Privacy Policy

Last updated: May 14, 2026

1. Overview

WhatLabels ("we", "our", or "us") provides a Chrome extension and website that enables live-stream sellers on Whatnot, eBay Live, and Poshmark Shows to automatically print item labels and view stream analytics. This Privacy Policy explains what data we collect, how we use it, how we store and protect it, what we share with third parties, and your rights regarding your data.

By installing the WhatLabels Chrome extension or creating a WhatLabels account, you consent to the data practices described in this policy.

2. Data We Collect

We collect only what is necessary to operate the service. Here is a complete list of data collected:

2a. Account Information

• Email address and display name — collected when you create an account (via email/password or Google Sign-In).
• Firebase Authentication UID — a unique identifier assigned to your account by Google Firebase.

2b. Subscription & Billing Data

• Plan information — your current subscription plan, billing status, and label usage counts.
• Payment data — billing is handled entirely by Stripe. We never see, access, or store your credit card number, CVC, or full card details. We receive only a Stripe customer ID and subscription status.

2c. Live Stream Data (Collected During Active Streams Only)

When you are on a live stream page on a supported platform (Whatnot, eBay Live, or Poshmark Shows) and the WhatLabels extension is active, we collect the following data from the stream page to provide label printing and analytics functionality:

• Sale events — item titles, buyer usernames, sale amounts, sale types (auction, buy-now, giveaway), and timestamps. This data is read from the live stream page via WebSocket message interception (Whatnot, eBay) or page state polling (Poshmark).
• Stream metadata — stream title, seller username, viewer counts, and stream duration.
• Chat messages — on Poshmark Shows, chat messages are captured for display in the extension's interface. Chat data is not stored on our servers.

This data is collected only while you are actively viewing a supported live stream page. The extension does not collect data from any other websites or when you are not on a live stream page.

2d. Stream Analytics & Reports

• Recap data — aggregated stream performance metrics (total sales, revenue, sales per minute, top buyers, viewer snapshots) are sent to our servers if you have the Stream Manager feature enabled. This data is used to generate post-stream reports accessible on the WhatLabels website.

2e. Locally Stored Data (Never Transmitted)

• Printer settings — your selected printer name, print engine, label layout preferences, and label appearance settings are stored locally on your device using Chrome's storage APIs.
• QZ Tray credentials — the signing certificate and private key for QZ Tray are stored locally in your browser's storage and are never transmitted to our servers or any third party.
• Current stream state — the list of sales, buyer numbers, and viewer data for the active stream session is stored locally in memory and Chrome storage. This data is used to render the extension's interface and is cleared when the stream ends.

2f. Support Assistant Data

• Support chat messages — if you use the built-in AI support assistant, your questions and account email are sent to OpenAI to generate responses. Use of the support assistant is optional.

3. How We Use Your Data

• To authenticate you and manage your subscription and account.
• To track label usage against your plan limits.
• To generate and print item labels during your live streams.
• To generate stream analytics reports and performance summaries.
• To provide AI-powered support assistance within the extension.
• To send transactional emails (password resets, billing receipts, support notifications) via your account email.
• To detect and alert our team about potential bugs or issues reported through the support assistant.

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as specifically described in Section 4 below.

4. Third-Party Services & Data Sharing

We share data with the following third-party services, solely to provide the WhatLabels service:

• Firebase / Google Cloud — authentication, database (Firestore), and cloud functions hosting. Your account data, subscription status, and stream recap data are stored in Google Firestore. Subject to Google's Privacy Policy.
• Stripe — payment processing. We share your email address with Stripe to create a billing customer. Stripe handles all payment card data. Subject to Stripe's Privacy Policy.
• OpenAI — AI support assistant. When you use the in-extension support chat, your messages and account email are sent to OpenAI to generate responses. Subject to OpenAI's Privacy Policy.
• Resend — transactional email delivery. Your email address is shared with Resend to send password resets, billing notifications, and support alerts. Subject to Resend's Privacy Policy.
• QZ Tray — a locally-installed print server. All communication between the extension and QZ Tray occurs entirely on your local device. No data is sent to QZ Technologies' servers.

We do not share data with any other third parties, data brokers, or advertising networks.

5. Data Storage & Security

• Cloud data — account information, subscription data, and stream recap reports are stored in Google Firebase (Firestore), protected by Firebase security rules and Firebase Authentication. All data is encrypted in transit (TLS) and at rest.
• Local data — printer settings, QZ Tray credentials, and current stream state are stored locally in your browser using Chrome's storage APIs (chrome.storage.local). This data never leaves your device.
• Access controls — server-side API endpoints require Firebase Authentication tokens. Admin functionality requires an additional admin role check. Firestore security rules restrict direct database access.

6. Data Retention

• Account data — retained for as long as your account is active.
• Stream recap data — retained for up to 90 days, after which it is automatically deleted by our cleanup processes.
• Support chat conversations — retained by OpenAI per their data retention policy. We do not separately store support conversations on our servers.
• Local data — retained in your browser until you uninstall the extension or clear browser data.
• Account deletion — you may request deletion of your account and all associated data at any time by contacting us at support@whatlabels.com or using the delete account option in your account settings. Upon deletion, all cloud-stored data associated with your account is permanently removed.

7. User Consent & Controls

• Installation consent — by installing the WhatLabels Chrome extension, you consent to the data collection practices described in this policy. The Chrome Web Store listing prominently discloses the permissions required by the extension.
• Stream data collection — sale event data is collected only when you are on an active live stream page on a supported platform. You can stop data collection at any time by navigating away from the stream page or disabling the extension.
• Support assistant — use of the AI support assistant is optional. Messages are only sent to OpenAI when you actively type and send a question in the support chat.
• Stream analytics — recap data is sent to our servers only when the Stream Manager feature is active. You can disable this by not linking a Whatnot account in the Stream Manager.
• Uninstall — you may uninstall the extension at any time to stop all local data collection. To delete cloud-stored data, contact us or use the account deletion option.

8. Permissions Used by the Extension

The WhatLabels Chrome extension requests the following browser permissions, each used for a specific purpose:

• Host permissions (whatnot.com, ebay.com, poshmark.com) — to read sale events from live stream pages on these platforms for label generation.
• storage — to store your printer settings, label layout preferences, and QZ Tray credentials locally on your device.
• identity — to enable Google Sign-In for account authentication.
• offscreen — to communicate with QZ Tray for label printing in the background.
• sidePanel — to display the WhatLabels interface as a browser side panel.

9. Children's Privacy

WhatLabels is not directed at children under 13. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 13, we will promptly delete it.

10. Your Rights

• You may request a copy of all data we hold about you.
• You may request correction of inaccurate data.
• You may request deletion of your account and all associated data.
• You may withdraw consent by uninstalling the extension and/or deleting your account.

To exercise any of these rights, contact us at support@whatlabels.com.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of the extension after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this privacy policy or our data practices, contact us at support@whatlabels.com.