CommentClient

Privacy Policy

Effective date: 24 April 2026  |  Last updated: 4 July 2026

1. Introduction

Welcome to CommentClient (the "Service"). We are committed to protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and applicable data-protection legislation.

This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have.

2. Data Controller

Detail	Value
Company name	Mindful Momentum Ltd
Registered address	Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom
Company number	14864005
Email	[email protected]
Phone	+855 964 823 658
Hungarian business address	Weiner Leó utca 4., 1066 Budapest, Hungary
Hungarian phone	+36 20 515 1514
Service website	https://commentclient.com

3. What is CommentClient?

CommentClient is a GoHighLevel Marketplace application that monitors YouTube comments on connected channels and automatically creates or updates contacts inside a subscriber's GoHighLevel (GHL) sub-account. The Service enables course creators and educators to convert YouTube audience engagement into email subscribers.

YouTube API Services – Access, Use, and Your Controls

CommentClient uses YouTube API Services. By connecting a YouTube channel to the Service you agree to be bound by the YouTube Terms of Service, and you acknowledge the Google Privacy Policy.

The OAuth scopes we request and why:

• https://www.googleapis.com/auth/youtube.readonly — to read your channel's basic details and the list of your own uploaded videos, so you can choose which of your videos the Service should watch for comments.
• https://www.googleapis.com/auth/youtube.force-ssl — to read the comments on the videos you have chosen to track, and to post a reply to a comment only after you have personally reviewed and approved that specific reply inside your GoHighLevel dashboard.

What we never do with YouTube data: we never edit, hide, or delete your videos, comments, captions, or channel settings; we never post any content without your explicit per-reply approval; we never sell YouTube data, use it for advertising, or use it to train machine-learning or AI models; we never transfer it to third parties except the sub-processors listed in Section 4, and only to operate the Service.

Storage and retention: OAuth access and refresh tokens are encrypted at rest (Fernet) and are deleted immediately when you disconnect your channel, uninstall the app, or revoke access. Retrieved comment data is retained only as described in Section 8 and is deleted within 90 days of subscription termination.

Revoking access: you can disconnect your channel at any time in the app's Settings, or revoke the Service's access directly at myaccount.google.com/permissions or security.google.com/settings/security/permissions.

CommentClient's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Processors

We use the following third-party sub-processors to operate the Service:

Processor	Role	Location
HighLevel Inc. (GoHighLevel)	CRM, contact management, marketing automation	USA
Google LLC (YouTube Data API)	YouTube comment retrieval	USA
Railway Corp.	Application hosting	USA
Supabase Inc.	PostgreSQL database hosting	USA (us-east-1)
Upstash Inc.	Redis cache / rate-limit storage	USA / EU
BulkGate (Bulkgate s.r.o.)	SMS / text message delivery	EU (Czech Republic)

All sub-processors are bound by GDPR-compatible Data Processing Agreements. Transfers to the USA are covered by Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.

5. Personal Data We Process

• YouTube commenter data: display name, YouTube channel ID, comment text, video ID, comment timestamp — retrieved via the YouTube Data API.
• GoHighLevel contact data: name, email address, phone number, tags, custom field values — as stored in the subscriber's GHL sub-account.
• Subscriber account data: GHL location ID, OAuth access/refresh tokens (Fernet-encrypted at rest), subscription status.
• Marketing contact data: name, email address, phone number, and marketing consent — collected via our opt-in forms and landing pages (see Section 6).
• Technical data: IP addresses, API request logs, error logs — retained for security and debugging.

6. Marketing Communications & Website Forms

Separately from the CommentClient application described above, we operate marketing websites, landing pages, and opt-in forms (for example on go.commentclient.com and commentclient.com) where you can request free resources and subscribe to updates. This section explains how we handle data collected through those channels.

• Data we collect via forms: first name, email address, phone number, and your marketing / communication preferences and consent.
• Purpose: to deliver the resource you requested (e.g. our free playbook), to send educational and promotional emails, and — only where you expressly opt in — to send SMS / text messages.
• Email marketing: sent on the basis of your consent. We use a double opt-in process — you confirm your email address before receiving further messages — and you can unsubscribe at any time via the link at the bottom of every email.
• SMS / text marketing: where you tick the SMS consent box, you agree to receive transactional and/or marketing text messages from CommentClient (Mindful Momentum Ltd). Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help at any time. Your mobile opt-in and consent are never shared with third parties for their own marketing purposes.
• Legal basis: consent — Art. 6(1)(a) UK GDPR / EU GDPR. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Processors: these forms and communications are operated through HighLevel Inc. (GoHighLevel) and our SMS gateway provider BulkGate (Bulkgate s.r.o.), each acting as a processor under a GDPR-compliant Data Processing Agreement.
• Retention: marketing contact data is retained until you unsubscribe or request deletion, after which it is removed within 90 days, subject to any legal record-keeping obligations.
• Automated decision-making: we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
• Your rights: the data-subject rights in Section 9 and the contact details in Section 15 apply equally to this marketing data.

7. Legal Basis and Purpose

Purpose	Legal basis (GDPR Art. 6)
Providing the Service (comment monitoring, contact creation)	Contract performance — Art. 6(1)(b)
OAuth authentication and token management	Contract performance — Art. 6(1)(b)
Marketing emails and SMS (opt-in forms)	Consent — Art. 6(1)(a)
Security, fraud prevention, debugging	Legitimate interest — Art. 6(1)(f)
Legal and regulatory compliance	Legal obligation — Art. 6(1)(c)

8. Retention Periods

• Active subscription: data is retained for the duration of the active GHL subscription.
• Post-cancellation: account data is deleted within 90 days of subscription termination.
• Marketing contacts: retained until you unsubscribe or request deletion, then removed within 90 days.
• Security / audit logs: up to 12 months.
• OAuth tokens: deleted immediately upon uninstall or revocation.

9. Your Rights

Under the UK GDPR and EU GDPR you have the right to:

• Access — request a copy of personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion under certain conditions.
• Restriction — request that processing be temporarily suspended.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, withdraw at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Cookies

The CommentClient web application uses strictly necessary session cookies for OAuth state verification. No marketing or analytics cookies are set by the application itself. Our marketing websites and landing pages (see Section 6) may additionally use functional and analytics cookies to operate opt-in forms and measure campaign performance; these are managed via our cookie consent banner, and you can also control them through your browser settings.

11. Security

• SSL/TLS encryption on all data in transit.
• OAuth tokens encrypted at rest using Fernet symmetric encryption before database storage.
• Access controls: only authorised personnel and automated systems access production data.
• Regular security reviews and dependency updates.
• Data breach notification within 72 hours of discovery where required by law.

12. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

13. Supervisory Authority

If you believe our data processing violates applicable law, you may lodge a complaint with:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) — naih.hu
• EU: Your local Data Protection Authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on this page at least 15 days before taking effect.

15. Contact

Mindful Momentum Ltd
Email: [email protected]
Phone: +855 964 823 658
Address: Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom