Standard terms
These are standard terms. They apply to every workspace as part of our terms of service. If your organisation needs a signed copy, contact [email protected] to sign.
Who does what
You (the customer who owns the workspace) decide which websites use CommentKit, who is invited and what is collected. You are the controller of that personal data. buildnboost Ventures Private Limited, which operates CommentKit, processes it on your behalf as your processor.
Information about your own account, billing and our website is covered by our privacy notice instead.
What we process
- People: your team members, invited reviewers and guests who leave feedback.
- Information: names and email addresses, comments and replies, screenshots and attachments, page addresses and titles, selected text, element positions, browser and screen details, IP addresses and sign-in records. Console and network details only when you turn that capture on.
- Purpose: to provide CommentKit to you: store and show feedback, send notifications, keep the service secure and give you support.
- Duration: for as long as you use CommentKit, and then as described under requests and deletion below.
Our commitments
- We process this data only to provide the service, as you instruct through your use of CommentKit and your settings, unless the law requires otherwise.
- People who can access it are bound to keep it confidential.
- We answer reasonable questions about how we protect it in writing.
Security measures
- Encrypted connections (HTTPS) for the website, the API and the widget.
- Private file storage: screenshots and attachments are only reachable through short-lived signed links after an access check.
- Sign-in with one-time email codes, sessions bound to one website, and project roles that limit what each person can see and do.
- Agent tokens scoped to one project, read-only unless a person grants more, and refused from web pages.
- Passwords, card fields and one-time codes are left out of screenshots, as is anything you mark private.
- Nightly encrypted database backups.
The access and data page describes these controls in more detail.
Subprocessors
You allow us to use the providers on the subprocessor list. We give them only what they need, and we tell workspace owners before a new one starts handling customer personal data. If you object, contact us and we will look for a solution together; you can also stop using CommentKit.
Location and transfers
Feedback, files and backups are stored in India (AWS ap-south-1, Mumbai). Some providers on the list can process information in other countries. If you need specific transfer terms, ask for them when you request a signed copy.
Security incidents
If we become aware of a breach affecting your personal data, we will tell the workspace owner without undue delay, share what we know, and keep you updated while we deal with it.
Requests and deletion
If someone asks you to see, correct or delete their information, you can export feedback and delete comments, projects and accounts in CommentKit. Contact us when you need help with a request.
When you delete data or close your workspace, it is removed from normal use. Nightly backups are kept for 35 days and backups made before a release for 90 days, after which they are deleted.
How to sign
Email [email protected] with your organisation’s legal name and the workspace you use. We will send these terms for signature.