Data Processing Agreement

What is processed

Subject and purpose: providing Commentoro to the agency — reading, sorting and answering the comments and direct messages left on the Facebook and Instagram accounts the agency connects, and hiding or deleting them under the agency's settings.

People concerned: the people who comment on, or send messages to, those accounts.

Data: their public name, handle and profile identifier, what they wrote, and anything attached to it.

Duration: for as long as the agency uses Commentoro, and then until it is deleted as set out below.

Commentoro's commitments

Commentoro will:

• process the data only on the agency's documented instructions, which are these terms and the settings the agency chooses in Commentoro, unless the law requires otherwise;
• make sure everyone who can access the data is bound to keep it confidential;
• keep appropriate technical and organisational security measures, including encryption in transit and at rest and separation of each agency's data;
• help the agency answer requests from the people concerned and meet its own obligations, as far as Commentoro reasonably can;
• tell the agency without undue delay after becoming aware of a personal data breach affecting its data;
• make available the information needed to show it meets this agreement, and allow reasonable audits on reasonable notice;
• not use the data to train AI models.

Sub-processors

The agency authorises Commentoro to use the following categories of sub-processors, each bound by data protection terms at least as protective as these. The names of the services in each category are sent by email to the agency on request to privacy@commentoro.com. Commentoro will tell the agency 30 days before adding or replacing one, and the agency may object in that time.

• Meta (Facebook and Instagram), whose platforms the comments and messages come from and are answered on
• a service that connects Commentoro to the brand's Facebook and Instagram accounts and carries comments, messages and moderation actions between them
• cloud hosting for the application
• a managed database, where the application's data is stored
• a sign-in and account service for our users
• AI model providers, which read comments and messages and write draft replies
• a website-reading service, which reads the brand's own public website so replies can answer from it
• an email delivery service, for the emails the application sends
• a payment provider, which handles plans, cards and invoices
• an error monitoring service
• a product analytics tool, which shows how the website and the application are used, and records each request to the AI models to measure their quality and cost

International transfers

Where data is transferred outside the UK or the European Economic Area, the transfer is covered by an adequacy decision or by the standard contractual clauses (with the UK addendum for UK data).

Deletion

When a brand is archived, the words of its comments and messages and the names of the people who wrote them are deleted 90 days later, or sooner when an owner or admin asks. When the agency closes, the same happens to all its brands 90 days after it closed. A record of what was done is kept without the words or the names.

A comment or message on an account that is not connected to any brand is not handled; its words and the name of the person who wrote it are deleted 30 days after it arrived.

The words the product analytics tool records of Commentoro's AI work, which can hold a name (a review on a brand's site, a name in a post's caption or video, words the agency's people copy from a comment into a test of a reply or a note, or a name an answer repeats), are deleted within two months of being recorded.

Contact

Dollani, LLC, 262 Chapman Road, Suite 240, Newark, DE 19702, United States. Email: privacy@commentoro.com.