GDPR

Last updated: 3 October 2026

This notice supplements our Privacy Policy for people in the European Economic Area, the United Kingdom and Switzerland, and explains how we meet the GDPR and the UK GDPR.

Controller and processor

The controller for the personal data of our customers is Neurai Technologies Private Limited, Gurugram, Haryana, India. For the personal data of people who interact with a customer's connected accounts, the customer is the controller and we act as its processor, on its instructions and only to provide the service.

Legal bases

We process personal data on the basis of the performance of our contract with you (Article 6(1)(b)); our legitimate interests in operating, securing and improving the service and preventing abuse (Article 6(1)(f)); your consent where we ask for it, such as for non-essential cookies (Article 6(1)(a)); and compliance with our legal obligations (Article 6(1)(c)).

Your rights

You have the right to be informed, to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, to withdraw consent at any time, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where we use automated measures to protect the service, such as pausing an account whose messages repeatedly fail to deliver, you may ask for a person to review the decision.

Exercising your rights

Use the controls in your account, or write to privacy@commentfor.com from the address on your account. We respond within the time the law allows, and we may ask you to confirm your identity first.

International transfers

We are based in India and our providers may process personal data outside the EEA and the UK. Where personal data leaves those areas we rely on appropriate safeguards, such as standard contractual clauses and our providers' data-protection terms. We review any request from a public authority for legal validity, challenge requests that are unlawful, and disclose only the minimum necessary.

Retention

We keep personal data only for as long as necessary for the purposes it was collected for, or as the law requires. Deleting your account or disconnecting a connected account removes the related data from our live systems promptly; encrypted backup copies may be retained for up to 60 days for operational and legal reasons. A minimal record that a subscription was cancelled, and an audit entry showing that an erasure was carried out (which holds no account content), may be kept for up to 400 days to resolve payment disputes and to evidence the erasure. Where a connected account was suspended for abuse, or connected within the last 30 days, that decision alone may be kept against a one-way hash of the account for up to 180 days.

Complaints

If you believe we have handled your personal data improperly, please contact us first so we can put it right. You also have the right to lodge a complaint with the supervisory authority in the country where you live or work.

Data protection officer

We are not required to appoint a data protection officer. Privacy matters are handled by the team at privacy@commentfor.com.