Legal
Privacy policy
What this covers
This policy explains what personal data CommentCrow collects when you use commentcrow.com or the CommentCrow service, and what we do with it.
Data we collect
When you sign up for a trial, claim a Crow Run bonus or contact us
- Your name, email address and role
- What you tell us about your business on the sign-up page: company name, website, country, number of employees and what you sell
- What you tell us about your ads: your Facebook Page and Instagram account, your Meta ad account ID if you give it, ad-spend band if you give it, how many ads you run, who runs them (and your agency's name and email if you give them), who owns replies to your customers and anything you write in the notes
- Which page variant you saw and the campaign that brought you here (UTM parameters)
- Anything you write to us through the contact form or by email
When you connect a Meta account
- Page and ad account identifiers, and an access token for the permissions listed on our Security page
- Comments under your ads, including the commenter's public name, for classification and reply
- Your rules, tone and FAQ settings
Automatically
- Standard server logs (IP address, browser, pages viewed) kept for 30 days
- Only if you say yes in the cookie banner: analytics events (page views, button clicks) through Google Analytics, and ad measurement through the Meta Pixel. See Cookies below.
Why we use it
- To provide the service you asked for (legal basis: contract, or steps before a contract)
- To email you about your trial and onboarding (legitimate interest; you can unsubscribe any time)
- To keep the site secure (legitimate interest)
- To measure how the site is used and whether our ads work (your consent, which you can withdraw any time)
- To log your cookie choices, so we can show you consented (legal obligation: GDPR Article 7(1))
We do not sell personal data, and we do not use your comment data to train models for anyone else.
Who we share it with
Only processors we need to run the service: hosting (Vercel), database (Supabase), form handling, and email (Resend). All under written agreements. Data stays in the EU/EEA, or is transferred under standard contractual clauses.
If you accept statistics or marketing cookies, Google (Google Analytics) and Meta (Meta Pixel) receive your IP address, device details and the pages you visit. Both may transfer this data to the USA, under the EU–US Data Privacy Framework and standard contractual clauses.
Cookies and similar storage
We only store or read something on your device without asking when it is strictly necessary for what you asked for. Everything else waits for your yes in the cookie banner. You can change or withdraw your choice any time with Cookie settings (also at the bottom of every page). When you withdraw, we delete the cookies below and reload the page without the tags. We ask again after 12 months, or sooner if we add a purpose or a company.
We keep a log of each choice (accept, reject, your selection, or closing the banner), with the time, the version of this list you saw and a random ID stored with your choice. It holds no IP address or other details about you, and we keep it for 3 years to be able to show that we asked properly.
If you withdraw consent to statistics, we also ask Google Analytics to delete the data it holds for your browser. If you withdraw consent to marketing, we tell the Meta Pixel on the page that consent is withdrawn and stop sending anything to Meta. Meta offers no way for us to delete what the Pixel already sent; you can see and clear it under Your activity off Meta technologies in your Facebook or Instagram settings.
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
| Strictly necessary (no consent needed) | |||
cr_consent (local storage) | CommentCrow | Remembers your cookie choice and a random ID for our consent log, so we don't ask on every visit | Until you clear it; we ask again after 12 months |
| Cloudflare Turnstile | Cloudflare | Bot check, loaded only when you start using the example ad on the home page, to stop automated abuse of the demo. It sets no tracking cookies. | For the check only |
| Statistics (only with your consent) | |||
_ga | Google Analytics | Tells visits apart, to count visitors | 2 years |
_ga_* | Google Analytics | Keeps track of the current visit | 2 years |
_gid, _gat*, _gcl_* | Google Analytics | Older or optional Google cookies; we don't set them, but delete them if they exist | Up to 90 days |
| Marketing (only with your consent) | |||
_fbp | Meta Pixel | Measures whether our Meta ads lead to visits and sign-ups | 90 days |
_fbc | Meta Pixel | Remembers the ad you clicked to get here | 90 days |
Our fonts are served from our own domain, so loading the page sends nothing to Google Fonts.
How long we keep it
- Sign-up details: until you ask us to delete it, or 12 months after our last contact
- Comment data: see the retention on our Security page
- Logs: 30 days
Your rights
Under GDPR and UK GDPR you can ask for access, correction, deletion, restriction, portability, or object to processing. Use our contact form and we respond within 30 days. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the UK ICO.
Changes
If this policy changes materially, we email everyone with a trial or an active account.