CommentClient

Privacy Policy

Effective date: 24 April 2026  |  Last updated: 24 April 2026

1. Introduction

Welcome to CommentClient (the "Service"). We are committed to protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and applicable data-protection legislation.

This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have.

2. Data Controller

Detail	Value
Company name	Mindful Momentum Ltd
Registered address	Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom
Company number	14864005
UTR	61309 15915
Email	[email protected]
Phone	+855 964 823 658
Hungarian business address	Weiner Leó utca 4., 1066 Budapest, Hungary
Hungarian phone	+36 20 515 1514
Service website	https://commentclient.com

3. What is CommentClient?

CommentClient is a GoHighLevel Marketplace application that monitors YouTube comments on connected channels and automatically creates or updates contacts inside a subscriber's GoHighLevel (GHL) sub-account. The Service enables course creators and educators to convert YouTube audience engagement into email subscribers.

4. Data Processors

We use the following third-party sub-processors to operate the Service:

Processor	Role	Location
HighLevel Inc. (GoHighLevel)	CRM, contact management, marketing automation	USA
Google LLC (YouTube Data API)	YouTube comment retrieval	USA
Railway Corp.	Application hosting	USA
Neon Inc.	PostgreSQL database hosting	USA / EU
Upstash Inc.	Redis cache / rate-limit storage	USA / EU

All sub-processors are bound by GDPR-compatible Data Processing Agreements. Transfers to the USA are covered by Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.

5. Personal Data We Process

• YouTube commenter data: display name, YouTube channel ID, comment text, video ID, comment timestamp — retrieved via the YouTube Data API.
• GoHighLevel contact data: name, email address, phone number, tags, custom field values — as stored in the subscriber's GHL sub-account.
• Subscriber account data: GHL location ID, OAuth access/refresh tokens (Fernet-encrypted at rest), subscription status.
• Technical data: IP addresses, API request logs, error logs — retained for security and debugging.

6. Legal Basis and Purpose

Purpose	Legal basis (GDPR Art. 6)
Providing the Service (comment monitoring, contact creation)	Contract performance — Art. 6(1)(b)
OAuth authentication and token management	Contract performance — Art. 6(1)(b)
Security, fraud prevention, debugging	Legitimate interest — Art. 6(1)(f)
Legal and regulatory compliance	Legal obligation — Art. 6(1)(c)

7. Retention Periods

• Active subscription: data is retained for the duration of the active GHL subscription.
• Post-cancellation: account data is deleted within 90 days of subscription termination.
• Security / audit logs: up to 12 months.
• OAuth tokens: deleted immediately upon uninstall or revocation.

8. Your Rights

Under the UK GDPR and EU GDPR you have the right to:

• Access — request a copy of personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion under certain conditions.
• Restriction — request that processing be temporarily suspended.
• Data portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, withdraw at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Cookies

The CommentClient web application uses strictly necessary session cookies for OAuth state verification. No marketing or analytics cookies are set by CommentClient itself.

10. Security

• SSL/TLS encryption on all data in transit.
• OAuth tokens encrypted at rest using Fernet symmetric encryption before database storage.
• Access controls: only authorised personnel and automated systems access production data.
• Regular security reviews and dependency updates.
• Data breach notification within 72 hours of discovery where required by law.

11. Children's Privacy

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

12. Supervisory Authority

If you believe our data processing violates applicable law, you may lodge a complaint with:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) — naih.hu
• EU: Your local Data Protection Authority.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on this page at least 15 days before taking effect.

14. Contact

Mindful Momentum Ltd
Email: [email protected]
Phone: +855 964 823 658
Address: Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom