Is a WhatsApp extension safe? How to evaluate it (and how Zapext handles your data)

How to evaluate any WhatsApp Web extension

There is a reason to be careful. In October 2025, Brazilian tech outlet Canaltech reported 131 Chrome extensions running inside WhatsApp Web as part of a spam campaign in Brazil (article in Portuguese). According to security firm Socket, quoted in the report, they were clones of the same automation tool, listed on the Chrome Web Store, with around 20,000 combined users, built to get around WhatsApp's anti-spam controls. In other words, being on the store does not guarantee an extension is right for you. Use these criteria:

1. Who publishes it. Check the developer name on the extension's Chrome Web Store page, and whether there is a website, contact details and a privacy policy. Be wary of extensions with no identifiable company, or of several near-identical extensions under different names.
2. Reviews and number of users. Read the most recent reviews, not just the rating. Complaints about slowness, unexpected ads or messages sent without your action are red flags. A high rating with very few reviews says little.
3. Last update date. WhatsApp Web changes often. An extension that has not been updated in many months tends to break and may have been abandoned. The date appears on the extension's store page.
4. Permissions. Any extension that adds features to WhatsApp Web needs to read and change that page: that is how it shows buttons, panels and tags next to your chats. What matters is access beyond that, such as to every site you visit, your history or your downloads. See below where to check.
5. Where the data goes. Read the privacy policy: what is collected, whether your chats leave your computer, who the data is shared with and how to request deletion. If the extension has no privacy policy, that is already an answer.

Where to check an extension's permissions

1. On the extension's Chrome Web Store page, scroll to the privacy section. That is where the developer declares what data it collects and how it is used.
2. When you install, Chrome shows a dialog listing what the extension will be able to access. Read it before confirming.
3. After installing, open chrome://extensions, click Details on the extension and review its permissions and site access. In many cases you can limit access to specific sites.

Red flags

• It asks for your WhatsApp password or verification code, or for a QR code scan on any page other than the official WhatsApp Web (web.whatsapp.com).
• It promises your number will never be banned, or teaches you how to get around WhatsApp's limits and anti-spam systems.
• It asks for access to all sites, your history or your downloads without explaining why.
• It has no privacy policy, no identifiable developer and no support channel.
• Its behavior suddenly changes: new ads, messages sent on their own, redirects.
• It lives outside the Chrome Web Store and asks you to install it from a file or through developer mode.

How Zapext handles your data

We hold ourselves to the criteria above. This is what you can expect from Zapext:

What reaches Zapext

To keep your account and subscription running, we process sign-up data (name, email and phone), payment data through the payment processor (Zapext does not store card data) and technical logs about how the extension is working, without the content of your chats. The full list, purposes and retention periods are in our Privacy Policy.

Check Zapext yourself

1. Open Zapext's Chrome Web Store page and look at the developer, the last update date, the reviews and the privacy section.
2. After installing, open chrome://extensions, click Details on Zapext and review its permissions and site access.
3. Still have questions? Talk to our support team before you subscribe.

Responsible use and WhatsApp's rules

Zapext is not affiliated with WhatsApp or Meta. WhatsApp's rules apply to anyone using any tool, Zapext included: WhatsApp's Terms of Service and its Business Messaging Policy restrict bulk, automated and unsolicited messages. Numbers that get many reports or blocks can be restricted by WhatsApp, and no tool can guarantee otherwise.

In practice:

• Only message people who gave you their number and agreed to hear from your business (opt-in).
• Keep a reasonable, spaced-out volume, especially on new numbers.
• Make it easy to opt out and respect anyone who asks to stop receiving messages.
• Send what is relevant to each contact instead of the same message to your whole list.

You are responsible for how you use the tool and for complying with WhatsApp's policies and the law, as set out in our Terms of use.

Data protection and your rights

Zapext processes personal data in line with Brazil's General Data Protection Law (LGPD, Law 13.709/2018). Our Privacy Policy covers the data we collect, the legal bases, who we share it with, how long we keep it and how to exercise your rights as a data subject, such as access, correction, portability and deletion. Rules on subscription, cancellation and refunds are in our Terms of use.

If you use WhatsApp to serve customers, your business also processes their personal data. Keeping the CRM on your computer helps you stay in control, but it does not replace your own obligations: have a legal basis for each contact, use the data only for the agreed purpose and honor deletion requests.

Security FAQ