01 Introduction & Core Philosophy
Welcome to LaterPro ("we", "us", "our", or the "Platform"). We provide enterprise-grade WhatsApp automation, bulk messaging, real-time customer messenger synchronization, and REST API dispatch infrastructure.
We believe that business messaging tools must earn your trust through architectural transparency. Unlike legacy bulk messaging gateways that centralize and store phone books for marketing monetization, LaterPro is engineered on a Zero-Knowledge Multi-Tenant Architecture. Your credentials, session keys, and message logs belong exclusively to your account container.
02 Information We Collect
To operate the Platform securely and reliably, we process the following categories of information:
- Account Credentials: Username, email address, cryptographically hashed passwords (using industry-standard bcrypt with high salt factor), and your unique REST API Key.
- Cryptographic Session Tokens: When you link your WhatsApp account by scanning the QR code, the WhatsApp Baileys socket handshake generates localized session auth keys (pre-keys, signed identity keys, session hashes). These are stored in an isolated, sandboxed directory on our secure cloud server.
- Broadcast Dispatch Inputs: Phone numbers and text/media payloads submitted by you during manual single sending, CSV uploads, or API calls, needed solely to execute the requested transmission.
- Operational Telemetry: Transmission timestamps, message delivery ticks (sent, delivered, read), error codes, and audit logs to enable troubleshooting and delivery reporting in your portal.
03 Information We NEVER Collect or Store
To preserve absolute user privacy, our software intentionally avoids collecting:
- We do not access your personal WhatsApp profile photos, WhatsApp status stories, call logs, or private 1-on-1 personal conversations unrelated to the phone numbers you engage with through our system.
- We do not store bank accounts, credit card numbers, or payment instruments on our application servers. Payment processing is delegated to certified PCI-DSS Level 1 compliant gateways.
- We do not build shadow demographic profiles, credit scores, or behavioral advertising graphs of your recipients.
04 Multi-Tenant Session Isolation & Security
Security is the cornerstone of our engineering. Here is how your WhatsApp connection is isolated:
| Component | Isolation Standard | Security Guarantee |
|---|---|---|
| Auth Session Storage | Sandboxed filesystem folder /auth_sessions/[userId] |
No user or socket can access or read another user's session credentials. |
| Database Isolation | Tenant-scoped MongoDB schemas with strict userId index queries |
Data queries are strictly restricted to the authenticated user's JWT ID. |
| Transmission Encryption | TLS 1.3 in-transit and AES-256 at-rest | All API communications, QR code websockets, and SSE streams are encrypted. |
| Real-Time SSE Inbox | Authenticated EventSource stream validation | Live incoming messages are piped only to the verified account owner. |
05 Message Payloads & Retention Policy
We enforce strict data minimization practices:
- Transient Media Handling: Images, videos, and documents uploaded for broadcasts are stored temporarily in isolated storage and are automatically cleaned up according to our media retention cycle.
- Message History Retention: Chat threads and message delivery states are stored only as long as you maintain your account on the Platform to allow you to review delivery history and reply to client inquiries.
- Instant Session Purge: When you click "Disconnect Session" on the Session Manager tab, your entire Baileys auth session folder, cryptographic tokens, and live socket connection are immediately deleted from disk.
06 Anti-Spam & Contact Consent Obligations
LaterPro is built for legitimate enterprise transactional alerts, order updates, customer service replies, and opt-in promotional updates.
07 Cookies, Google AdSense & Third-Party Advertising
LaterPro is a 100% Free Service. To support infrastructure and server operating expenses without charging subscription fees to users, we display non-intrusive advertisements from verified third-party advertising networks, including Google AdSense.
Google AdSense & Third-Party Advertising Cookies
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to our website or other websites across the Internet.
- Google's use of advertising cookies enables it and its certified partners to serve relevant ads to users based on their visits to our platform and/or other sites on the World Wide Web.
- Users may opt out of personalized advertising at any time by visiting Google Ads Settings or through the Network Advertising Initiative at aboutads.info.
Essential Application Storage
In addition to standard ad delivery cookies, the Platform utilizes localized browser storage strictly essential to maintain authenticated operations:
wa_token(localStorage): Secure JSON Web Token (JWT) required to maintain your active authenticated login state.currentUser(localStorage): Basic display profile (username, email) to personalize your dashboard interface.
08 International Compliance (GDPR, CCPA, DPDP Act 2023)
We honor the privacy rights of users across international jurisdictions:
- General Data Protection Regulation (GDPR - EU): Legal basis for processing is performance of contract (to provide automation services requested by you). EU residents possess full rights to data portability, rectification, and erasure.
- California Consumer Privacy Act (CCPA - USA): We do not sell personal data. California residents may request disclosure of any personal data maintained.
- Digital Personal Data Protection Act (DPDP Act 2023 - India): Data is processed exclusively for specified lawful purposes with strict consent boundaries and user-accessible grievance redressal mechanisms.
09 Data Subject Rights & 1-Click Erasure
You have the absolute right to:
- Access: Request a complete export of your stored contacts, campaign statistics, and scheduled tasks.
- Rectification: Update your account details, credentials, or API tokens anytime via the portal.
- Right to be Forgotten: Request the total and permanent deletion of your account, message history, and database records by contacting our support team or triggering automated session disconnect.
10 Contact Our Data Protection Officer (DPO)
If you have questions, inquiries, compliance requests, or wish to exercise your legal data rights, please reach out to our dedicated privacy office:
Email: privacy@laterpro.in / support@laterpro.in
Response SLA: Within 24-48 business hours.
Headquarters: Ahmedabad, Gujarat, India.