Privacy policy

Who we are

CommentRouter is made by Ravar Technologies (“we”). It brings comments from your Facebook, Instagram, Threads and LinkedIn accounts into one inbox, applies moderation rules, sends Instagram comment-to-DM replies and publishes scheduled posts. For anything in this policy, email support@commentrouter.com.

What we collect

• Your account: your email address, a display name taken from it, the workspaces you belong to, your role in each, and invitations you send or receive.
• Connected social accounts: each account’s name, platform ID and connection status. You sign in to the platform yourself; we never see your password. The access tokens are held by PostPeer, the service we use to connect to the platforms.
• Content from those accounts: your posts (caption, thumbnail, link and date) and the comments and replies on them, including each commenter’s display name, platform ID and like counts.
• What you set up: moderation rules, automations (keywords, public replies and DM text), scheduled posts and the media you upload for them, and a history of moderation actions and automation runs.
• Usage and technical data: how many billable calls a workspace makes each day, short-lived counters that limit sign-in attempts (a hash of the email and IP address, kept for 10 minutes), and server logs kept by our hosting provider.

Cookies

We use only the cookies the service needs, and no analytics or advertising cookies:

• Session: keeps you signed in for up to 30 days. It can’t be read by scripts and is removed when you sign out.
• Theme: remembers light or dark mode for a year, set only if you choose one.
• Onboarding: remembers that you chose to connect accounts later, for a year.

How we use it

• To run the service: show your inbox, carry out the replies, hides, deletes, DMs and posts you or your rules ask for, and keep your team’s access in line with their roles.
• To check comments against tone and profanity rules. The comment’s text is sent to Cloudflare Workers AI, and the result is cached for 7 days so the same text isn’t checked twice. If a workspace has no tone or profanity rule turned on, nothing is sent.
• To email you sign-in links, team invitations and notices when a scheduled post fails.
• To measure usage against your plan, prevent abuse and fix problems.

We don’t sell your data, show you ads, or use your content to train AI models.

Who else processes it

• Cloudflare hosts the app and its database, sends our email and runs the AI checks.
• PostPeer connects to the social platforms on our behalf: it reads comments and posts, carries out actions and DMs, stores media for scheduled posts and holds the access tokens.
• Meta (Facebook, Instagram, Threads) and LinkedIn receive the actions you take through CommentRouter, under their own terms and privacy policies.

These providers may process data outside your country. We only share what each one needs to do its part.

People who comment on your posts

Comments on your posts are public on the platform. We process them for the workspace that connected the account, which decides what is replied to, hidden, deleted or messaged. If you commented on a post and want your data removed from CommentRouter, email support@commentrouter.com and we’ll pass the request to that workspace and remove our copy.

How long we keep it

• Workspace data (connected accounts, posts, comments, rules, automations, logs and scheduled posts) stays until the workspace is deleted.
• Sign-in links expire after 15 minutes. Sessions last up to 30 days. Records of incoming platform notifications are kept for 30 days.
• Your user record (email and name) stays until you ask us to delete it, so you can still be invited to other workspaces.
• Database backups may hold deleted data for up to 30 days before it is gone for good.

Deleting your data

• Disconnect one account: on the Accounts page, choose Disconnect. CommentRouter stops reading and acting on it.
• Delete a workspace: an owner can go to Settings and choose Delete workspace. This removes the workspace’s accounts, posts, comments, rules, automations and history, and disconnects its accounts at PostPeer.
• Delete your user account or anything else: email support@commentrouter.com from the address you sign in with. We’ll confirm within 30 days.
• Remove access at the platform: you can also remove the connection in your Facebook, Instagram, Threads or LinkedIn settings. We then lose access straight away.

Your rights

Depending on where you live, you may have the right to see the data we hold about you, correct it, get a copy, have it deleted, or object to how we use it. Email support@commentrouter.com and we’ll respond within 30 days. You can also complain to your local data protection authority.

Security

All traffic uses HTTPS. Sign-in links and sessions are stored only as keyed hashes. Every request is checked against your workspace and role, so one workspace can’t see another’s data.

Children

CommentRouter is for businesses and creators. It isn’t meant for anyone under 16, and we don’t knowingly collect their data.

Changes to this policy

If we change this policy in a way that matters, we’ll update the date above and tell workspace owners by email before it takes effect.