GDPR

Last updated: 28 August 2026

This notice explains how CommentFor meets the EU General Data Protection Regulation (GDPR) and the UK GDPR, and how you can exercise your rights. It sits alongside our Privacy Policy, which describes in detail what we collect and why.

Who is responsible for your data

The data controller is Neurai Technologies Private Limited, H No. 944, Block C, Sushant Lok 1, Gurugram - 122001, Haryana, India. For any privacy or data-protection matter, contact privacy@commentfor.com.

When you use CommentFor to handle comments and messages from your own audience, you are the controller of that audience data and we act as your processor, handling it on your instructions and only to provide the service.

Legal bases we rely on

• Performance of a contract (Article 6(1)(b)) — creating and running your account, connecting your Instagram professional account, sending the replies your automations define, and taking payment for paid plans.
• Legitimate interests (Article 6(1)(f)) — keeping the service secure, preventing abuse, and understanding aggregate, cookieless usage so we can improve the product. We balance these against your rights and use the least data that works.
• Consent (Article 6(1)(a)) — analytics and advertising cookies on this website, and any optional marketing email. If you are in the EEA, the UK or Switzerland — and also in India and Brazil, where we apply the same standard — nothing is set until you choose: the consent bar lets you grant both ("Accept all"), analytics only ("Accept analytics"), or neither ("Reject"), and no cookie is placed beforehand. You may withdraw consent at any time, and withdrawal does not affect processing carried out beforehand.
• Legal obligation (Article 6(1)(c)) — retaining invoices and tax records where the law requires it.

Your rights

If the GDPR applies to you, you have the right to:

• be informed about how your data is used — this notice and the Privacy Policy;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased — see Data Deletion for the self-serve routes;
• restrict processing, or object to processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, including your cookie choice; and
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects — we make no such decisions.

How to exercise them

Email privacy@commentfor.com from the address on your account, telling us which right you wish to exercise. We respond within one month, as the GDPR requires; if a request is complex we may extend that by up to two further months and will tell you why. We do not charge a fee for reasonable requests, and we may ask you to confirm your identity before we act.

You can also delete your data yourself at any time — disconnecting your account in the dashboard, or removing CommentFor from your Instagram settings, purges it. Data Deletion has the steps.

International transfers

We are based in India, which is not covered by a European Commission adequacy decision, and our service providers may process data outside the European Economic Area. Where personal data leaves the EEA or the UK, we work to ensure it stays protected — including through the data-protection terms our providers offer and the technical and organisational measures described in our Privacy Policy. If you would like details of the safeguards that apply to a particular transfer, write to privacy@commentfor.com and we will explain them.

Retention

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. Account and audience data is purged when you disconnect or delete your account; billing records are kept for the statutory retention period.

Data protection officer

We are not required to appoint a data protection officer, and have not appointed one. Privacy matters are handled directly by the team at privacy@commentfor.com.

Complaints

If you believe we have handled your data improperly, please tell us first — we would rather fix it. You also have the right to complain to the supervisory authority in the EU or UK country where you live, work, or where you believe the issue arose.

Changes

If this notice changes, we will update this page and the date above.