Privacy Policy

This Privacy Notice for Loore s.r.o. ("we," "us," or "our") describes how and why we access, collect, store, use, and/or share ("process") personal information when you use CommentLoop (the "Services"), including when you:

• visit or use the CommentLoop web application, or any website of ours that links to this Privacy Notice;
• use CommentLoop to manage, moderate, and reply to comments and direct messages on Facebook Pages and Instagram business accounts you connect;
• engage with us in other related ways, including support, sales, or marketing.

This notice also explains how we handle information about people who comment on or send messages to Pages and Instagram accounts that our customers connect to CommentLoop, because those people do not use CommentLoop themselves.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@loore.io.

Summary of key points

What personal information do we process? Account details you give us, information from the Facebook and Instagram accounts you connect, the comments and direct messages those accounts receive, content from your website if you add it, and technical data needed to run the Services.

Do we process any sensitive personal information? We do not intentionally collect sensitive personal information. Comments and messages written by members of the public can contain anything their authors choose to write; we process them only to provide the Services to the Page owner.

Do we collect any information from third parties? Yes. When you connect Facebook, we receive data from Meta Platforms as described in the section on Meta data below.

Do we sell your information? No. We do not sell personal information, and we do not use data from Meta or from your connected accounts for advertising.

How do you exercise your rights? Contact us at support@loore.io, or follow our data deletion instructions.

Table of contents

1. What information do we collect?
2. What data do we receive from Meta (Facebook and Instagram)?
3. How do we process your information?
4. What legal bases do we rely on to process your personal information?
5. When and with whom do we share your personal information?
6. How do we use artificial intelligence?
7. Do we use cookies and other tracking technologies?
8. How long do we keep your information?
9. How do we keep your information safe?
10. Do we collect information from minors?
11. What are your privacy rights?
12. Controls for Do-Not-Track features
13. Do United States residents have specific privacy rights?
14. Do we make updates to this notice?
15. How can you contact us about this notice?
16. How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you provide when you register for the Services, use them, or contact us. This may include:

• names;
• email addresses;
• passwords (stored only in hashed form by our authentication provider);
• the website address of your business, if you add one so CommentLoop can answer questions about your products;
• moderation settings, keyword lists, automation rules, reply texts, and other content you enter in the Services;
• billing information, if you subscribe to a paid plan (card details are handled by our payment provider and never stored by us).

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In short: Some technical information, such as your IP address and browser characteristics, is collected automatically when you use the Services.

When you use the Services, our hosting and infrastructure providers automatically record technical information such as your IP address, browser and device type, operating system, the pages you request, dates and times, and error reports. This information is needed to keep the Services secure and working, and for troubleshooting.

2. What data do we receive from Meta (Facebook and Instagram)?

In short: When you connect Facebook, we receive only the data needed to manage comments and messages on the Pages and Instagram accounts you choose.

When you click Connect Facebook or Add Pages and grant permission, we receive and store:

• your Facebook user ID and name, and an access token for your Facebook login;
• for each Page you choose: its ID, name, profile picture, a Page access token, and the linked Instagram business account (ID, username, and profile picture);
• comments on your Pages' posts and ads and on your Instagram account's posts and ads: the comment text, any attachment flag, the time, the post or ad it belongs to, and the commenter's ID, name or username;
• direct messages sent to your Page on Messenger or to your Instagram account: the message text and attachments, the time, and the sender's ID, name or username, and profile picture.

Access tokens are encrypted before they are stored and are never shown in the browser. We use Meta data only to provide the Services to the account that connected it: showing comments and messages, moderating them according to your settings, drafting and sending replies you approve or configure, and producing the totals shown in your dashboard. We do not sell Meta data, use it for advertising, or share it with other customers.

People who comment on or message a connected Page. If you commented on or messaged a Facebook Page or Instagram account that uses CommentLoop, the account owner (our customer) decides how your comment or message is handled, and we process it on their behalf. To ask for your data to be deleted, contact the account owner or follow our data deletion instructions.

You can remove CommentLoop's access at any time by removing a Page in CommentLoop, or by removing the app in your Facebook settings (Settings and privacy, Settings, Business integrations).

3. How do we process your information?

In short: We process your information to provide, improve, and administer the Services, communicate with you, for security and fraud prevention, and to comply with law.

• To create and manage your account and let you log in.
• To deliver the Services: receiving comments and messages from Meta, labelling them, hiding or deleting them according to the rules you set, drafting and sending replies, running your automations, and showing your inbox, action log, and totals.
• To answer questions about your products: reading the public pages of the website you add so reply drafts can use correct information.
• To communicate with you: account emails, such as onboarding messages and alerts when your Facebook connection needs to be renewed.
• To bill you for paid plans and enforce plan limits.
• To keep the Services secure and to save or protect an individual's vital interest.

4. What legal bases do we rely on to process your information?

In short: We only process personal information when we have a valid legal reason to do so under applicable law, such as to perform our contract with you, your consent, our legitimate interests, or to comply with law.

If you are located in the EU or UK, this section applies to you.

• Performance of a contract. We process your account information and the data from the accounts you connect to provide the Services you signed up for.
• Consent. Where we rely on your permission, such as connecting your Facebook account, you can withdraw it at any time.
• Legitimate interests. We process technical data to secure and improve the Services.
• Legal obligations. We may process information to comply with the law, for example tax and accounting rules, or to cooperate with a law enforcement body or regulatory agency.
• Vital interests. We may process information where necessary to protect the vital interests of any person.

