BaseReach

Privacy Policy

Last updated: 23 September 2026 · Applies to the BaseReach panel for Lark Base and the BaseReach Bridge Chrome extension. Operated by Systransform (“we”, “us”).

This policy explains what data BaseReach processes, what stays on your computer, and what is sent to our servers. It is written for people who install BaseReach from a Lark Base, and for the Chrome Web Store listing of the Bridge extension.

What BaseReach does

BaseReach lets a person in your Lark organisation send personalised WhatsApp messages to contacts listed in their own Base table, through their own WhatsApp Web session. Messages are composed in the browser from the table you choose and sent one at a time from that browser. Status can be written back to the table, and replies can be shown in the panel or stored in a table you choose.

Data processed only in your browser

The following is read or held on your computer. It is not sent to Systransform’s servers:

• Table contents — names, phone numbers, message text, attachments and any other fields you include in a template. The panel reads them with your Lark Base permissions and passes send jobs to the Chrome extension in the same browser.
• WhatsApp messages — outbound and inbound messages go through your own WhatsApp Web tab. WhatsApp (Meta) processes that traffic under WhatsApp’s terms and privacy policy. We do not receive message bodies, captions or media on our servers.
• Extension storage — the current send job (including phone numbers and message text) is kept in chrome.storage.local. Incoming replies (phone, display name, message text, type, time) are kept there too, up to a few hundred recent items, so the panel can show them and, if you choose, write them into your Base.
• Attachments — files you send with a job are held in IndexedDB in the extension, keyed only for that job, and cleared when the job is cleared. Maximum size is 16 MB per file.
• Panel preferences — the panel may remember a local API origin or which extension build answered, in the browser’s localStorage.

Data sent to our servers

When the panel can talk to the BaseReach API, we receive:

• Organisation registration you type in: company name, person in charge, email, phone, country and optional industry.
• Identity from Lark Base — your organisation’s tenant key and your Lark user identifiers, used to attribute the session and usage to your organisation. We do not receive your Lark password.
• Optional Base check — if the panel can obtain a personal Base token, the API may call Lark once to confirm you have that Base open. The token is not stored. We keep only a yes/no “verified” flag on the user record.
• Usage counts — per send job: job id, whether it was a dry run, total / sent / failed counts, and start/finish times. No message text, phone numbers, names or attachments are included.

We use this to operate the service, know which organisations are using it, support you, apply blocks, and (later) bill from usage counts. We do not sell personal data. We do not use your table contents or WhatsApp messages to train AI models — those contents never reach our servers.

How we use it

• To provide BaseReach: registration, session status, usage totals shown in the panel, and operator support.
• To contact the person named on the registration about the service.
• To secure the service (for example blocking an organisation) and to produce aggregate usage figures per organisation.

Chrome extension permissions

The BaseReach Bridge extension asks only for what it needs to send from your WhatsApp Web tab:

• https://web.whatsapp.com/* — to send a message or read a reply inside that tab when you start a job or reply from the panel.
• storage — to keep the current job and recent replies on your computer.
• tabs — to find or open the WhatsApp Web tab.

The extension talks only to the BaseReach panel origins listed in its manifest (including https://basereach.systransform.ai) and to WhatsApp Web. It does not read other sites, does not track browsing, and does not inject ads or analytics.

Where data is stored

Registration, identity and usage records are stored on BytePlus infrastructure in Singapore / Southeast Asia, in a PostgreSQL database on the same deployment as DocForge but in separate BaseReach tables. A DocForge registration or block does not apply to BaseReach, and the reverse. Data is encrypted in transit (TLS) and at rest. Browser-side job data and replies stay on the computer that has the extension installed.

Data isolation

Every server record is scoped to your Lark organisation (tenant). Users of one organisation cannot see another organisation’s registration or usage. Systransform operators can see registration details and usage counts in the operator console in order to support the product.

Sub-processors

• BytePlus (ByteDance Pte. Ltd., Singapore) — hosting and database.
• Lark (Lark Technologies Pte. Ltd.) — identity via the Base SDK, and the optional Base token check.
• WhatsApp / Meta — message delivery through your own WhatsApp Web session. We do not send your message content to Meta except via that session you control.

Cookies and similar technology

The public BaseReach pages do not use advertising or analytics cookies. The panel and extension use local browser storage as described above, not third-party trackers.

Retention and deletion

• Registration and usage records are kept while your organisation uses BaseReach.
• Uninstalling the Chrome extension removes its local job, reply and attachment data from that browser.
• Removing the panel from a Base does not by itself delete server records. Email us to delete your organisation’s BaseReach records; we will do so on written request.
• You can edit registration details from the panel (when registration is enabled) or by asking us.

Your rights

Systransform is based in Malaysia. This policy is governed by Malaysian law, including the Personal Data Protection Act. Organisation administrators and individuals may ask us to access, correct or delete personal data we hold, or ask a question about this policy, by emailing the address below. If you are not satisfied, you may complain to the Personal Data Protection Commissioner of Malaysia.

Children

BaseReach is a workplace tool. It is not directed at children, and we do not knowingly collect data from anyone under 18.

Your responsibilities

You are responsible for messaging only people who agreed to hear from you, for the contact data in your Base, and for complying with WhatsApp’s terms and the laws that apply to you, including anti-spam and data protection law. See the Terms of Service.

Changes

We will update this page when the policy changes and change the date at the top.

Contact

Systransform · support@systransform.ai · basereach.systransform.ai

This page is the privacy policy for BaseReach. It is not the sending panel.