Privacy Policy

1. Data controller

The controller of personal data of Users of the CommentTap service (available at commenttap.com, the "Service") is Michał Kołnierzak conducting business under the name "KOLM MICHAŁ KOŁNIERZAK", ul. Milenijna 43/2, 03-130 Warsaw, Poland, NIP 5361929091, REGON 367735680 (the "Controller", "Operator" or "we").

Data protection contact: privacy@commenttap.com. General contact: support@commenttap.com, hello@commenttap.com, phone +48 573 210 950.

We have not appointed a Data Protection Officer, as the conditions of Art. 37 GDPR do not apply.

2. Two roles of the Operator

CommentTap is a SaaS service and acts in two distinct roles:

• Controller — for personal data of Users of the Service (account, billing, contact and technical login data). This Policy governs that processing.
• Processor — for data of Contacts (Leads) that a User collects and processes through the Service while running their own campaigns. Processing in this role starts when an Instagram account is connected to the Service (from then on we receive comments and messages sent to that account), including before any campaign is launched. Here the controller of the campaign data is the entity that determines the campaign's purposes and essential means of processing — the User, or an entity on whose behalf the User acts as an authorised processor (e.g. an agency's client). We act accordingly as a processor or sub-processor and process such data only on documented instructions, under the data processing agreement (DPA).

Requests from data subjects (e.g. Leads) regarding data collected by a User are directed to that User as controller; we forward them and assist the User.

3. What data we process (as controller)

As controller we process data of Users: account data (name, email, hashed password), billing data (company name, address, tax ID, payment history, Stripe and App Store / Google Play purchase identifiers), identifiers and access tokens of connected social accounts, technical data (IP address, logs, device/browser type, in-app events), support correspondence, and — where applicable — an email address for marketing.

Plan purchase. When a Plan is purchased, we record information needed to enter into and perform the agreement and document its terms: Account and Workspace identifiers, the accepted Terms version, acceptance time, platform (website, App Store, Google Play) and purchase identifiers. For in-app purchases, we also record the start of the purchase process (purchase intent) to assign the transaction to the correct Workspace and prevent duplicate charges. We process transaction identifiers, amounts, currencies, subscription periods and statuses, and refund information. If a store does not refund an amount due after withdrawal from the agreement or after a duplicate purchase and the Operator pays it from its own funds (Terms section 6(11) and section 7(6)), we record the amount, currency, date and method of payment and a note, and for a bank transfer — the bank account details provided by the recipient. Depending on the purpose, the legal bases are performance of the agreement (Art. 6(1)(b) GDPR), legal record-keeping obligations (Art. 6(1)(c) GDPR) and our legitimate interests in accurate billing and protecting legal claims (Art. 6(1)(f) GDPR); for persons acting on behalf of a customer that is not a natural person — Art. 6(1)(f) GDPR.

Free trial. To check eligibility for a free trial, we use a trial-use marker, a pseudonymised email identifier (a one-way hash) and linked Instagram account identifiers. These data may still allow us to recognise a returning person and are not treated as anonymous. The basis is our legitimate interest in preventing promotional abuse (Art. 6(1)(f) GDPR). Individuals may object on grounds relating to their particular situation (section 10).

Legal bases:

• Providing and running the account and the service — Art. 6(1)(b) GDPR; for persons acting on behalf of a customer that is not a natural person (e.g. a company's employee) — Art. 6(1)(f) GDPR (handling the contract with the customer).
• Billing, subscriptions (including those bought in the App Store and Google Play), invoices, refunds and complaints — Art. 6(1)(b) and (c) GDPR (tax/accounting obligations) and Art. 6(1)(f) GDPR (correctly assigning purchases, preventing duplicate charges, protecting legal claims).
• Security, error diagnostics and abuse prevention — Art. 6(1)(f) GDPR (legitimate interest).
• Checking free-trial eligibility — Art. 6(1)(f) GDPR (preventing promotional abuse); you have the right to object (section 10).
• Traffic analytics on marketing pages (Google Analytics) — Art. 6(1)(a) GDPR (consent given in the cookie banner, which can be withdrawn).
• Notifications about events in the Account (email, push) — Art. 6(1)(b) GDPR. System permission for push notifications is not marketing consent; we do not send ads through them.
• Marketing communications — Art. 6(1)(a) GDPR (separate consent), where applicable.

4. Contact / Lead data (as processor)

Through the Service, a User may process data of people interacting with their profiles. Per the Service's data model this includes: platform identifiers (provider user id, username, display name), email address if provided, content of comments, story replies and messages, tags, notes, custom fields (lead fields), lead status, opt-out status and text, answers to the marketing consent question (state, date and question text), interaction timestamps, and delivery and link-click history. We process this data on behalf of the User under the DPA.

Individual click tracking with a recipient identifier and the conversion pixel are not currently available. Enabling them will require separate legal and technical work and an update of the information for users. The link statistics available today count clicks without assigning them to a specific person and without recording the IP address, browser or referring page.

For campaign data we process data on the documented instructions of the relevant controller. The User may be that controller or its authorised processor, e.g. an agency — CommentTap then acts as a sub-processor under the data processing agreement. The information for campaign participants (in the first message of the campaign) names the actual controller — the brand the campaign is run for — and links to its information on data processing.

5. Sources of data

We obtain data: (a) directly from the User; (b) automatically during use of the Service (logs, cookies); (c) from social platforms via official APIs (Meta/Instagram), to the extent the User authorised when connecting an account.

6. Meta / Instagram integration

The Service uses official Meta (Instagram) APIs. We process only data necessary for the features the User has authorised (e.g. reading comments, sending messages in response to user-initiated interactions). For this we store access tokens for connected accounts (encrypted, with limited scopes). We use Meta platform data in accordance with the Meta Platform Terms and Developer Policies; we do not sell it or use it for purposes other than providing the Service.

You can disconnect an account at any time, which stops access to platform data. The Service also handles data deletion requests in line with Meta requirements (Data Deletion Request Callback). Status and instructions are available on the data deletion page.

Optional AI features. The Service can help draft campaign message texts and post captions (the User reviews and approves the result before use). AI classification of comment intent is not currently available — campaigns react to keywords only. We send to the provider of the feature being used (Google — Gemini API, primary provider; OpenAI — fallback provider; see the list of sub-processors) only the text needed for that feature: text entered by the User (with the brand-style profile and campaign name) and the caption of a post the User selects — without profile data of any person, although the text may contain data someone typed into it. In the paid services we use, the providers' terms restrict using submitted content to train models; this does not mean no retention at all — retention for security, abuse monitoring and legal obligations depends on the provider, endpoint and configuration (e.g. OpenAI — generally up to 30 days). We do not use a “zero retention” option. We do not store AI output outside the campaign itself; we record usage billing data (feature type, token count, cost).

6a. Google Sheets integration (optional)

The User may optionally connect their own Google Sheets spreadsheet as a destination for captured leads. The connection uses Google OAuth with the “drive.file” scope, meaning access only to the files the User selects in the Google picker or creates through CommentTap — we have no access to any other files in the User's Drive. We store the resulting refresh token only in encrypted form (AES-256-GCM) and use it solely to obtain a short-lived access token at the moment of writing and to open the file picker.

When the spreadsheet picker is opened, the User's browser loads a Google script from “apis.google.com”. It is a functional element, triggered only by the User's click, and is not used for analytics or marketing purposes.

From the User's Google data we read only the metadata of the selected spreadsheet (its title and tab names) — to confirm access and let the User pick the destination tab — and then append rows with lead data (event date, event type, lead fields) to the spreadsheet and tab chosen by the User. At the User's request we can also create a new spreadsheet with a header row. We do not read cell contents, do not browse the User's files, and do not modify or delete anything beyond appending these rows.

The integration can be disconnected at any time in the Service settings (deleting the integration permanently removes the stored token); access can also be revoked from the Google account (myaccount.google.com/permissions). CommentTap's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements — we use Google API data solely to provide the user-facing lead export feature, do not transfer it to third parties (beyond necessary hosting infrastructure) and do not use it for advertising.

6b. Mobile app

The CommentTap mobile app (iOS, Android) uses the same Account as the Service. In the app we additionally process:

• Sign in with Apple or Google — we receive an email address (with Apple this may be a relay address) and an account identifier from the provider; legal basis: Art. 6(1)(b) GDPR.
• Push notifications — we store a device token to send the notifications you choose. Notifications are sent through Expo (Expo Push), which forwards them to Apple Push Notification service or Firebase Cloud Messaging (Google). A notification may contain a Contact's name (e.g. the username of the person who sent a message). You can withdraw notification permission in the system or app settings.
• In-app purchases — payment is taken by Apple (App Store) or Google (Google Play), which process payment data as independent controllers under their own policies. We receive the subscription status through RevenueCat, which processes your Account identifier and store transaction data on our behalf (as a processor) so that we can assign the subscription to a Workspace. We do not share Contact data with RevenueCat. Section 3 describes the purchase data and legal bases, and section 9 the retention periods.
• Diagnostics — app crash reports go to Sentry with your Account identifier (without email address and without Contact content).
• Device storage — the app stores your sign-in session and a copy of recently viewed data locally so it works on a weak connection; this data is cleared when you sign out.

The app does not track you across other companies' apps and websites and shows no ads. Photos and videos picked from your device are uploaded only when you add them to a post or campaign yourself.

7. Recipients and subprocessors

We entrust processing to trusted providers (processors) only to the extent necessary to run the Service. Where a recipient acts as an independent controller for a given scope — not on our behalf but under its own policies — we say so explicitly:

• Supabase — database, authentication, file storage — EU/EEA, Frankfurt (Germany).
• Railway — hosting of the API, background workers and the cache/queue store (Redis) — EU/EEA, EU West, Amsterdam (Netherlands); a US-based operator, so remote access from the USA is possible (see section 8).
• Vercel — web application (frontend) hosting — EU + USA (see section 8).
• Stripe — payments and subscriptions — EU + USA (see section 8).
• inFakt — issuing and syncing accounting documents — Poland/EU.
• Brevo — transactional and notification emails — EU/EEA.
• Meta Platforms — Instagram/Facebook API integration — EU + USA (see section 8).
• Sentry — error and performance monitoring (active when a DSN is configured) — EU + USA (see section 8).
• Google (Google Analytics, Google Search Console, Gemini API, Google Sheets — when the User connects a spreadsheet) — traffic analytics, search-visibility measurement and AI content features (see section 6) — EU + USA (see section 8).
• OpenAI — AI content features (fallback provider, see section 6) — USA (see section 8).
• Expo (650 Industries) — push notification delivery in the mobile app (onwards via Apple and Google) — USA (see section 8).
• RevenueCat — processor: subscription status for App Store and Google Play purchases (Account identifier, store transaction data) — USA (see section 8).
• Apple, Google — app stores and Sign in with Apple/Google; they process App Store and Google Play payment data as independent controllers under their own policies (for that scope they are not our processors) — EU + USA (see section 8).
• Accounting office / advisor / law firm — Poland.

The list of subprocessors handling Contact data is published on the Subprocessors page. Where disclosure to public authorities is required by law, we review the legality of each request, challenge requests we consider unlawful, disclose only the minimum necessary, and keep a record of requests, our responses and the legal reasoning.

8. Transfers outside the EEA

Core infrastructure runs in the EU/EEA: database and files (Supabase) — Frankfurt (Germany); API and background-worker hosting (Railway) — EU West, Amsterdam (Netherlands). Some recipients (Stripe, Meta, Google, OpenAI, Vercel, Sentry, Expo, RevenueCat, Apple — and, for remote access by US-based teams, Supabase and Railway) may also process data in the USA. Such transfers rely on safeguards under Chapter V GDPR — in particular Standard Contractual Clauses (SCC) and, where applicable, the EU-U.S. Data Privacy Framework (DPF). For in-store payments, Apple and Google act as independent controllers and rely on their own transfer mechanisms. A copy of the safeguards is available at privacy@commenttap.com.

