Privacy Policy
Last updated: October 2, 2026
The short version: the WhatsApp tools on this site run in your browser, so the messages and phone numbers you type are never sent to us. We have no user accounts and collect no personal data to operate the tools. Analytics and advertising cookies are off by default and only activate if you accept the cookie banner.
Who is responsible for your data (data controller)
Pro Commons Developers SLNIF: ESB55412076
Spain
Web: procom.dev
Contact: via the contact form
Pro Commons Developers SL is the data controller for any personal data processed through wha.tools, within the meaning of the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Spanish LOPDGDD (Ley Orgánica 3/2018). For anything in this policy, reach us through the contact page.
Processing at a glance
Everything this site does with personal data, summarized. Each activity is described in detail in the sections below.
| Activity | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Contact form | Message; name and email if you provide them | Reading and answering your enquiry | Consent: Art. 6(1)(a) | Deleted once the conversation is resolved |
| Server logs | IP address, user agent, requested URL, timestamp | Security, abuse prevention, debugging | Legitimate interest: Art. 6(1)(f) | Rotated on a short schedule (weeks, not months) |
| Analytics (GA4, Clarity) | Pseudonymous usage identifiers, device/page data | Aggregated usage statistics | Consent: Art. 6(1)(a); nothing runs until you accept | Per cookie lifetimes: up to 2 years (see cookie policy) |
| Advertising (AdSense or Ezoic) | Ad identifiers and cookies | Serving and measuring ads | Consent: Art. 6(1)(a); ad storage denied until you accept | Per cookie lifetimes: up to 13 months (see cookie policy) |
The free tools themselves are absent from this table on purpose: they run in your browser and process nothing on our side.
What we do not collect
The site has no registration, no accounts and no newsletters. The link generator and QR generator build their output entirely on your device: the phone numbers, messages and QR codes you create are never uploaded, stored or logged by us.
The one thing that does touch our server
The share widget tool can fetch the title, description and preview image of a web page for you. To do that, the URL you enter is sent to our server, which requests that page's public metadata and returns it to your browser. The URL is processed only to answer your request; we do not build a database of fetched URLs.
The contact form
If you write to us through the contact form, the message you type (and the name and email address, if you choose to give them) is stored on our server so we can read it and, when you asked for one, reply. We use it for nothing else: no mailing lists, no marketing, no sharing with third parties. Messages are deleted once the conversation is resolved. Providing an email address is optional; without one we simply can't reply.
Server logs
Like virtually every website, our hosting infrastructure keeps standard technical logs of requests (IP address, user agent, requested URL, timestamp). We use them only for security monitoring, abuse prevention and debugging, and they are rotated on a short schedule. The legal basis is our legitimate interest in keeping the service secure and working.
Cookies and consent
When you first visit, a consent banner asks whether you accept analytics and advertising cookies. In the EEA, the UK and Switzerland the question may instead come from Google's consent message, a consent platform certified under the IAB Transparency & Consent Framework that also lets you choose by purpose and by advertising partner. Until you accept, Google Consent Mode v2 keeps analytics and ad storage set to denied. Declining or ignoring the banner means those cookies are not used. Your choice is remembered in a single first-party cookie for 180 days. The full list of cookies and how to change your choice is in the cookie policy.
Analytics
With your consent, we use Google Analytics 4 (with IP anonymization), optionally Google Tag Manager, and Microsoft Clarity to understand how the site is used: which pages are visited, on what kind of device, and where the tools confuse people. This data is aggregated usage information; we do not use it to identify individuals. Google and Microsoft act as processors and may process this data on servers outside the EEA under the EU–US Data Privacy Framework and standard contractual clauses.
Advertising
The site is supported by display ads served through our advertising provider: currently either Google AdSense or Ezoic (the provider may change over time). With your consent, the active provider, Google, and their certified advertising partners may set their own cookies and similar identifiers to serve and measure ads, including personalized ads. Without consent, ad personalization and ad storage remain disabled. You can read how Google uses data from partner sites at policies.google.com/technologies/partner-sites and manage ad personalization at adssettings.google.com . When Ezoic is the active provider, its privacy policy and full list of advertising partners are at ezoic.com/privacy-policy .
Affiliate links
Some guides link to third-party services through affiliate links, marked with rel="sponsored" and disclosed on the page. Clicking one takes you to the third party's site under their own privacy policy; we do not pass them any personal data about you.
Who receives your data
We never sell personal data, and we share it only with the service providers needed to run the site, acting as processors on our behalf:
- Google (Google Ireland Limited / Google LLC): analytics and advertising, only after you consent.
- Ezoic (Ezoic Inc. / Ezoic Limited): display advertising and ad measurement when it is the active ad provider, only after you consent.
- Microsoft (Microsoft Ireland Operations Ltd / Microsoft Corporation): Clarity usage analytics, only after you consent.
- Our hosting provider: operates the server this site runs on, which processes requests (and therefore IP addresses) as any web server does.
Where these providers process data outside the European Economic Area (notably in the United States), the transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. Data may also be disclosed where the law requires it (courts, public authorities).
Your rights
Under the GDPR you can ask us for access to, rectification or erasure of personal data, restriction of or objection to processing, and data portability, and you can withdraw consent at any time (see the cookie policy for how). Send your request through the contact form and we'll respond within a month. You also have the right to lodge a complaint with a supervisory authority: in Spain, the AEPD ( aepd.es ).
In practice, note that we hold almost nothing: because the tools run in your browser and there are no accounts, in most cases there is no personal data on our side to retrieve or delete beyond short-lived server logs.
Children
The site is not directed at children and we do not knowingly collect personal data from them.
Changes to this policy
If we change how the site handles data, we'll update this page and the date at the top. Significant changes will be visible from the site itself (for example, a new tool behaving differently would say so on its own page).