Legal
Privacy policy
What this covers
This policy explains what personal data CommentROAS collects when you use commentroas.com or the CommentROAS service, and what we do with it.
Data we collect
When you reserve a seat or contact us
- Your email address and the ad-spend band you select
- Which page variant you saw and the campaign that brought you here (UTM parameters)
- Anything you write to us by email
When you connect a Meta account
- Page and ad account identifiers, and an access token for the permissions listed on our Security page
- Comments under your ads, including the commenter's public name, for classification and reply
- Your rules, tone and FAQ settings
Automatically
- Standard server logs (IP address, browser, pages viewed) kept for 30 days
- Aggregate analytics events (page views, button clicks). We use these to improve the site. Where we use the Meta Pixel for ad measurement, we tell you in a cookie notice and you can decline.
Why we use it
- To provide the service you asked for (legal basis: contract, or steps before a contract)
- To email you about your seat and onboarding (legitimate interest; you can unsubscribe any time)
- To keep the site secure and measure whether it works (legitimate interest)
We do not sell personal data, and we do not use your comment data to train models for anyone else.
Who we share it with
Only processors we need to run the service: hosting (Netlify), form handling, email, and scheduling (Calendly, if you book a call). All under written agreements. Data stays in the EU/EEA, or is transferred under standard contractual clauses.
How long we keep it
- Waitlist email and spend band: until you ask us to delete it, or 12 months after our last contact
- Comment data: see the retention on our Security page
- Logs: 30 days
Your rights
Under GDPR and UK GDPR you can ask for access, correction, deletion, restriction, portability, or object to processing. Reply to any email you have received from us, or reserve a seat on the home page and reply to the confirmation, and we respond within 30 days. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the UK ICO.
Changes
If this policy changes materially, we email everyone with a reserved seat or active account.