Beamiro - Privacy Policy
Effective date: July 5, 2026
Last updated: July 5, 2026
Company: PayForSay s.r.o., Doležalova 3424/15C, Bratislava – Ružinov, 821 04, Slovakia, registered with Mestský súd Bratislava III, IČO: 54455073.
Contact: info@beamiro.com
DPO: PayForSay has not appointed a Data Protection Officer. Privacy requests may be sent to info@beamiro.com.
EU representative: Not applicable. PayForSay s.r.o. is established in the European Union.
Controlling language: English. Any translation is provided for convenience only.
This Privacy Policy explains how PayForSay s.r.o. (“PayForSay”, “we”, “us”, “our”) collects, uses, shares, stores, and protects personal data in connection with the Beamiro browser extension, website, backend services, subscriptions, support, and related services (the “Service”).
Beamiro is distributed via the Chrome Web Store under the listing names “Whatsapp Bulk Message” and “Bulk Whatsapp Sender”. Both listings refer to the same Service operated by PayForSay, and this Privacy Policy applies to both equally.
Beamiro is not affiliated with, endorsed by, sponsored by, or officially connected with WhatsApp, WhatsApp LLC, Meta Platforms, Inc., or any of their affiliates.
1. Summary
The Service helps Users prepare and send personalized bulk WhatsApp messages from their own WhatsApp account. To provide the Service, we may process the sender’s phone number/account identifier, uploaded recipient lists, recipient phone numbers and fields, message content, media attachments, campaign settings, usage counters, subscription activation data, technical data, and support/feedback data.
The Service uses backend infrastructure hosted with OVH GmbH / OVHcloud in Germany. The backend uses a MySQL database and a self-hosted WAHA component operated by PayForSay on the same OVH-hosted infrastructure. Website email is sent through Google email services. Payments and subscription checkout are handled by Lemon Squeezy as Merchant of Record.
Where you upload recipient lists or message content, you are responsible for having a lawful basis to process and send messages to those recipients. For that data, you are generally the controller and PayForSay acts as processor. For your own account, licensing, billing activation, support, security, analytics, and legal compliance data, PayForSay acts as controller.
2. Roles Under GDPR
2.1. PayForSay as controller. We act as controller for personal data we process for our own purposes, including account/license administration, subscription activation, purchase restoration, security, fraud prevention, support, feedback, legal compliance, website analytics, cookie consent management, and business records.
2.2. User as controller. You act as controller for Recipient Data and Campaign Data you upload or submit to the Service, including recipient phone numbers, names, cities, custom fields, message content, and media, where you decide who to contact, why, what to send, and on what legal basis.
2.3. PayForSay as processor. We process Recipient Data and Campaign Data on your behalf to provide the Service, subject to our Terms of Use and Data Processing Addendum. A separate signed Data Processing Agreement may be available for business Users on request where reasonably required.
2.4. If applicable law in your jurisdiction characterizes the roles differently for a specific processing activity, the parties will comply with the mandatory legal characterization.
3. Personal Data We Process
| Category | Examples | Source | Purpose | Location | Retention |
|---|---|---|---|---|---|
| Account and sender data | sender phone number, WhatsApp account identifier, license/account association | User / extension | authorization, limits, Service operation, abuse prevention | OVH Germany backend / MySQL | while active + 1 year after last use or account/subscription end |
| Subscription and payment activation data | email, order ID, subscription status, plan, license status, refund/chargeback status | Lemon Squeezy / User | billing activation, purchase restoration, subscription access, records | Lemon Squeezy and PayForSay backend | while active + 1 year; legal/accounting records as required by law |
| Payment card data | card number, payment credentials | Lemon Squeezy / payment providers | payment processing | Lemon Squeezy/payment providers | not stored by PayForSay |
| Recipient Data | phone numbers, names, cities, imported fields, custom variables | User upload/import | preparing and sending campaigns | OVH Germany backend / MySQL | until deleted by User or 1 year after last use, whichever occurs earlier |
| Message and campaign content | message text, spin syntax, templates, media attachments, documents, images, videos | User | campaign preparation, personalization, sending workflow | OVH Germany backend/storage | until deleted by User or 1 year after last use, whichever occurs earlier |
| Technical data | IP address, approximate location/country, browser, device, extension version, timestamps, logs | automatically | pricing by country/tier, security, fraud prevention, troubleshooting, compatibility | backend/log systems | 12 months, longer if needed for security, fraud, legal claims, or disputes |
| Usage data | counters, plan limits, campaign status, sending status, feature usage | automatically | limits, reporting, abuse prevention, Service improvement | PayForSay backend | while active + 1 year after last use or account/subscription end |
| Support and feedback | support emails, feedback text, ratings, screenshots or files provided by User | User | support, product improvement, dispute handling | Google email services and internal systems | 3 years after the last support interaction, longer if needed for legal claims |
| Website and cookie data | cookie identifiers, consent preferences, analytics events, marketing pixels | website visitor/browser | website operation, analytics, marketing if consented | website/cookie providers | see Cookie Policy |
4. How the Service Processes Campaign Data
4.1. When you use the Service, data may be transferred from the browser extension to our server infrastructure and processed there to operate the Service. This may include sender identifiers, uploaded recipient lists, message content, media attachments, templates, campaign settings, sending counters, and status data.
4.2. We use this data to provide the Service, including campaign preparation, personalization, sending workflow, license limits, reporting, troubleshooting, abuse prevention, security, and support.
4.3. We do not sell Recipient Data or message content.
4.4. We do not use Recipient Data or message content for unrelated advertising, credit scoring, lending decisions, or unrelated third-party purposes.
4.5. We do not control WhatsApp, Meta, recipient devices, telecom networks, or browser platforms. Data may also be processed by those third parties when you use their services.
5. Legal Bases for Processing
Where PayForSay acts as controller, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| providing the Service, account/license management, subscription activation, purchase restoration | performance of a contract or steps before a contract |
| security, fraud prevention, abuse prevention, troubleshooting, enforcing Terms | legitimate interests |
| legal, tax, accounting, compliance, dispute handling | legal obligation and/or legitimate interests |
| support and feedback | performance of contract and/or legitimate interests |
| website analytics and marketing cookies/pixels | consent where required |
| service improvement using aggregated or non-identifying data | legitimate interests |
Where PayForSay acts as processor, the User is responsible for identifying and documenting the legal basis for processing Recipient Data and Campaign Data.
6. Recipient Data and User Responsibility
6.1. You are responsible for ensuring that recipients have validly consented or that you otherwise have a lawful basis to send messages to them.
6.2. You must provide all notices, disclosures, opt-out mechanisms, and rights mechanisms required by applicable law.
6.3. If a recipient contacts us about a message sent by you, we may redirect the recipient to you, ask you to handle the request, suspend your account, delete relevant data, or take other actions required by law or necessary to protect rights and safety.
6.4. You must not upload special categories of personal data, sensitive data, children’s data, payment card data, identity documents, passwords, authentication secrets, or other high-risk data unless you have a lawful basis and our prior written permission.
7. Sharing and Subprocessors
We may share personal data with the following recipients and subprocessors where necessary:
| Recipient / subprocessor | Role | Purpose | Location / transfer mechanism |
|---|---|---|---|
| Lemon Squeezy | Merchant of Record / payment and subscription provider | checkout, payments, taxes, invoices, refunds, chargebacks, subscription status, license activation | may process in the EEA, United States, or other locations under its own terms and transfer safeguards |
| OVH GmbH / OVHcloud | hosting / infrastructure provider | hosting backend, MySQL database, storage, logs, campaign processing, self-hosted WAHA component | Germany / EEA |
| Google email services | email provider | sending and receiving support and transactional email | may process in the EEA, United States, or other locations under Google’s transfer safeguards |
| Google Analytics | analytics provider | website analytics subject to consent where required | may process in the EEA, United States, or other locations under Google’s transfer safeguards |
| Meta Pixel / Meta Platforms | marketing pixel/ad provider | advertising and conversion measurement subject to consent where required | may process in the EEA, United States, or other locations under Meta’s transfer safeguards |
| Custom cookie banner operated by PayForSay | consent management | stores cookie consent preferences and enables consent withdrawal/change | PayForSay website / OVH Germany, plus local browser storage |
| Professional advisers and authorities | independent recipients | legal, accounting, compliance, enforcement | as required by law |
We do not use a separate support CRM/helpdesk provider at this time; support is handled by email. A current list of core subprocessors is maintained in this policy and may also be requested at info@beamiro.com. We may also disclose data where required by law, court order, regulator request, platform enforcement request, or to protect rights, safety, security, and the Service.
8. International Transfers
Our core backend, MySQL database, storage, and self-hosted WAHA component are hosted in Germany with OVH GmbH / OVHcloud.
Some providers, including Lemon Squeezy, Google, and Meta, may process personal data outside the EEA. Where personal data is transferred outside the EEA or another protected jurisdiction, we will rely on an appropriate transfer mechanism where required, such as an adequacy decision, Standard Contractual Clauses, supplementary measures, or another lawful mechanism.
9. Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.
| Data | Retention |
|---|---|
| Account and sender data | while active + 1 year after last use or account/subscription end |
| Subscription/license activation data | while active + 1 year; legal/accounting records as required by law |
| Recipient Data | until deleted by User or 1 year after last use, whichever occurs earlier |
| Message and campaign content | until deleted by User or 1 year after last use, whichever occurs earlier |
| Media attachments | until deleted by User or 1 year after last use, whichever occurs earlier |
| Technical and security logs | 12 months, longer if needed for security, fraud, legal claims, or disputes |
| Usage counters and campaign status | while active + 1 year after last use or account/subscription end |
| Support and feedback | 3 years after the last support interaction, longer if needed for legal claims or disputes |
| Cookie/analytics data | see Cookie Policy |
| Legal/accounting records | as required by applicable tax, accounting, payment, and legal obligations |
Backups may retain data for up to 90 additional days before automatic deletion, unless longer retention is required for security, restoration, fraud prevention, legal claims, or compliance.
10. Security
We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These may include encryption in transit, server access controls, authentication, logging, least-privilege access, monitoring, backups, incident response, and limiting production access to authorized personnel.
No method of transmission or storage is completely secure. You are responsible for securing your own devices, browser profile, WhatsApp account, email account, and access credentials.
11. Personal Data Breaches
Where required by law, we will notify the competent supervisory authority and/or affected individuals of a personal data breach. Where we act as processor for Recipient Data, we will notify the relevant User/controller without undue delay after becoming aware of a breach affecting that data, as required by applicable data protection law.
12. Your Rights
Depending on your location and the type of processing, you may have the right to:
- access your personal data;
- correct inaccurate data;
- delete data;
- restrict processing;
- object to processing;
- receive a copy of data in portable format;
- withdraw consent where processing is based on consent;
- complain to a supervisory authority.
To exercise rights, contact us at info@beamiro.com. We may need to verify your identity. We aim to respond within one month where GDPR applies; this period may be extended by up to two further months for complex or numerous requests, with notice where required. Where a request concerns Recipient Data controlled by a User, we may redirect the request to that User or assist the User as processor.
For Slovakia, the supervisory authority is the Office for Personal Data Protection of the Slovak Republic. Depending on your location and the processing at issue, you may also have the right to complain to the supervisory authority in your EU/EEA country of residence, place of work, or place of alleged infringement.
13. Cookies and Similar Technologies
Our website may use cookies, local storage, pixels, and similar technologies. Strictly necessary cookies may be used without consent where permitted. Analytics and marketing cookies/pixels are used only with consent where required. See our Cookie Policy for details.
14. Browser Extension Disclosures
The browser extension may require browser permissions and access to pages or data necessary to provide the Service. The current extension manifest includes the following permissions: tabs, storage, scripting, and webNavigation.
The extension includes a content script and host permission for https://web.whatsapp.com/* so that it can operate on WhatsApp Web pages and support the message preparation and sending workflow requested by the User.
The extension may use browser storage for settings, templates, counters, or session-related information; may communicate with PayForSay backend servers for subscription/license validation, campaign processing, limits, status, and support; and may process CSV/Excel recipient lists and message/media content when uploaded or used by the User.
The development manifest reviewed during preparation also contained http://localhost:3000/* host permissions and an externally_connectable entry for localhost. These should be removed from production builds unless they are genuinely required and properly disclosed in the Chrome Web Store listing and this Privacy Policy.
Before publication, ensure Chrome Web Store data disclosure, in-product disclosure, and this Privacy Policy are consistent.
15. Children
The Service is intended for business and professional communication use and is not directed to children. You must be at least 18 years old to use the Service. You must not use the Service to upload children’s personal data or contact children unless you have a lawful basis and comply with all applicable child protection and privacy laws.
16. Third-Party Services
The Service may interact with third-party services such as WhatsApp, Meta, Lemon Squeezy, browser providers, analytics providers, hosting providers, and email providers. Their processing is governed by their own terms and privacy policies where they act independently. We do not control their systems or decisions.
17. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date. Where required by law, we will provide additional notice.
18. Contact
PayForSay s.r.o.
Doležalova 3424/15C, Bratislava – Ružinov, 821 04, Slovakia
IČO: 54455073
Email: info@beamiro.com