Privacy Policy

1Who we are#

CommentWatchDog provides comment moderation and direct message automation for Facebook pages and Instagram professional accounts at commentwatchdog.com and app.commentwatchdog.com (the "Service"). It is operated by GrowMeOrganic LLC, 30 N Gould St STE R, Sheridan, WY 82801, United States, the controller for the data described in this policy. You can reach us at support@commentwatchdog.com.

2Who this covers#

This policy covers three groups of people: customers who create an account, team members a customer invites, and the people whose comments and messages appear on a customer's connected pages. For that third group we process data on the customer's instructions; the customer is the controller of that data and we act as their processor. That group includes the people in a customer's contact list: each person an automation of the customer sent something to, or who gave it something, such as an email address.

3Data we collect#

• Account data: your name, email address, language and timezone preferences, and workspace details. There is no password: you sign in with a one-time code or link we email you, or with Google.
• Sign in with Google: if you choose to sign in with Google, Google sends us the name, email address and account identifier of the Google account you pick, and we use them to create or find your CommentWatchDog account. We never see your Google password and we do not read or post anything in your Google account. Google's own privacy policy governs what Google records about the sign-in.
• Meta platform data: when you connect your Facebook account, we receive access tokens for the pages you choose, page names and identifiers, and the content the Service exists to manage: comments, commenter names and public profile pictures, direct messages sent to your pages, and related metadata such as timestamps and post identifiers.
• Contacts and DM automation data: when you use DM automation, the Service keeps a contact record for each person an automation of yours sent something to, or who gave it something. The record holds their name and username; on Instagram, whether they follow your account, their follower count and whether they are verified, as last read from Meta; an email address or a phone number they typed in answer to a question your automation asked, with that question and the time; the answers your flows saved to the custom fields you defined; the tags, field values and team notes you added; whether they asked to stop; which links in an automated message they opened, and when; and the history of the automation runs that involved them. Photos, videos, voice notes and files a person sends you in a message are copied to our storage, because Meta's links to them expire.
• Billing data: payments are processed by Stripe. We store your plan, subscription status, invoice references, and the billing address and phone number you give at checkout. We never see or store your full card number.
• Usage and log data: standard technical logs such as IP address, browser type and actions taken in the Service, used for security and troubleshooting; the pages you visit on our websites, with the visitor cookie described in section 11; and the link that brought you, including its campaign tags and, when you arrive from a Meta ad, Meta's click identifier.
• Support correspondence: emails you send us, kept so we can help you and improve.

4How we use it#

• To run the Service: fetching, classifying, hiding, deleting and replying to comments and messages on the pages you connected, according to the rules you set.
• To run DM automation when you use it: sending the public replies and direct messages your automations and AI agents write, asking the questions you set and saving the answers to the contact, keeping your contact list, counting the links opened in an automated message, and sending the HTTP requests you configure in a flow to the addresses you chose.
• To send you service emails such as sign-in codes and links, team invitations, usage warnings and the digests you enable.
• To bill you, prevent abuse, and comply with law.
• To measure and improve our own advertising on Facebook and Instagram, as described in section 12.

Where the GDPR applies, our legal bases are: performing our contract with you (running the Service, billing), our legitimate interests (security, abuse prevention, improving the Service), and your consent where we ask for it specifically, such as for ad measurement. We do not sell personal data for money, and we never use the content of the pages, comments or messages you moderate for advertising.

5Meta platform data#

Our use of data received from Meta's APIs complies with the Meta Platform Terms and Developer Policies. Page access tokens are used only to operate the features you configure, are never shared with third parties, and are deleted when you disconnect a page or your Facebook account. Disconnecting is available at any time inside the Service under Settings, then Pages. If you remove CommentWatchDog from your Facebook account on Facebook's side, Meta notifies us immediately: our access ends, and we email the workspace owner.

Where you use DM automation, the Service uses the message access you granted for three more things: to send the messages your automations and AI agents write; to read, for a person who messaged you on Instagram, whether they follow your account, their username, their follower count and whether they are verified; and to set the ice breakers shown on your page while a live automation of yours uses them. An automated message is sent only in response to something the person did, such as commenting, sending a message, tapping a button or replying to a story.

6AI processing#

To classify comments (for example profanity, negativity or spam), and when you use those features, to translate text or draft replies, the text of a comment is sent to our AI providers and processed only to return the result. Comment text sent this way is not used by us to train AI models, and our providers process it under API terms that exclude training on customer content. No commenter profile is built; each request stands alone.

