CommentClient
Privacy Policy
Effective date: 24 April 2026 | Last updated: 12 September 2026
1. Introduction
Welcome to CommentClient (the "Service"). We are committed to protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and applicable data-protection legislation.
This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have.
2. Data Controller
| Detail | Value |
|---|
| Company name | Mindful Momentum Ltd |
| Registered address | Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom |
| Company number | 14864005 |
| Email | [email protected] |
| Phone | +855 964 823 658 |
| Hungarian business address | Weiner Leó utca 4., 1066 Budapest, Hungary |
| Hungarian phone | +36 20 515 1514 |
| Service website | https://commentclient.com |
3. What is CommentClient?
CommentClient is a GoHighLevel Marketplace application that monitors YouTube comments on connected channels and automatically creates or updates contacts inside a subscriber's GoHighLevel (GHL) sub-account. The Service enables course creators and educators to convert YouTube audience engagement into email subscribers.
YouTube API Services – Access, Use, and Your Controls
CommentClient uses YouTube API Services. By connecting a YouTube channel to the Service you agree to be bound by the YouTube Terms of Service, and you acknowledge the Google Privacy Policy.
The OAuth scopes we request and why:
https://www.googleapis.com/auth/youtube.readonly — to read your channel's basic details and the list of your own uploaded videos, so you can choose which of your videos the Service should watch for comments.https://www.googleapis.com/auth/youtube.force-ssl — to read the comments on the videos you have chosen to track, and to post a reply to a comment only after you have personally reviewed and approved that specific reply inside your GoHighLevel dashboard.
What we never do with YouTube data: we never edit, hide, or delete your videos, comments, captions, or channel settings; we never post any content without your explicit per-reply approval; we never sell YouTube data, use it for advertising, or use it to train machine-learning or AI models; we never transfer it to third parties except the sub-processors listed in Section 4, and only to operate the Service.
Storage and retention: OAuth access and refresh tokens are encrypted at rest (Fernet) and are deleted immediately when you disconnect your channel, uninstall the app, or revoke access. Retrieved comment data is retained only as described in Section 8 and is deleted within 90 days of subscription termination.
Revoking access: you can disconnect your channel at any time in the app's Settings, or revoke the Service's access directly at myaccount.google.com/permissions or security.google.com/settings/security/permissions.
CommentClient's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Data Processors
We use the following third-party sub-processors to operate the Service:
| Processor | Role | Location |
|---|
| HighLevel Inc. (GoHighLevel) | CRM, contact management, marketing automation | USA |
| Google LLC (YouTube Data API) | YouTube comment retrieval | USA |
| Railway Corp. | Application hosting | USA |
| Supabase Inc. | PostgreSQL database hosting | USA (us-east-1) |
| Upstash Inc. | Redis cache / rate-limit storage | USA / EU |
| BulkGate (Bulkgate s.r.o.) | SMS / text message delivery | EU (Czech Republic) |
| Meta Platforms Ireland Limited | WhatsApp message delivery to contacts who consented to that channel | EU (Ireland) |
All sub-processors are bound by GDPR-compatible Data Processing Agreements. Transfers to the USA are covered by Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.
5. Personal Data We Process
- YouTube commenter data: display name, YouTube channel ID, comment text, video ID, comment timestamp — retrieved via the YouTube Data API.
- GoHighLevel contact data: name, email address, phone number, tags, custom field values — as stored in the subscriber's GHL sub-account.
- Subscriber account data: GHL location ID, OAuth access/refresh tokens (Fernet-encrypted at rest), subscription status.
- Marketing contact data: name, email address, phone number, the consent options you selected, the date, time and IP address of that consent, and the exact consent wording shown to you at the time — collected via our opt-in forms and landing pages (see Section 6).
- Technical data: IP addresses, API request logs, error logs — retained for security and debugging.
6. Marketing Communications & Website Forms
Separately from the CommentClient application described above, we operate marketing websites, landing pages, and opt-in forms (for example on go.commentclient.com and commentclient.com) where you can request free resources and subscribe to updates. This section explains how we handle data collected through those channels.
- Data we collect via forms: first name, email address, phone number, and your marketing / communication preferences and consent.
- Purpose: to deliver the resource you requested (e.g. our free playbook), to send educational and promotional emails, and — only where you expressly opt in — to send SMS / text messages and WhatsApp messages.
- Email marketing: sent on the basis of your consent. We use a double opt-in process — you confirm your email address before receiving further messages — and you can unsubscribe at any time via the link at the bottom of every email.
- SMS / text marketing: where you tick the SMS consent box, you agree to receive transactional and/or marketing text messages from CommentClient (Mindful Momentum Ltd). Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help at any time. Your mobile opt-in and consent are never shared with third parties for their own marketing purposes.
- WhatsApp messaging: where you tick a consent box that covers WhatsApp, you agree to receive transactional and/or marketing messages from CommentClient (Mindful Momentum Ltd) on WhatsApp. We send these through the WhatsApp Business Platform operated by Meta Platforms Ireland Limited, so the messages are delivered through Meta's infrastructure and are also subject to WhatsApp's own privacy policy. Message frequency varies. Reply STOP to opt out or HELP for help at any time. We contact you on WhatsApp only where you gave us your number yourself and consented to that channel; we never message numbers obtained from purchased lists or third parties.
- Legal basis: consent — Art. 6(1)(a) UK GDPR / EU GDPR. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Processors: these forms and communications are operated through HighLevel Inc. (GoHighLevel) and our SMS gateway provider BulkGate (Bulkgate s.r.o.), and, for WhatsApp messages, Meta Platforms Ireland Limited, each acting as a processor under a GDPR-compliant Data Processing Agreement.
- Retention: marketing contact data is retained until you unsubscribe or request deletion, after which it is removed within 90 days, subject to any legal record-keeping obligations.
- Automated decision-making: we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
- Your rights: the data-subject rights in Section 9 and the contact details in Section 15 apply equally to this marketing data.
7. Legal Basis and Purpose
| Purpose | Legal basis (GDPR Art. 6) |
|---|
| Providing the Service (comment monitoring, contact creation) | Contract performance — Art. 6(1)(b) |
| OAuth authentication and token management | Contract performance — Art. 6(1)(b) |
| Marketing emails, SMS and WhatsApp messages (opt-in forms) | Consent — Art. 6(1)(a) |
| Security, fraud prevention, debugging | Legitimate interest — Art. 6(1)(f) |
| Legal and regulatory compliance | Legal obligation — Art. 6(1)(c) |
8. Retention Periods
- Active subscription: data is retained for the duration of the active GHL subscription.
- Post-cancellation: account data is deleted within 90 days of subscription termination.
- YouTube commenters who have not opted in: the comment text, display name and channel ID we retrieve from YouTube are deleted automatically 29 days after we retrieve them, together with the placeholder contact in the creator's CRM, unless the commenter has given us their email address or phone number through an opt-in form.
- Marketing contacts: retained until you unsubscribe or request deletion, then removed within 90 days.
- Consent records: the record of which consent you gave, when, and the wording shown to you is kept for as long as we hold your contact data and for one further year, so that we can demonstrate that consent was given.
- Security / audit logs: up to 12 months.
- OAuth tokens: deleted immediately upon uninstall or revocation.
9. Your Rights
Under the UK GDPR and EU GDPR you have the right to:
- Access — request a copy of personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion under certain conditions.
- Restriction — request that processing be temporarily suspended.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, withdraw at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
10. Cookies
The CommentClient web application uses strictly necessary session cookies for OAuth state verification. No marketing or analytics cookies are set by the application itself. Our marketing websites and landing pages (see Section 6) may additionally use functional and analytics cookies to operate opt-in forms and measure campaign performance; these are managed via our cookie consent banner, and you can also control them through your browser settings.
11. Security
- SSL/TLS encryption on all data in transit.
- OAuth tokens encrypted at rest using Fernet symmetric encryption before database storage.
- Access controls: only authorised personnel and automated systems access production data.
- Regular security reviews and dependency updates.
- Data breach notification within 72 hours of discovery where required by law.
12. Children's Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.
13. Supervisory Authority
If you believe our data processing violates applicable law, you may lodge a complaint with:
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) — naih.hu
- EU: Your local Data Protection Authority.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on this page at least 15 days before taking effect.
15. Contact
Mindful Momentum Ltd
Email: [email protected]
Phone: +855 964 823 658
Address: Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom