1. Information We Collect
The Service processes the following information only to the extent necessary to provide the Service.
- Account information: Email address, login method, identifiers required for authentication, subscription plan status, and related account information.
- YouTube channel information: Connected channel name, channel ID, video information, connection status, and authorization information required to use the YouTube API.
- YouTube comments, reply drafts, and reply history: Synced comment text, author names and other information displayed on YouTube, AI-generated reply drafts, human-edited replies, posted reply IDs, response status, risk assessments, and operation history.
- Product information, FAQs, reply memory, and automation rules: Product URLs, product descriptions, specifications, FAQs, notes, video-product associations, reply memory, keyword rules, and auto-reply execution history registered by users.
- Payment, inquiry, and usage logs: Stripe customer IDs, billing status, inquiry details, and access logs necessary for error investigation and prevention of unauthorized use.
2. Purposes of Use
- Providing the Service: To sync comments, generate AI reply drafts, assist translation, connect product information, maintain reply memory, run auto-replies, post approved replies to YouTube, and manage response status.
- Identity verification and security: To maintain login sessions, protect accounts, detect unauthorized use, and investigate failures.
- Support and communications: To respond to inquiries, send important notices, and provide guidance based on usage status.
- Quality improvement: To improve features, analyze failures, and improve operational quality in a way that does not identify individuals.
3. Storage and Security Management
Service data is stored mainly in Cloud server. Access tokens and refresh tokens required for YouTube integration are encrypted and stored on the server side, with permissions designed so they cannot be read directly from the browser.
We use administrative, technical, and organizational safeguards to protect Google user data and other sensitive data. Data is transmitted over HTTPS/TLS. OAuth access tokens and refresh tokens required for YouTube integration are encrypted before storage and processed only on the server side. These tokens are not exposed to client-side browser code.
Access to Google user data is limited to authorized service components and personnel with a legitimate need to operate, secure, debug, or support the Service. Database access controls and row-level access restrictions are used to separate user data. We monitor and investigate unauthorized access, errors, and abuse. We do not sell Google user data or use it for advertising, credit assessment, data brokerage, or training general-purpose AI models.
Payment information such as credit card numbers is managed by Stripe. The Service does not directly store credit card information.
4. Integration with External Services
The Service uses the following external services. Data may be sent to each service only to the extent necessary to provide the relevant functionality.
- Cloud server: Used for authentication, database, and session management.
- AI processing services: Used to understand comment intent, generate reply drafts, assist translation, extract product information, and summarize reply memory. The Service may send the minimum necessary text information, such as YouTube comment text, to AI processing services for AI reply generation and translation assistance. This processing is limited to what is necessary to provide the Service and is not used for advertising delivery or sale to third parties.
- YouTube Data API: Used to connect YouTube channels, retrieve videos and comments, and post replies approved by the user.
- Stripe: Used to manage paid plan payments, invoices, payment methods, and subscription status.
- Google Analytics: Used to understand use of the Service and improve public pages and the free-trial journey. Information such as pages viewed, access times, referral source, and device or browser information may be sent to Google. We do not send email addresses, names, or YouTube comment text as custom analytics events.
- Hosting and log management providers: Used to the extent necessary for service delivery, failure investigation, and security.
5. Handling of Google API Data
The Service uses the YouTube Data API. User data obtained from Google APIs is used only to provide and improve user-facing features such as comment synchronization, reply draft generation, reply posting, and connection status management. It is not used for advertising delivery, sale to third parties, credit assessment, provision to data brokers, or training general-purpose AI models. The Service's use of user data obtained from Google APIs complies with the Google API Services User Data Policy.
Users may revoke the Service's access at any time from their Google Account security settings. If access is revoked, features that require the integration, such as YouTube comment synchronization and reply posting, will no longer be available.
6. Use of Cookies and Similar Technologies
The Service may use cookies or similar technologies to maintain login sessions, provide security, store settings necessary for screen display, and analyze usage. Information collected through Google Analytics is handled under Google's Privacy Policy. The Service does not use Google Analytics to deliver third-party advertising. Users may disable measurement with the Google Analytics Opt-out Browser Add-on.
7. Disclosure to Third Parties
The Service does not provide personal information to third parties except where required by law, with the user's consent, or where handling is entrusted to service providers within the scope necessary to provide the Service.
8. Disclosure, Correction, Deletion, and Suspension of Use
Users may request disclosure, correction, deletion, or suspension of use of their personal information. To make a request, please contact us with the information necessary to verify your identity. Except for information that must be retained for legal or operational reasons, we will respond within a reasonable scope.
9. Data Retention Period
The Service retains data for the period necessary to provide the Service, handle accounting, comply with laws, maintain security, and resolve disputes. After account deletion or integration revocation, data will be deleted or anonymized sequentially after the required retention period has passed.
10. Use by Minors
The Service is intended for businesses, creators, and operation teams that manage YouTube channels or social media accounts. Minors must obtain consent from a parent or legal representative before using the Service.
11. Changes to This Privacy Policy
This Policy may be updated in response to laws and regulations, external services, or changes to Service functionality. If there are material changes, we will notify users within the Service, by email, or by other appropriate means.
12. Contact
The Service is operated by Emu-One Inc. For inquiries about this Policy or requests for disclosure, correction, deletion, or suspension of use of personal information, please contact us at the email address below.
contact@commentory.ai
Related External Policies