When an AI agent you set up answers a comment or a message, our AI providers are sent that comment or message and the knowledge and instructions you gave the agent; for a message, they are also sent the most recent messages of the same conversation, with the sender's display name and your page's name, so the answer fits the conversation. Before an automatic answer is sent, a second request checks it against that knowledge. This content is handled like the comment text above: it is processed only to return the result, it is not used by us to train AI models, and our providers process it under API terms that exclude training on customer content.

7Subprocessors#

These are the companies that touch data on our behalf, what they do, and where they process it. We add to this list only when the Service needs it.

Meta also receives data from our websites when ad measurement is allowed. For that it is not our subprocessor but a separate controller, as described in section 12.

An HTTP request step in a flow sends what you put in it, for example a contact's email address or an answer, to the web address you configured, each time the flow reaches that step. The recipient is a service you chose; we send to it on your instruction, and it is not our subprocessor.

The same list, with the data each company handles and a change log, is kept on the Subprocessors page. Business customers covered by the GDPR or similar laws have our Data Processing Agreement, which applies automatically.

8Where data lives#

Service data is stored on servers operated by Hetzner Online GmbH in the European Union. Where a subprocessor processes data in the United States, the transfer relies on recognized safeguards such as standard contractual clauses in that provider's data processing terms. Neither this site nor the product requests anything from Google: the typefaces are served from our own servers.

9Retention and backups#

• Comment and message history is kept while your account is active, so your inbox and insights keep working.
• Contact records, with their tags, fields and collected answers, and the record of links opened, are kept until the page is removed or your account is deleted (section 14).
• The history of automation runs is deleted after 90 days, and after 30 days for runs that were skipped. Daily totals are kept.
• The copies of photos, videos, voice notes and files sent in messages are deleted one year after the message; the message itself stays in your inbox.
• Backups are taken daily. The copy on our server rolls off after 14 days, and the copy on a second server after 30 days.
• If your account is deleted, all associated data, including comment history and tokens, is removed immediately, and leaves the backups within 30 days. Files you uploaded are deleted with it; a file uploaded in the last seven days is deleted within eight days.
• Deletion receipts (a confirmation code and counts of what was removed, never content) are kept so deletions stay verifiable.
• Records of the events we sent to Meta (section 12) are kept for 400 days; the IP address in them is deleted after 90 days.

10Your rights#

You can access, correct, export or delete your data. Where the GDPR or similar laws apply, you additionally have the right to restrict or object to processing, the right to data portability, and the right to lodge a complaint with a supervisory authority.

California and other US state residents: we do not sell personal information for money. Our use of Meta's and OpenAI's measurement tools for advertising may count as "sharing" under the CCPA and as targeted advertising under other state laws. You can opt out by writing to support@commentwatchdog.com, and we honour the Global Privacy Control signal as that opt-out.

Workspace owners exercise these rights directly in the app. Commenters whose content appears in a customer's workspace can contact us, and we will coordinate with the workspace owner as the law requires. The same applies to a person who sent a message to a customer's page or who is in a customer's contact list: that customer is the controller of the data, so a request is best sent to the business you wrote to, and a request that reaches us is passed to the workspace owner. A customer can erase one person from their workspace with Forget: it deletes the person's name, username, email address, phone number, saved answers and the conversation kept in the Service; Meta keeps its own copy of the messages. A person who no longer wants automated messages from a page can write "stop" to it; every automation on that page skips them from then on.

11Cookies#

The Service uses a small number of first-party cookies: a session cookie that keeps you signed in, a preference cookie for your language, and a visitor cookie (cwd_vid) that recognises your browser on our websites, so we can understand which pages and sources bring people to the Service and support you when you sign up. We record the pages you visit here, the time spent on them, how much of a video you watch on our site, the page you arrived from, your browser and device details, and an approximate location derived from your IP address; the IP address itself is deleted after 90 days.

Ad measurement (section 12) uses four more cookies, two read by the Meta Pixel and two by the OpenAI Pixel. You can remove any of these cookies in your browser settings, or write to support@commentwatchdog.com to have your visit history deleted.

Every cookie by name, with its purpose and how long it lasts, and the browser storage the site and the app use, is in the Cookie Policy.

12Ad measurement: Meta and ChatGPT#

We advertise CommentWatchDog on Facebook and Instagram, and in ChatGPT. To learn which ads bring people who sign up and buy, and to show our ads to people likely to find the Service useful, we use two tools from Meta: the Meta Pixel, a script on commentwatchdog.com and app.commentwatchdog.com, and the Meta Conversions API, which sends the same events from our servers. The recipient is Meta Platforms Ireland Limited for people in the EEA, the UK and Switzerland, and Meta Platforms, Inc. everywhere else.

