Privacy Policy
Last updated: 3 October 2026
Who we are
CommentFor is operated by Neurai Technologies Private Limited ("CommentFor", "we", "us"). It lets businesses reply automatically to comments on their Instagram and Facebook content with a direct message, using Meta's official platform APIs. This policy explains what personal data we process, why, and the choices you have. Questions and requests: privacy@commentfor.com.
We process personal data in two roles. For our customers, the businesses that create an account, we act as the data controller. For the people who interact with a customer's connected account, such as commenters, message recipients and people who share contact details, we act as a processor on that customer's behalf: the customer decides why and how that data is used, and requests about it should go to the customer first.
What we collect
- Account information — your email address, login credentials and account settings, and, if you sign in with Google or Apple, the account identifier and email address that service shares with us.
- Connected platform information — information Meta provides when you connect an account, such as the account's name, identifiers and the access tokens needed to act on your behalf.
- Content and interactions — comments, messages and related metadata received through the connected platforms, and the automations you configure.
- Contact details people share — such as an email address a person sends in reply to one of your messages, where you enable that feature.
- Technical and usage information — such as IP address, browser and device details, dates and times of use, pages and features used, links clicked, and security-related events.
- Payment information — handled by our payment processor; we receive confirmation of payment and subscription status, not card details.
How we use it
- To provide, operate, secure and support the service.
- To run the automations you configure on your behalf.
- To communicate with you about your account and the service, including through our own customer-relationship tools.
- To bill for paid plans.
- To detect, prevent and address abuse, fraud and technical issues, and to enforce our terms.
- To comply with legal obligations.
We do not sell personal data, and we do not use your account or automation data for advertising.
Legal basis
Where the law requires a legal basis, we rely on the performance of our contract with you, our legitimate interests in operating, securing and improving the service, your consent where we ask for it, and compliance with legal obligations.
Who we share it with
We share personal data only as needed to provide the service: with Meta, through its platform APIs, in order to act on your connected accounts; with service providers that may host and secure our systems, provide sign-in, deliver email, process payments, measure use of our website and monitor errors; with third-party integrations you choose to connect; with professional advisers; with authorities where the law requires, or where the law permits it in an emergency involving a risk of death or serious physical harm; and with a successor in the event of a business transfer. Providers act on our instructions and are bound by contract. We review any request from a public authority for legal validity, challenge requests that are unlawful, and disclose only the minimum necessary.
Retention
We retain personal data only for as long as necessary for the purposes described here and as required by law. When you delete your account, disconnect a connected account, or ask us to erase your data, we delete or anonymise the related data from our live systems promptly. Encrypted backup copies may be retained for up to 60 days for operational and legal reasons, after which they expire. Security and access logs, which can include IP addresses and account identifiers, may be kept in encrypted archives for up to 14 months from the date of each archive, to meet legal record-keeping duties and to investigate security incidents. A deletion request does not shorten this period. Some information may be kept longer where required by law or needed to resolve disputes, prevent abuse or enforce our agreements. A minimal record that a subscription was cancelled, and an audit entry showing that an erasure was carried out (which holds no account content), may be kept for up to 400 days to resolve payment disputes and to evidence the erasure. Where a connected account was suspended for abuse, or connected within the last 30 days, that decision alone may be kept against a one-way hash of the account for up to 180 days.
Your rights and choices
Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal data, to object to or restrict its processing, to withdraw consent, and to complain to a supervisory authority. To exercise them, use the controls in your account or write to privacy@commentfor.com. Readers in the European Economic Area, the United Kingdom and Switzerland can find further detail on our GDPR page, and California residents on our CCPA page.
How to delete your data
You can delete your account, or disconnect a connected account, from Settings in the dashboard at any time. You can also remove CommentFor from your Instagram or Facebook settings, which sends us Meta's data-deletion request; we honour it and provide a status link through Meta. See Data Deletion for the steps.
International transfers
We and our providers may process personal data in countries other than your own. Where required, we use appropriate safeguards, such as standard contractual clauses, to protect it.
Security
We take reasonable and appropriate measures to protect personal data against loss, misuse and unauthorised access, including encryption of sensitive data. No system or transmission over the internet is completely secure, and we cannot guarantee absolute security.
Cookies and analytics
The app uses only the cookies needed to keep you signed in securely and to remember your display preference. This website uses, with your consent where the law requires it, Google Analytics and advertising measurement, under Google's privacy policy. This website also uses Cloudflare Web Analytics, a measurement service that does not use cookies or identify individual visitors, under Cloudflare's privacy policy. You can accept or reject non-essential cookies on the consent bar and change your choice at any time using the change your cookie choice link on this page. Our Cookie Policy has the detail.
Pages on this website may also load content or data, such as currency exchange rates, from third-party services. Those services receive the technical information your browser sends with any request, under their own privacy policies.
Children
The service is not intended for anyone under 18, and we do not knowingly collect personal data from children.
Changes
We may update this policy from time to time. We will post the updated version here with a new date and, for material changes, notify account holders through the service.