1. Who operates WholeShot
WholeShot is operated by vaisoft. Our business registration number is 238-70-00743. Our business address is J866, 8F, City Plaza, 191 Dongbaekjungang-ro, Giheung-gu, Yongin-si, Gyeonggi-do, Republic of Korea. Contact support@vaisoft.io for privacy questions and requests.
2. Captures and edits stay on your device
The extension processes screenshots, captured page URLs and annotations locally in Chrome. It does not upload them to vaisoft, Paddle or the licensing service. Images and metadata, including source URL, title, capture time, dimensions and hashes, remain in local IndexedDB. The latest batch is kept for ZIP export; apart from that batch, up to 30 recent results are retained within the storage budget. The total can exceed 30. Edits stay in the result tab’s memory until refresh or close. Exporting a crop or hide box does not erase the stored original. The separate original-download action includes content hidden in the edited view. Hide boxes cover annotations and remove intersecting PDF links; other metadata, including stamps and batch captures.json, can still contain URLs. The batch URL draft remains in localStorage until cleared or the extension is removed. Batch progress uses session storage. Language and capture settings can use Chrome Sync; licensing credentials do not. Downloaded files require separate deletion. Visiting or capturing a page still makes ordinary requests to that website, which follows its own privacy practices.
3. Purchases and license verification
Paddle handles checkout, payment details, receipts and subscription billing. WholeShot does not receive card numbers. The licensing service uses Cloudflare Workers and D1. It stores a SHA-256 hash of the license key, the purchase email and its hash, an installation name you choose, random license, installation and activation identifiers, Paddle customer, subscription and transaction identifiers, access and subscription status, paid-period dates and creation, verification, activation and deactivation times. Minimal payment-event records contain relevant identifiers and processing or retry times and counts. A manual key replacement records the verified transaction identifier and replacement time. The service receives keys over HTTPS to check their hash. Installation names are provided by you; the service does not collect hardware identifiers or browser fingerprints. It does not store raw license keys, your full name, postal address, card details, screenshots or captured page URLs. Cloudflare sends sign-in emails. Sign-in links expire after 10 minutes and require the confirmation code shown in the browser where you requested access. The database stores hashes of authentication secrets and the state needed to confirm and manage sessions, which expire after 30 days. The owner uses a separate Cloudflare Access login to view purchase status and registered installations; customer credentials do not grant administrator access. Paddle processes information under its Paddle Privacy Policy; Cloudflare infrastructure is covered by the Cloudflare Privacy Policy.
4. Browser storage and access checks
The checkout page keeps the license key in this browser’s local storage so it can check payment status and show the key after server verification. Sandbox and live credentials are stored separately. Email sign-in sessions are stored locally in the browser that requested them and are not synced through Chrome Sync. Signing out removes the local session and revokes it on the server. You can remove the saved key with the control on the checkout or management page. The extension keeps its activation credentials locally and caches a verified status for ordinary display in browser-session storage for 15 minutes; PRO actions request another check. During a temporary service outage, a previously verified entitlement may remain usable for at most 72 hours, never beyond its paid expiry. An explicit rejection removes cached access, and restarting the browser requires an online check. A failed deactivation disables local PRO while retaining the information needed to retry releasing the installation. A browser event alone does not grant PRO access.
5. Security and retention
WholeShot API request logging is disabled and no raw webhook payloads are kept. Expired sign-in requests and sessions are eligible for deletion by scheduled maintenance; request links expire after 10 minutes and sessions after 30 days. Infrastructure providers can still process technical connection information. Completed minimal payment-event records are eligible for deletion 30 days after receipt; records awaiting successful processing remain until resolved. Rate limiting uses a salted hash of the requesting IP address, retained for 24 hours. Unpaid checkout records are eligible for deletion after 24 hours once Paddle confirms transaction cancellation; failed cancellation checks are retried. License and associated installation records are deleted after 180 days once final subscription cancellation and the end of paid access are confirmed. Key-replacement audit records share the lifetime of the associated license. Paused or past-due subscriptions are kept while recovery is possible. Disconnected installation records are eligible for deletion after 30 days. Scheduled maintenance performs deletion; delays or outages may postpone it. Deletion from the active database does not immediately erase provider backups or Cloudflare D1 Time Travel recovery data, which follow provider recovery retention. Browser-stored keys remain until you remove them or clear site storage. Paddle keeps its own payment records according to its policies and legal obligations.
6. Support and your choices
Support messages are used to answer your request and are normally retained for one year after resolution, unless a legal obligation or unresolved dispute requires longer retention. Do not email your full license key, card details or private screenshots. Contact support@vaisoft.io to request access, correction or deletion, or to ask about a lost key. We verify purchase ownership before issuing a replacement key and invalidating the previous key. Deleting a local key or uninstalling the extension does not cancel the subscription; use the billing portal or contact support.
7. Limited use
Information is used only for the stated capture, editing, export, licensing, payment, security and support functions. It is not sold or used for personalized advertising, creditworthiness, lending decisions or unrelated purposes. Use of Chrome API information follows the Chrome Web Store User Data Policy, including Limited Use requirements.
8. Website infrastructure
The product pages and licensing service use Cloudflare infrastructure. Technical requests may be processed outside your country. An Asia-Pacific database location preference does not guarantee storage in South Korea or restrict all processing to that region. See D1 location guidance and D1 recovery retention. The website’s contact form uses Cloudflare Turnstile and the existing vaisoft contact service; the company privacy policy also explains that form. No advertising or analytics SDK is added to WholeShot’s licensing flow.