Privacy Policy

Our users: we decide how their data is used

For the people who use Commentoro (agency owners, admins and team members), we are the controller. We collect their name, email address and sign-in details, the agency and brands they belong to, what they do in Commentoro (for example, which reply they approved and when), billing details for agency owners, and technical details about their browser and device.

We use this to provide Commentoro and keep it secure, to bill for it, to send the emails the application sends (each person can switch the optional ones off), to answer questions, and to understand and improve how Commentoro is used. Our legal bases are the contract with the agency, our legitimate interest in running and improving the service (which covers the product analytics described under Cookies), and consent for the session recordings and the ad cookie described there.

The audience of each brand: we handle it for the agency

Commentoro reads the comments and direct messages people leave on the Facebook and Instagram accounts an agency connects: what they wrote, their public name, handle and profile identifier, and anything attached to their message. For this data the agency is the controller and Commentoro is its processor: we handle it only to provide Commentoro to the agency, under the agency's instructions and the Data Processing Agreement.

If you wrote to a brand and want to use your rights over what you wrote, contact that brand or the agency that manages it. If you contact us, we will pass your request to them.

AI

Comments and messages are read, and draft replies are written, by AI models from AI model providers. We send them only what is needed for the task. We do not use customer data to train AI models, and our AI providers' terms for paid use do not allow them to train on what we send.

Our product analytics tool records each request to an AI model: which model, how long it took, what it cost and whether it worked, so we can measure how good the answers are and what they cost. For comments and messages, that is all it records: never their words or who wrote them. When the AI reads a brand's own information (its website, its documents, and the pictures and videos of its posts), or answers what an agency's people type to test a reply or check a note, it also records words from the request and the answer. That can include a review the brand's site shows, a name in a post's caption or video, words someone copied from a comment, or a name an answer repeats. The analytics tool deletes those words within two months of recording them. It is used for nothing else.

AI can be wrong. A person at the agency decides which actions happen automatically and which wait for approval, and should check what Commentoro does in their name.

Who we share data with

We do not sell personal data. We share it only with the services that run Commentoro for us, under contracts that let them use it only for that, and when the law requires it. By category, these are:

• Meta (Facebook and Instagram), whose platforms the comments and messages come from and are answered on
• a service that connects Commentoro to the brand's Facebook and Instagram accounts and carries comments, messages and moderation actions between them
• cloud hosting for the application
• a managed database, where the application's data is stored
• a sign-in and account service for our users
• AI model providers, which read comments and messages and write draft replies
• a website-reading service, which reads the brand's own public website so replies can answer from it
• an email delivery service, for the emails the application sends
• a payment provider, which handles plans, cards and invoices
• an error monitoring service
• a product analytics tool, which shows how the website and the application are used, and records each request to the AI models to measure their quality and cost

International transfers

Some of these services process data outside the UK and the European Economic Area. Where they do, the transfer is covered by an adequacy decision or by standard contractual clauses.

How long we keep it

Comments and messages are kept while their brand is active in Commentoro, so the agency can see what was done and why.

When a brand is archived, the words of its comments and messages and the names of the people who wrote them are deleted 90 days later; an owner or admin can delete them sooner. When an agency closes, the same happens to all its brands 90 days after it closed. A record of what was done (which comment, which action, when and by whom) is kept without the words or the names, so an audit or a dispute can still be answered.

A comment or message on an account that is not connected to any brand is not handled; its words and the name of the person who wrote it are deleted 30 days after it arrived.

Our users' details are kept while their agency has an account, except who did what in the record above, which is kept with it; billing records are kept for as long as tax law requires.

The words the product analytics tool records of the AI's work (see AI) are deleted within two months of being recorded.

Cookies

Commentoro uses cookies that are needed for it to work: to keep you signed in, to keep it secure and to remember your language and time zone. These are always on.

It also uses product analytics, on for everyone: a cookie that recognises your browser from one visit to the next, with a record of the pages you open and what you click, so we can see how the site and the application are used and improve them. In the application, what it records from your browser holds no text you see or type; what it records of the AI models' work is described under AI above.

Only with your consent, given or refused in the cookie banner and changeable at any time, it also makes session recordings, which replay how a visit went, and sets a cookie that remembers which ad or link first brought you to Commentoro. Refusing turns both off; the product analytics above stay on.

The ad cookie holds only the ad's or link's campaign details and the ad's click id, the first page you opened and the site that sent you, never anything you type. It is kept for up to 90 days, and if you sign up, it is saved with your account and with the agency you create, so we can tell which of our ads work. Refusing, or withdrawing your consent, deletes the cookie and the copy with your account; once your agency exists, the copy saved with it stays, and you can ask us to remove it.

Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to limit or object to how we use it, or to receive it in a portable form, and you can withdraw a consent at any time. Write to privacy@commentoro.com. You can also complain to your data protection authority.

Security

Data is encrypted in transit and at rest. Each agency's data is kept apart from every other agency's in the database, and access by our staff is limited to what running the service needs.

Children

Commentoro is a business tool and is not meant for anyone under 16.

Changes to this policy

We will show the date of any change at the top of this page.

Contact

Dollani, LLC, 262 Chapman Road, Suite 240, Newark, DE 19702, United States. Email: privacy@commentoro.com.