Compliance

Comment Coach is designed with privacy and compliance in mind. This page summarizes the regulatory frameworks we follow and the measures we take to comply with them.

1. Regulatory Overview

2. GDPR Compliance

The General Data Protection Regulation applies to our processing of EU/EEA residents' data. Our compliance measures include:

• Lawful basis — Contract performance for the service itself, legitimate interest for security and abuse prevention, consent for optional extras, legal obligation for copyright notices (detail)
• International transfers — Processing occurs in the United States under Standard Contractual Clauses
• Right to complain — Users may lodge a complaint with their national supervisory authority
• Data minimization — We collect only what is necessary to provide the service
• Purpose limitation — Data is used only for the purposes described in our Privacy Policy
• Storage limitation — Defined retention periods for all data categories (see Privacy Policy §6)
• Data subject rights — Full self-service for access, portability, rectification, and erasure via Your Data Rights
• Breach notification — 72-hour notification commitment
• Data protection by design — Privacy-first architecture with no tracking cookies, no third-party analytics, essential data collection only

3. CCPA/CPRA Compliance

The California Consumer Privacy Act and California Privacy Rights Act apply to California residents. Our compliance includes:

• Right to know — Clear disclosure of data collection practices
• Right to delete — Self-service account deletion that removes all data
• No sale of data — We do not sell or share personal information with third parties for advertising or marketing
• Non-discrimination — Equal service regardless of privacy choices

4. COPPA Compliance

The Children's Online Privacy Protection Act protects children under 13. Our compliance measures:

• The Terms of Service set a minimum age of 13, and creating an account requires agreeing to them. We do not ask for a date of birth, and we do not otherwise verify age
• The Terms also require anyone under 18 to have parental or guardian consent. That is a condition of use we state; it is not something we can verify, and we do not claim to
• We do not knowingly collect data from children under 13
• Reports of underage accounts are investigated and deleted promptly — contact@comment.coach

5. ePrivacy & Cookies

The ePrivacy Directive regulates electronic communications and cookie use in the EU/EEA:

• Comment Coach uses only essential authentication cookies — no consent required under ePrivacy exemption for "strictly necessary" cookies
• No tracking cookies, advertising cookies, or analytics cookies are used
• No third-party scripts that set cookies (no Google Analytics, no Facebook Pixel, no advertising SDKs)
• An informational cookie notice is displayed to inform users about our minimal cookie use

6. Third-Party Data Processing

We share data with third-party providers only as necessary to deliver the service:

This list is the same one in the Privacy Policy §5, which describes what each provider receives in more detail.

7. Data Residency

Comment Coach application data is hosted on Fly.io infrastructure. Primary data processing occurs in the United States. AI processing via Anthropic and audio transcription via Deepgram occur in the United States.

8. Contact

For compliance questions or concerns:

Email: contact@comment.coach