Privacy Policy

CommentSurge is operated by AutoGenShorts, trading as CommentSurge, located in London, United Kingdom ("we", "us"). We are the data controller for the personal data described in this policy. This policy explains what we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.

What we collect

• Account data — email, name, password hash (bcrypt, never plain text).
• Project data — product URL, description, keywords, subreddits, competitors, and optional writing samples you provide.
• Reddit connection — if you connect Reddit via OAuth: your Reddit username, granted scopes, and encrypted OAuth tokens (AutoGenShorts never sees your Reddit password).
• Usage data — opportunities viewed, drafts generated, feature usage counters, posting/pacing records.
• Billing data — handled by Stripe; we store only customer/subscription IDs, plan, interval and order records — never card numbers.
• Affiliate data — referral codes, click events (IP, user-agent), payout email.
• API tokens — personal API keys are stored as SHA-256 hashes; the plaintext is shown once at creation and never persisted.
• AI configuration — LLM API keys stored in admin settings are encrypted with AES-256-GCM at rest.

What we don't do

• We never post to Reddit on your behalf without your explicit per-action approval.
• We never sell your data or share it with advertisers.
• We don't buy, rent, or operate networks of Reddit accounts, comments, or upvotes.

How we use data (lawful bases)

• Contract — run the product: scanning, scoring, drafting, tracking rankings and visibility, executing posts you approve.
• Contract — process payments, subscriptions, and affiliate commissions.
• Consent — product emails you opt into (alerts, digests); unsubscribe anytime.
• Legitimate interests — aggregate, anonymized analytics to improve the Service; security and abuse prevention.

Third-party processors

• Stripe — payments (PCI-DSS Level 1)
• Reddit API — public post data and user-initiated posting, per Reddit's API terms
• LLM providers (OpenAI, Anthropic, Google, OpenRouter) — only the prompt content needed to generate outputs; providers and models are chosen by the site administrator
• Vercel — hosting (if deployed there)
• Email provider (e.g. Resend) — transactional and digest emails you enable

Where processors are outside the UK/EEA, transfers rely on adequacy regulations or standard contractual clauses.

Cookies

We use a session cookie for login, a short-lived OAuth state cookie during Reddit connection, and a 60-day affiliate referral cookie when you arrive via a partner link. No third-party ad trackers.

Your rights

You can access, correct, export, or delete your data, and object to or restrict processing, by emailing privacy@commentsurge.io. You may also withdraw consent for optional processing (alerts, digests, OAuth) at any time in Settings. Deleting your account removes projects, drafts, and history within 30 days, except records we must keep for legal or financial reasons (e.g. paid invoices). You also have the right to complain to the ICO (ico.org.uk).

Data retention & security

Data is retained while your account is active and deleted within 30 days of account deletion, subject to legal holds. We use TLS in transit, encryption at rest for secrets and OAuth tokens, and scoped access controls. No system is perfectly secure — we will notify affected users and the ICO of any qualifying breach as required by law.

Changes

We'll update this page for material changes and note the date above. Continued use after changes means acceptance.

Contact

AutoGenShorts (trading as CommentSurge)
London, United Kingdom
Privacy: privacy@commentsurge.io