1.Parties and scope
This agreement is between the customer identified by their CommentCare account and Theodor Conrad Borth, Zehenthofgasse 37, 1190 Wien, Austria (CommentCare). The customer acts as controller, or as an authorized processor of the relevant controller. CommentCare acts as processor or subprocessor for the connected account content. Account administration and CommentCare’s own legal duties are covered by the Privacy Notice instead.
Electronic acceptance records the customer account, this version and the acceptance time. The agreement lasts while CommentCare processes the customer’s personal data. Its confidentiality, assistance and deletion duties continue for any remaining copies. Where these clauses conflict with general service terms, these clauses govern personal-data processing. Mandatory data-protection law remains unaffected.
2.Processing instructions and details
The customer instructs CommentCare to retrieve comments and replies on their authorized TikTok accounts, analyze once, after a TikTok account is connected, up to 1,500 of its most recent accessible comments and replies, starting with the newest videos, classify comment content, identify optional unwanted-content patterns, apply the chosen moderation rules, hide eligible comments, and restore comments on request. A newly connected TikTok account is protected from the start under the settings of the customer’s first TikTok account or, without one, CommentCare’s default settings, until the customer changes them. Storage, access, analysis, transmission to authorized providers, minimization, export and deletion are necessary operations. The dashboard settings and authenticated requests form documented instructions.
On the VIP plan, the customer also instructs authorized CommentCare staff to double-check the customer’s comments and moderation decisions daily and to hide or restore comments on the authorized accounts where a decision does not fit the customer’s rules. Staff may also do so when the customer asks or while handling support. Staff actions are recorded.
For a YouTube channel protected on the VIP plan, the customer adds CommentCare’s moderator account as a moderator of the channel in YouTube Studio and instructs CommentCare to read the channel’s available videos, comments and replies through that access at intervals, assess them with AI under the customer’s settings and remove comments that match them using YouTube’s moderator controls. YouTube holds removed comments for the channel owner’s review in YouTube Studio. For the separate YouTube API comment-review service, the customer instructs CommentCare to retrieve that information through the YouTube API Services and suggest comments for review; there, comments are hidden only when the customer explicitly selects them. The channel connection, the moderator invitation and channel-specific settings are documented instructions under this agreement.
For an X account connected on the VIP plan, the customer authorizes CommentCare’s X app on X’s authorization screen and instructs CommentCare to receive the direct replies to the account’s posts that X delivers as they are posted, assess them with AI under CommentCare’s standard protection against spam, scams, bots and impersonation, hide matching replies using X’s hide-reply function and show a hidden reply again on request. The connection of the X account is a documented instruction under this agreement.
For an Instagram account connected on the Pro or VIP plan, the customer signs in on Instagram’s own page and authorizes the Instagram app of SocialAPI, the provider through which CommentCare reaches Instagram. The customer instructs CommentCare to receive, through SocialAPI, the comments and replies written on the account’s posts and reels from then on, read the captions of those posts, assess the comments with AI under the customer’s settings, hide matching comments on Instagram and hide or show a comment again on request. SocialAPI keeps the Instagram access tokens and passes on the comments and the hide and unhide requests as CommentCare’s subprocessor; CommentCare does not receive the tokens. The connection of the Instagram account and its protection settings are documented instructions under this agreement.
If the customer uses the CommentCare iPhone app, the customer also instructs CommentCare to prepare a weekly and a monthly community recap for the connected accounts and protected channels: figures from the saved moderation records and an AI-written summary of a sample of the period’s comments, with quoted comments, shown only to the customer. Signing in to the app and its recap switches are documented instructions; switching a recap off ends its preparation. Notifications that a recap is ready contain no comment content.
Data subjects are account owners, commenters and people mentioned in captions, posts or comments. Data comprises platform and internal identifiers, usernames, video captions and thumbnail links, the captions, links and preview pictures of Instagram posts, the text of posts that are replied to on X, comment and reply text, timestamps, moderation decisions and settings, and the recaps written from them. Free-text content can incidentally disclose sensitive data or refer to children; customers must assess that risk and must not use CommentCare to infer sensitive traits or make decisions on employment, credit, essential services or similar significant matters.
CommentCare processes only on documented lawful instructions, including instructions about transfers, unless applicable EU or Member State law requires otherwise. We inform the customer of such a requirement before processing unless legally prohibited. We promptly notify the customer if an instruction appears unlawful and suspend the affected instruction pending clarification. Data is not sold, used for advertising or used to train CommentCare models.
3.Customer responsibilities
The customer identifies a lawful basis, supplies required notices to commenters and obtains authorization from the relevant account owner. TikTok, Google, X or Instagram authorization, or adding CommentCare as a YouTube moderator, grants access; it is not consent from commenters. Customers remain responsible for their moderation policy, responding to rights requests and reviewing potentially incorrect decisions. The community-notice guidance can be adapted to identify the actual creator/controller and their contact details.
4.Confidentiality and technical measures
Access is limited to people who need it for the service and who are bound by confidentiality obligations. CommentCare applies appropriate security measures taking account of risk, including encrypted transport, server-only credentials, encrypted platform tokens, hashed passwords and session tokens, authenticated ownership checks, restricted operational logs, expiry of temporary credentials and coordination between deletion and active scans. The technical annex below describes current technical measures.
CommentCare will assist the customer with obligations under Articles 32–36 GDPR, taking account of the nature of processing and information available, including security assessments, impact assessments and prior consultation where necessary.
