Privacy Policy

commentspickerpro.com is owned and operated by AZLIN LLP, a Limited Liability Partnership registered in India with the Ministry of Corporate Affairs (MCA). AZLIN LLP is the data controller for personal data collected through this website and application. If you have questions about how we handle your data, contact us at commentspickerpro@gmail.com.

We collect information you provide directly: • Account data: name, email address, hashed password. • Platform authorisations: the OAuth access and refresh tokens issued when you connect YouTube, TikTok, Instagram, Facebook or X (AES-256 encrypted at rest). We never see or store your social media password. • Campaign data: the post links you enter, your filter rules, and the winner records you create. • Comment data: the public comments we fetch from the posts you choose. These belong to the people who wrote them rather than to you — section 3 explains that processing separately. • Billing data: your billing name, billing address or country, and any tax identifier you supply (such as a GSTIN), together with the invoices we issue you. Card and bank details are entered on our payment providers' own systems and never reach our servers; we store only the provider's customer reference. • Usage data: pages visited, features used, session timestamps, browser and operating system, and the sign-in records (IP address, approximate city and country, device) shown in your account.

When you run a giveaway on one of your posts, we read the public comments on that post. The people who wrote those comments have not signed up with us, so this section — not the rest of this policy — describes how we treat their data. AZLIN LLP acts as the data controller for it. What we hold about a commenter: • Their public display name or handle, exactly as the platform shows it. • The public text of the comment itself. • The platform's own comment identifier, the public like and reply counts, whether it is a reply, and when it was posted. What we never collect: email addresses, phone numbers, location, follower counts, profile photos, profile links, platform user IDs, private messages, or anything from a private or restricted account. We do not build profiles, we do not track anyone across sites, we do not use this data for advertising, and we never use it to train AI models. Lawful basis: legitimate interests, Art. 6(1)(f) GDPR. The interest is running the prize draw the account holder asked for, on a post they control, using comments their audience posted publicly for exactly that purpose. We have carried out and documented a legitimate interests assessment (balancing test) covering necessity and the effect on commenters; a copy is available on request. Why we do not notify each commenter: we hold no contact details for them and no way to reach them, so individual notice would be impossible or would take disproportionate effort — Art. 14(5)(b) GDPR. This section is the public notice that takes its place. How long we keep it: comments are deleted 7 days after the campaign ends, or immediately if the account holder deletes the campaign or asks us to delete that platform's data. A winner's display name and comment text are anonymised on the same 7-day clock; only the fact that a draw happened survives. Your rights if you are a commenter: you may object to this processing or ask us to erase your comment data at any time, and you do not need an account to do so. Email commentspickerpro@gmail.com with the post link and the display name you commented under. We will locate and erase the data within 30 days and confirm when it is done. You may also complain to your local data protection authority.

We process your personal data on the following legal bases: • Contract performance: processing account and campaign data is necessary to provide the service (Art. 6(1)(b) GDPR). • Legitimate interests: security monitoring, service analytics, and the processing of public comment data described in section 3 (Art. 6(1)(f) GDPR). • Legal obligation: retaining invoices and transaction records as required by Indian tax law (Art. 6(1)(c) GDPR). • Consent: optional marketing emails, and the advertising and analytics cookies described in section 10. You may withdraw either at any time.

CommentsPickerPro uses YouTube API Services to fetch and display YouTube comments on your behalf. By using YouTube-related features, you also agree to Google's Terms of Service: https://www.youtube.com/t/terms Our use of information received from YouTube APIs is governed by Google's Privacy Policy: https://policies.google.com/privacy You may revoke CommentsPickerPro's access to your YouTube/Google account at any time via Google's Security Settings page: https://myaccount.google.com/connections?filters=3,4 For Facebook and Instagram, we access public comments via the Meta Graph API only for posts you specify. We request the minimum permissions required and do not post, delete, or modify any content on your behalf. To request deletion of the data we hold, visit: https://commentspickerpro.com/data-deletion For all connected platforms (YouTube, TikTok, Instagram, Facebook, Twitter/X), comment data is: • Stored only for your active campaign and history retention period (7 days). • Never sold, shared with third parties, or used to train AI models. • Processed strictly to provide the comment-picking functionality you requested. • Deleted within 7 days of the campaign ending, or immediately when you use the "Delete data" button for that platform. Disconnecting a platform revokes our authorisation with it and deletes the stored token, so the app stops appearing in your connected-apps list — your existing campaigns and comments are kept unless you ask for them to be deleted.

• Account data: retained for the lifetime of your account. After you close it, your account stays recoverable for 90 days — just log back in — and is then permanently deleted. • Campaign & comment data: retained for 7 days after campaign end, then purged. We warn you by email the day before this happens. • Copies you export: the 7-day deletion above applies to our servers. While the data is still live you can export your comments and winners to a file — anything you download is yours to keep, stored on your own device, and outside our control. You become responsible for that copy. • Campaigns you delete: the collected comments are deleted straight away. A minimal record — platform, the link you entered, dates and totals — is kept while your account exists so we can support and audit your account, and is removed with the account. Any text we read from the platform (such as the video or post title) expires on the platform schedule above, not with your account. • Winner records: the pick itself (round, date, campaign) is retained indefinitely for your audit trail, but the winner's platform username and comment text (API Data) are anonymized 7 days after the campaign ends, in line with platform API data-retention requirements. • Platform authorization tokens (YouTube/TikTok/Instagram/Facebook/Twitter OAuth access & refresh tokens): retained only for as long as necessary to provide the feature you authorized. Tokens unused for 90 consecutive days are automatically revoked with the provider and deleted, even if you never explicitly disconnect the platform. • Payment records: retained for 7 years as required by tax law.

Under GDPR and applicable privacy laws, you have the right to: • Access: request a copy of all personal data we hold about you. You do not have to ask — your account page has a "Download my data" button that produces the whole bundle immediately. • Rectification: correct inaccurate or incomplete data. • Erasure: request deletion of your account and associated data. • Portability: receive your data in a structured, machine-readable format (the same download). • Objection: object to processing based on legitimate interests. • Restriction: request we limit how we process your data. To exercise any right, email commentspickerpro@gmail.com. We will respond within 30 days. If you are not an account holder but your comment was collected, section 3 explains your route.

We do not sell personal data. We share it only with the service providers we need to run the product, each under a data processing agreement: • Payment providers: Paddle (international cards and wallets) and Razorpay (payments in Indian rupees). They receive what a payment requires — name, email, billing country, amount. • Hosting and infrastructure: our application, database, cache and email providers. The complete, current list with each provider's purpose and region is published at https://commentspickerpro.com/subprocessors • Advertising and analytics: Google, in the limited sense described in sections 10 and 11, and only after you accept cookies. • Law enforcement: when we are legally required to, and only to the extent required. We update the sub-processor page before adding a new provider that handles personal data.

AZLIN LLP operates from India, and the services we build on run in the United States and the European Union. Personal data therefore crosses borders: it is stored and processed by our hosting, database, cache and payment providers in their regions, and accessed by us from India. For personal data protected by the GDPR or UK GDPR, we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) — incorporated into our agreements with each provider — as the transfer mechanism, together with technical measures that apply to every transfer: TLS in transit, encryption at rest, and access limited to the people who operate the service. The providers involved, and where each one holds data, are listed at https://commentspickerpro.com/subprocessors. To request details of the transfer safeguards for a specific provider, email commentspickerpro@gmail.com.

We use a small number of essential cookies that make the site work — keeping you signed in, remembering your theme and language, and protecting forms. These carry no consent requirement because the site cannot function without them. We also use two third-party services: • Google AdSense — shows advertising to visitors on the free plan, and may personalise it. Advertising cookies typically last up to 13 months. • Google Analytics 4 — tells us which pages and features are used, in aggregate. Its cookies last up to 14 months. Where you are decides how these are switched on, because the law differs: • In the European Economic Area, the United Kingdom and Switzerland we do not serve advertising at all at present, so AdSense never loads there. Analytics loads only if you press Accept — no answer counts as a refusal, and nothing is set in the meantime. • Everywhere else, they run by default and you can switch them off whenever you like — the banner, or the opt-out page below. In every region we honour a Global Privacy Control signal from your browser as a refusal, and paying customers are never shown ads. Where analytics runs before you have answered, it runs in Google's cookieless consent mode: no cookies and no identifiers, only aggregate signals. You can change your choice at any time at https://commentspickerpro.com/do-not-sell, or by clearing this site's data in your browser. Our Cookie Policy lists every cookie by name, purpose and duration.

This section applies if you are a California resident. It sits alongside the rest of this policy and uses the CCPA's own vocabulary. Categories of personal information we have collected in the last 12 months, and why: • Identifiers (name, email, account ID, IP address) — to create and secure your account. Kept for the life of the account, then 90 days. • Commercial information (purchases, plan, credits, invoices) — to take payment and meet tax obligations. Kept 7 years, as Indian tax law requires. • Internet or network activity (pages viewed, features used, device and browser, sign-in records) — to operate, secure and improve the service. Kept up to 24 months. • Approximate location inferred from IP address (country and city level only) — for fraud prevention, currency and tax determination. Kept with the sign-in record. • Public social media content (the comments described in section 3) — to run the draw you asked for. Kept 7 days after the campaign ends. We disclose these categories to the service providers listed at https://commentspickerpro.com/subprocessors for those business purposes only. We do not sell personal information for money, and we never have. However, because we serve Google AdSense advertising to free-plan visitors who accept cookies, that activity counts as "sharing" personal information for cross-context behavioural advertising under the CPRA. California law makes this opt-out rather than opt-in, so advertising runs until you say otherwise: you can stop it at any time at https://commentspickerpro.com/do-not-sell, or by sending a Global Privacy Control signal, which we honour automatically as an opt-out. We do not knowingly sell or share the personal information of anyone under 16. Your California rights: to know what we collect and disclose, to delete it, to correct it, to opt out of sharing for advertising, and to limit the use of sensitive personal information — we do not collect the categories the CPRA treats as sensitive, so that last right has nothing to act on. You may use an authorised agent by emailing commentspickerpro@gmail.com with written permission signed by you; we will verify directly with you before acting. We will never deny service, change prices, or reduce quality because you exercised a privacy right.

We implement industry-standard security measures: HTTPS everywhere, AES-256 encryption for credentials at rest, bcrypt password hashing, rate limiting, and regular dependency audits.

We may update this policy to reflect changes in law or our practices. We will notify registered users by email at least 14 days before material changes take effect. This policy is written in English. Translations are provided for convenience; where a translation and the English text differ, the English text governs.

You can request complete deletion of your account and all associated data at any time: • In-app: Account → Profile → Delete Account. • By email: send a request to commentspickerpro@gmail.com with the subject line "Data Deletion Request" and include the email address linked to your account. Connected platform data (YouTube, TikTok, Instagram, Facebook and Twitter/X authorisation tokens, fetched comments, and winner records sourced from those platforms) is deleted immediately and always within 7 calendar days, in line with each platform's API developer policies. Your remaining account and billing records are permanently purged within 90 days; we send a confirmation email once that completes. You do not have to delete your whole account to remove one platform. Account → Connections gives you two separate buttons for each connected platform, for all five platforms and not just Meta: "Disconnect" revokes our authorisation with that platform and deletes the stored token while leaving your campaigns and comments intact, and "Delete data" does the same and also erases the comments and winner names we fetched from it. Our dedicated deletion page, covering every platform and the route for people who are not account holders, is at https://commentspickerpro.com/data-deletion