CommentClient
Privacy Policy
Effective date: 24 April 2026 | Last updated: 4 July 2026
1. Introduction
Welcome to CommentClient (the "Service"). We are committed to protecting your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and applicable data-protection legislation.
This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have.
2. Data Controller
| Detail | Value |
|---|
| Company name | Mindful Momentum Ltd |
| Registered address | Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom |
| Company number | 14864005 |
| Email | [email protected] |
| Phone | +855 964 823 658 |
| Hungarian business address | Weiner Leó utca 4., 1066 Budapest, Hungary |
| Hungarian phone | +36 20 515 1514 |
| Service website | https://commentclient.com |
3. What is CommentClient?
CommentClient is a GoHighLevel Marketplace application that monitors YouTube comments on connected channels and automatically creates or updates contacts inside a subscriber's GoHighLevel (GHL) sub-account. The Service enables course creators and educators to convert YouTube audience engagement into email subscribers.
4. Data Processors
We use the following third-party sub-processors to operate the Service:
| Processor | Role | Location |
|---|
| HighLevel Inc. (GoHighLevel) | CRM, contact management, marketing automation | USA |
| Google LLC (YouTube Data API) | YouTube comment retrieval | USA |
| Railway Corp. | Application hosting | USA |
| Neon Inc. | PostgreSQL database hosting | USA / EU |
| Upstash Inc. | Redis cache / rate-limit storage | USA / EU |
| BulkGate (Bulkgate s.r.o.) | SMS / text message delivery | EU (Czech Republic) |
All sub-processors are bound by GDPR-compatible Data Processing Agreements. Transfers to the USA are covered by Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework.
5. Personal Data We Process
- YouTube commenter data: display name, YouTube channel ID, comment text, video ID, comment timestamp — retrieved via the YouTube Data API.
- GoHighLevel contact data: name, email address, phone number, tags, custom field values — as stored in the subscriber's GHL sub-account.
- Subscriber account data: GHL location ID, OAuth access/refresh tokens (Fernet-encrypted at rest), subscription status.
- Marketing contact data: name, email address, phone number, and marketing consent — collected via our opt-in forms and landing pages (see Section 6).
- Technical data: IP addresses, API request logs, error logs — retained for security and debugging.
6. Marketing Communications & Website Forms
Separately from the CommentClient application described above, we operate marketing websites, landing pages, and opt-in forms (for example on go.commentclient.com and commentclient.com) where you can request free resources and subscribe to updates. This section explains how we handle data collected through those channels.
- Data we collect via forms: first name, email address, phone number, and your marketing / communication preferences and consent.
- Purpose: to deliver the resource you requested (e.g. our free playbook), to send educational and promotional emails, and — only where you expressly opt in — to send SMS / text messages.
- Email marketing: sent on the basis of your consent. We use a double opt-in process — you confirm your email address before receiving further messages — and you can unsubscribe at any time via the link at the bottom of every email.
- SMS / text marketing: where you tick the SMS consent box, you agree to receive transactional and/or marketing text messages from CommentClient (Mindful Momentum Ltd). Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help at any time. Your mobile opt-in and consent are never shared with third parties for their own marketing purposes.
- Legal basis: consent — Art. 6(1)(a) UK GDPR / EU GDPR. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Processors: these forms and communications are operated through HighLevel Inc. (GoHighLevel) and our SMS gateway provider BulkGate (Bulkgate s.r.o.), each acting as a processor under a GDPR-compliant Data Processing Agreement.
- Retention: marketing contact data is retained until you unsubscribe or request deletion, after which it is removed within 90 days, subject to any legal record-keeping obligations.
- Automated decision-making: we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
- Your rights: the data-subject rights in Section 9 and the contact details in Section 15 apply equally to this marketing data.
7. Legal Basis and Purpose
| Purpose | Legal basis (GDPR Art. 6) |
|---|
| Providing the Service (comment monitoring, contact creation) | Contract performance — Art. 6(1)(b) |
| OAuth authentication and token management | Contract performance — Art. 6(1)(b) |
| Marketing emails and SMS (opt-in forms) | Consent — Art. 6(1)(a) |
| Security, fraud prevention, debugging | Legitimate interest — Art. 6(1)(f) |
| Legal and regulatory compliance | Legal obligation — Art. 6(1)(c) |
8. Retention Periods
- Active subscription: data is retained for the duration of the active GHL subscription.
- Post-cancellation: account data is deleted within 90 days of subscription termination.
- Marketing contacts: retained until you unsubscribe or request deletion, then removed within 90 days.
- Security / audit logs: up to 12 months.
- OAuth tokens: deleted immediately upon uninstall or revocation.
9. Your Rights
Under the UK GDPR and EU GDPR you have the right to:
- Access — request a copy of personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion under certain conditions.
- Restriction — request that processing be temporarily suspended.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, withdraw at any time.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
10. Cookies
The CommentClient web application uses strictly necessary session cookies for OAuth state verification. No marketing or analytics cookies are set by the application itself. Our marketing websites and landing pages (see Section 6) may additionally use functional and analytics cookies to operate opt-in forms and measure campaign performance; these are managed via our cookie consent banner, and you can also control them through your browser settings.
11. Security
- SSL/TLS encryption on all data in transit.
- OAuth tokens encrypted at rest using Fernet symmetric encryption before database storage.
- Access controls: only authorised personnel and automated systems access production data.
- Regular security reviews and dependency updates.
- Data breach notification within 72 hours of discovery where required by law.
12. Children's Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.
13. Supervisory Authority
If you believe our data processing violates applicable law, you may lodge a complaint with:
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) — naih.hu
- EU: Your local Data Protection Authority.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on this page at least 15 days before taking effect.
15. Contact
Mindful Momentum Ltd
Email: [email protected]
Phone: +855 964 823 658
Address: Hova House, 1 Hova Villas, Brighton & Hove, BN3 3DH, United Kingdom