For comments and messages written by people who are not our customers, our customer is the controller and we act as their processor.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (express consent) or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example, for investigations and fraud detection and prevention, if disclosure is required to comply with a subpoena, warrant, court order, or rules of the court, or if the information is publicly available and is specified by the regulations.

5. When and with whom do we share your personal information?

In short: We share information only with the service providers that run CommentLoop for us, and in the situations described below.

We use the following service providers, each under contract to process data only on our instructions:

• Meta Platforms, to read and act on comments and messages on your connected Pages and Instagram accounts;
• Supabase, for our database, file storage, and login;
• Vercel, to host the web application;
• Trigger.dev, to run background jobs;
• OpenRouter and the AI model providers it routes to (currently TypeSafe, Google, and OpenAI), to label comments, draft replies, and search your website content;
• Firecrawl, to read the public pages of the website you add;
• Resend, to send account emails;
• Stripe, to process payments for paid plans.

Some of these providers process data outside the European Economic Area, including in the United States. Where required, these transfers rely on the data protection terms those providers offer, such as standard contractual clauses.

We may also share information:

• Business transfers. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal requirements. Where we are required to do so by law.

6. How do we use artificial intelligence?

In short: AI labels comments and drafts replies; you control what happens with them.

CommentLoop sends the text of incoming comments, the commenter's name, and the relevant parts of your website content to AI models through OpenRouter. The models return labels (for example spam, question, or profanity) with probabilities, and reply drafts with a confidence score. Depending on the settings you choose, CommentLoop then hides or deletes comments, saves reply drafts for you to review, or sends replies automatically. Every action is recorded in your action log, and hidden comments can be unhidden.

We do not use your data or the comments and messages you receive to train AI models.

7. Do we use cookies and other tracking technologies?

In short: We use only the cookies needed to run the Services.

We use essential cookies to keep you logged in, to protect the Facebook connection step against forgery, and to remember whether your sidebar is open. We do not use advertising or third-party tracking cookies. Most web browsers are set to accept cookies by default; if you block them, you will not be able to log in.

8. How long do we keep your information?

In short: We keep your information for as long as your account exists, unless the law requires otherwise.

We keep your account information and the data from your connected accounts for as long as you have an account with us. When you remove a Page, its comments, messages, settings, automations, and stored pictures are deleted. When you close your account, we delete your data within 30 days, except where we must keep it longer by law (for example billing records). If deletion is not immediately possible, for example because data is in backups, we securely store it and isolate it from further processing until deletion is possible.

9. How do we keep your information safe?

In short: We protect your personal information through organizational and technical security measures.

Access tokens are encrypted, every request is checked against the logged-in account, database rows are restricted to the account they belong to, stored pictures are private and served through short-lived links, and webhooks from Meta are accepted only with a valid signature. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorized third parties will not be able to defeat our security. You should only access the Services within a secure environment.

10. Do we collect information from minors?

In short: We do not knowingly collect data from or market to children under 18 years of age.

CommentLoop is a business tool for people 18 years of age or older. If we learn that we have collected personal information from a user under 18, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any such data, please contact us at support@loore.io.

11. What are your privacy rights?

In short: Depending on where you live, such as the EEA, UK, Switzerland, Canada, or some US states, you have rights that allow you greater access to and control over your personal information.

These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us at support@loore.io. We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent. Where we rely on your consent, you can withdraw it at any time by contacting us or by disconnecting Facebook. This will not affect the lawfulness of the processing before its withdrawal.

Account information

You can review and change your name and password in Settings, and remove connected Pages on the Pages screen. To close your account, email us at support@loore.io. We may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal requirements.

12. Controls for Do-Not-Track features

Most web browsers include a Do-Not-Track ("DNT") setting. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT browser signals. Because we do not use tracking cookies, this does not change how we process your information. California law requires us to let you know how we respond to DNT signals; this paragraph is that notice.

13. Do United States residents have specific privacy rights?

In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to access, correct, get a copy of, or delete your personal information, and to withdraw your consent.

Categories of personal information we collect

We keep the categories marked YES for as long as the user has an account with us, as described in section 8.

We have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months, and we will not do so in the future.

Your rights

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of targeted advertising, the sale of personal data, or profiling (we do none of these)

How to exercise your rights

Email us at support@loore.io. You can designate an authorized agent to make a request on your behalf; we may deny a request from an agent who cannot show they are validly authorized. We will need to verify your identity before acting on a request, and will use the information you provide only for that purpose.

Appeals

If we decline to act on your request, you may appeal by emailing support@loore.io. We will tell you in writing what action we took and why. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" law

California residents may request once a year, free of charge, information about personal information we disclosed to third parties for direct marketing purposes. We do not disclose personal information for that purpose. To make a request, contact us using the details below.

14. Do we make updates to this notice?

In short: Yes, we update this notice as necessary to stay compliant with relevant laws.

The updated version will be indicated by the "Last updated" date at the top. If we make material changes, we will notify you by email or in the Services.

15. How can you contact us about this notice?

Email us at support@loore.io or write to:

16. How can you review, update, or delete the data we collect from you?

You can review and update your account details in Settings, remove connected Pages on the Pages screen, and request a copy, correction, or deletion of your personal information by emailing support@loore.io. See also our data deletion instructions.