5.Subprocessors and transfers
The customer gives general written authorization for the service providers listed below for their stated functions. CommentCare must impose applicable Article 28 obligations on each subprocessor and remains responsible for their performance under this agreement. International transfers require a valid Chapter V GDPR mechanism and any necessary supplementary measures.
Current service providers are Railway (API and database hosting, deployed in Amsterdam), Vercel Inc. (frontend hosting and server-side delivery, including non-EEA infrastructure) and OpenAI (comment classification, the built-in assistant and community recaps; the contracting entity depends on the customer’s provider agreement). For connected Instagram accounts, SocialAPI (social-api.ai, operated by EP ENTREPRISE, France) maintains the connection to Instagram: it keeps the Instagram access tokens, receives the comments on the account’s posts and reels from Instagram and passes them to CommentCare, and sends Instagram CommentCare’s requests to hide a comment or show it again. SocialAPI states that its service is hosted in Germany. TikTok, YouTube, X and Instagram are independently operated source platforms for their respective connections. Namecheap forwarding and Google Gmail currently process support correspondence; customers should not email comment exports, credentials or sensitive content. Contact hello@commentcare.app for information about provider contracts and international transfers.
Before adding or replacing a subprocessor with access to customer content, CommentCare will notify the customer at their registered email at least 30 days in advance and allow objections based on data protection. We will seek a reasonable alternative; where none exists, the customer may end the affected service before that processing begins.
6.Rights, incidents and accountability
CommentCare assists with access, correction, restriction, portability, objection and erasure requests through the account tools and support. We promptly forward requests relating to customer-controlled data to the customer where identifiable and do not answer substantively on their behalf without instructions, unless legally required.
We notify the customer without undue delay after becoming aware of a personal-data breach affecting their data. We provide the nature of the breach, available categories and approximate numbers affected, a contact, likely consequences and measures taken or proposed. Information may be provided in phases without undue further delay. The customer decides their controller notification obligations; this clause does not postpone any statutory deadline.
We make information necessary to demonstrate compliance available to the customer and allow and contribute to proportionate audits, including inspections by the customer or an auditor mandated by them. Reasonable confidentiality and scheduling measures may protect other customers but must not prevent effective audits or urgent regulator access.
7.Return, retention and deletion
At the customer’s choice on termination, CommentCare returns the data through export and/or deletes it and existing copies unless EU or Member State law requires storage. The customer can export before deleting. Disconnect removes the connected account’s active data; full deletion removes the CommentCare account’s active records. Hidden comments on TikTok are not restored by deletion. Provider-held records and backup copies are addressed through the separate deletion process.
Processed comment text, usernames and detailed signals are redacted by the hourly retention task after 90 days from collection. Minimal identifiers and decision records remain until disconnection to avoid processing the same comments again. Pending items remain until their action is resolved; unresolved items and inactive accounts require operational review. Data subject to a genuine legal hold must be isolated and used only for that obligation.
A community recap is deleted 90 days after the period it covers. Disconnecting an account or channel also deletes the content of the customer’s saved recaps.
For YouTube channels protected through the moderator account, comment text, author names and detailed signals are redacted 90 days after collection, keeping minimal decision records; disconnecting a channel deletes its saved videos, comments and check records from the active database, and the customer should also remove CommentCare as a moderator in YouTube Studio. In the separate YouTube API service, saved comment and video data are refreshed or removed within 29 days, and disconnecting removes the connection, tokens, videos and comments and initiates revocation of its Google authorization. Disconnecting or deleting CommentCare data does not restore a comment already removed or rejected on YouTube. Provider backups and records legally required to be kept may have different retention periods.
For connected X accounts, a saved reply, with its text, its author and the decision, is deleted 30 days after it was received; only the count toward the allowance remains. When the customer shows a hidden reply again, CommentCare notes that author’s X identifier and the date, nothing they wrote, so that the author’s later replies are not hidden again for repeating the customer’s post. The note is deleted one year after the customer last showed a reply of that author again, when the customer hides a reply of that author, and when the X account is disconnected. Disconnecting an X account ends X’s deliveries, asks X to revoke CommentCare’s authorization and deletes the account’s tokens, saved replies and these notes from the active database. Replies already hidden on X stay hidden until the customer shows them again on X.
For connected Instagram accounts, a saved comment, with its text, its author and the decision, is deleted 90 days after it was received; only the count toward the allowance remains. The saved details of a post are deleted once they are 90 days old and no saved comment belongs to the post. Disconnecting an Instagram account ends the connection at SocialAPI and deletes the account and its saved posts and comments from the active database; SocialAPI states that it then revokes the Instagram authorization and deletes the data it holds for the account within 30 days. Comments already hidden on Instagram stay hidden until the customer shows them again on Instagram.
Technical annex
The live implementation uses PostgreSQL behind the authenticated Railway API, server-side OpenAI calls with response storage disabled, encrypted platform credentials and HttpOnly production session cookies. Data exports omit secrets. Deletion invalidates active account sessions and cascades through connected application records. A minimal deletion ledger supports backup-restore checks. Cookie-free Vercel Web Analytics measures visits and interactions on the public landing page. No advertising tracker runs in the application; on the public landing page, Whop’s advertising pixel is loaded only after a visitor has allowed it. The iPhone app uses the same authenticated API; its session token is kept in the phone’s Keychain, and its notifications are sent through Apple’s push service without comment content. Instagram access tokens are kept by SocialAPI and do not reach CommentCare; requests to SocialAPI are authenticated with server-only keys, and SocialAPI’s deliveries are accepted only with a valid signature.
Contact hello@commentcare.app for further information about technical measures, provider arrangements and deletion of backup copies.