Last updated: 13 May 2026
CommentR uses the third-party services listed below to operate the service. A “sub-processor” is a third party that processes personal data on our behalf to deliver the CommentR service to you. We rely on each sub-processor's privacy commitments and have data processing agreements in place where required by applicable law.
Change notification: we aim to notify customers at least 30 days before adding a new sub-processor or making a material change to this list. To receive notifications, email [email protected].
| Sub-processor | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Meta Platforms, Inc. | Facebook & Instagram comment retrieval and posting via Graph API; server-to-server conversion event tracking (Conversions API) for ad optimization | Page content, comments, ad data, your Facebook user ID, name, email, hashed identifiers and conversion events | United States / Ireland | Link |
| OpenAI, Inc. | AI-suggested replies (Trial tier) | Comment text and post context (no account tokens, emails, or user IDs) | United States | Link |
| Anthropic, PBC | AI-suggested replies and brand voice analysis (Starter, Growth, PRO, Business tiers) | Comment text and post context (no account tokens, emails, or user IDs) | United States | Link |
| Supabase, Inc. | Authentication and database hosting | Account credentials, user metadata, application data | United States | Link |
| Stripe Payments Canada, Ltd. | Payment processing and subscription billing | Name, email, tokenized payment method, invoice records | Canada / United States | Link |
| ActiveCampaign, LLC (Postmark) | Transactional email (sign-in, password reset, account recovery) | Email address, name | United States | Link |
| Klaviyo, Inc. | Lifecycle email (welcome, trial reminders, onboarding) and behavioural event ingestion (signup, trial start, subscription) for audience segmentation | Email address, name, account lifecycle events | United States | Link |
| Resend, Inc. | Team invite emails | Email address, invite metadata | United States | Link |
| Cybot A/S (Cookiebot) | Cookie consent management | Anonymized IP address, consent state | European Union (Denmark) | Link |
| Cloudflare, Inc. | DNS, content delivery, and DDoS protection | IP address, request metadata | United States | Link |
| Netcup GmbH | Server infrastructure (VPS hosting) | All application data at rest | Germany | Link |
Several sub-processors are located outside of the European Economic Area and the United Kingdom. When personal data is transferred internationally, we rely on safeguards required by applicable law, such as the European Commission's Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms.
For questions about our sub-processors or to request a copy of our data processing terms, contact [email protected].
See also our Privacy Policy and Terms of Service.