9. Data retention

• Account and service data — for the term of the agreement and 30 days afterwards (export/recovery window), then deleted or anonymised. In the provider-switching procedure (Terms section 12a) — after the transitional and retrieval periods of that procedure.
• Tax and accounting records — for the period required by law, generally until the tax liability becomes time-barred (5 years from the end of the year in which the tax payment deadline passed, taking into account events affecting that period); records of sales under the VAT OSS scheme — 10 years from the end of the year of the transaction.
• Records of app store transactions (transaction identifier, product, amount, currency, date, status, refunds), billing cases (refunds, withdrawals, duplicate purchases) and payments made by the Operator from its own funds (amount, currency, date, payment method, note and, for a bank transfer, the recipient's bank account details) — like tax and accounting records: until the tax liability becomes time-barred (5 years from the end of the year in which the tax payment deadline passed) and, in a dispute or complaint, until it is closed; these records survive Account deletion. Legal basis: Art. 6(1)(c) and (f) GDPR.
• Data processed based on consent (marketing) — until consent is withdrawn.
• Technical and security logs — up to 12 months.
• Click statistics for campaign links (number of clicks, time, automated-traffic flag) — 12 months; without IP address, browser data or referring page.
• Identifier of a disconnected Instagram account (without the profile name) — until the workspace is deleted; it lets you reconnect the same account and prevents it from being assigned to two workspaces at once.
• Raw events delivered by Instagram (the full content of comments and messages before processing) — 30 days. Events for accounts we don't serve (e.g. disconnected ones) are deleted immediately.
• Backups — a rolling cycle of up to 30 days.
• Trial-use marker (a one-way hash of the owner's email address and the Instagram account identifiers that used a trial) — for as long as the Account exists and 24 months after it is closed (Account deletion); legal basis: Art. 6(1)(f) GDPR. These data are not anonymous.
• Record of the start of an in-app purchase process (purchase intent: Account and Workspace identifiers, time) — 24 hours, whatever the outcome: a completed purchase is by then assigned to the Workspace, and evidence of acceptance of the Terms is kept separately (next item).
• Minimum evidence of concluding the agreement and of statements made (document version, date and time, context, account or purchase identifier) is kept after the account is deleted for as long as needed to show its content and to establish, exercise or defend claims: an account without campaigns or payments — 12 months (without the email address); a Free account with campaigns — until the end of the 3rd calendar year after deletion; an account with a paid Plan — until the end of the 6th calendar year after deletion. In a specific dispute, complaint or incident — until the matter is closed. Evidence of Contacts' marketing consents and of cookie choices has separate periods tied to its purpose.
• Contact opt-out register — as a one-way hash of the identifier, also after the Contact is deleted, so the opt-out keeps being honoured; for as long as the User uses the Service.
• In-app notifications (may contain a Contact's or account name) — 12 months.
• Log of data deliveries to the User's integrations (webhooks, spreadsheets) — 90 days.
• Full content of notifications from payment providers (Stripe, RevenueCat) — 90 days; afterwards only the event identifier is kept.
• Register of data deletion requests received from Meta — 3 years (evidence that the request was fulfilled: date, status, confirmation code); the Instagram account identifier is removed from the register 30 days after the request is fulfilled.
• Snapshot of the post caption call to action (CTA) a Contact responded to — evidence of what they asked for by commenting — 24 months from the last time that content was seen; it survives campaign deletion and is deleted together with the workspace.
• Free-plan Accounts with no sign-in and no live campaigns for 24 months are included in a retention review. We notify you of the planned end of the agreement and deletion of data at least 30 days in advance; during that time you can keep the Account by signing in or export your data. After that we delete operational data unless there is a specific, documented basis for keeping it. To assess activity we record the date of your last visit to the Service.
• Contact/Lead data (as processor) — a contact with no interaction for 24 months is deleted automatically together with its conversations; other data is deleted within 30 days after the Service ends, or earlier at the User's request.

After these periods data is deleted by automated retention jobs and by deletion procedures run when the agreement ends and on request.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). We handle requests at privacy@commenttap.com without undue delay, generally within one month (which may be extended in the cases set out in Art. 12(3) GDPR — we will then tell you and explain why). You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

If a request concerns data collected by a User in their campaigns (Leads), the controller is that User or the entity on whose behalf the User runs the campaign (e.g. an agency's client) — we forward your request to the User and point you to the controller named in the campaign's privacy information.

You can download your account data yourself at any time: Settings → Your data (JSON file). You can delete your account in Settings → Danger zone. Other requests are handled at privacy@commenttap.com.

11. Automated decision-making

Campaigns use rules and keywords set by the User. AI classification of comment intent is currently not available. The AI features described in section 6 prepare content suggestions that the User reviews before use. The only effect of campaign automation is that a message is or is not sent within the User's campaign. We do not make automated decisions producing legal or similarly significant effects on Users or Contacts within the meaning of Art. 22 GDPR.

13. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), access control, password hashing, backups, need-to-know access limits, and processing with providers offering an adequate level of security. Security reports: security@commenttap.com.

14. Changes to this Policy

We may update this Policy. We will inform Users of material changes electronically or in the Service in advance. The last-updated date is shown at the top.

15. Contact

Data protection matters: privacy@commenttap.com. Operator: KOLM MICHAŁ KOŁNIERZAK, ul. Milenijna 43/2, 03-130 Warsaw, NIP 5361929091.