For our ads in ChatGPT we use the same two kinds of tool from OpenAI: the OpenAI Pixel, a script on the same two websites, and the OpenAI Conversions API from our servers. The recipient is OpenAI Ireland Limited for people in the EEA, the UK and Switzerland, and OpenAI, L.L.C. everywhere else. Everything in this section applies to both companies alike, with the differences named where they exist.

• What is sent: the pages you visit on our websites and the page you came from; events such as signing up, starting a trial, connecting a page, starting a checkout and paying, with the plan and the amount; your IP address and browser details; the identifiers in the _fbp and _fbc cookies (to Meta); and the click reference and browser reference in the __oppref and __obref cookies (to OpenAI).
• What our servers add, hashed: once you have an account, a SHA-256 hash (a one-way code, never the value itself) of your email address, name, phone number, account ID and visitor ID; to Meta also a hash of your country and your billing city, region and postcode, and the Facebook user ID of the account you connected; to OpenAI the country, billing city, region and postcode as they are. Each company uses these only to match an event to an ad, and deletes the hashed contact details after matching.
• Never sent: your sign-in codes and links, your payment card, and anything from the pages, comments and messages you moderate in the Service.
• Why: to measure and report on our ads, to improve who sees them, and to build advertising audiences. Meta also uses the data it receives for its own purposes, as an independent controller, under its Privacy Policy and Cookies Policy. For collecting and sending this data in the EEA, the UK and Switzerland, we and Meta Platforms Ireland Limited are joint controllers under Meta's Controller Addendum. OpenAI uses what it receives to measure and optimise our ads under its Privacy Policy and its advertising terms; it states that it does not currently use measurement data to personalise ChatGPT for you, and we mark every event so that it never may.
• Legal basis: our legitimate interest in measuring and improving our own advertising. Ad measurement runs on our websites by default; write to support@commentwatchdog.com and we will leave you out of both, and we treat a Global Privacy Control signal from your browser as that request. We do not use either company's tools at all for visitors in Russia, China, Iran, North Korea and Turkmenistan.
• Retention: Meta keeps event data for up to two years; OpenAI keeps it under its own retention terms. We keep a record of each event we sent for 400 days, and delete the IP address in it after 90 days.
• Transfers: data Meta Platforms, Inc. and OpenAI, L.L.C. receive in the United States is transferred under the EU Standard Contractual Clauses in each company's terms.

13Children#

The Service is a business tool and is not directed to children under 16. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

14Data deletion#

You never need our permission to delete your data:

• In the app: Settings, then Account, then Delete account. This permanently removes your workspace, connected pages, tokens and all comment and message history, together with your contacts, your automations and their history, the copies we kept of media sent in messages, and the files you uploaded; a file uploaded in the last seven days is deleted within eight days.
• A single page: Settings, then Pages, then Remove. To disconnect Facebook entirely: Settings, then Pages, then Disconnect Facebook.
• From Facebook: remove CommentWatchDog under Facebook Settings, Business Integrations. If you also choose "Delete data" there, Facebook sends us a deletion request; we erase everything derived from your connection immediately and issue a confirmation code with a status page you can check.
• By email: write to support@commentwatchdog.com from your account email and we will complete deletion within 30 days and confirm.

15Security#

All traffic is encrypted in transit (TLS). Access tokens and credentials are stored server-side on hardened servers with restricted access and are never exposed to your browser. There are no passwords: sign-in codes and links are single-use, expire within minutes or a day, and only their hashes are stored. Access to production systems is limited to the people who operate the Service.

16Changes and contact#

September 12, 2026: we added the Meta Pixel and Conversions API (section 12), under Meta's Business Tools Terms of November 3, 2025, and updated sections 3, 4, 7, 9, 10 and 11 to match.

September 24, 2026: we added the OpenAI Pixel and Conversions API for our ads in ChatGPT to section 12, and the two cookies they use to section 11 and the Cookie Policy.

October 10, 2026: this policy now describes DM automation: the contact list and what it holds, the messages that automations and AI agents send, the HTTP request step, and how long run history and media copies are kept. For existing customers these changes take effect 14 days after we notify you by email.

If this policy changes materially we will notify you by email or in the Service before the change takes effect. Questions and requests: support@commentwatchdog.com, or by post to GrowMeOrganic LLC, 30 N Gould St STE R, Sheridan, WY 82801, United States.