Who we are
CommentKit is operated by buildnboost Ventures Private Limited, registered in Mumbai, Maharashtra, India. In this notice, “we” means that company. Contact [email protected] for privacy questions or requests.
This notice covers our website, hosted workspace, and CommentKit SDK. A customer who installs CommentKit chooses the pages and content used in their reviews. Their own privacy notice also applies to their website. Contact that customer about their use of your information, or contact us if you need help identifying the relevant workspace.
Information we handle
- Account and profile information: your name, email address, avatar, team memberships, preferences, and optional profile details such as company or job title. Google sign-in can provide your name, email and avatar.
- Feedback and project information: project names and hostnames, comments, replies, assignments, reactions, selected text, drawing data, element positions, page URLs and titles, environment details, screenshots and attachments you submit.
- Access and activity information: sign-in times, IP addresses, browser details, verification records, session identifiers, and records of account, project and administrative actions. Review participants may provide a name and email address.
- Billing information: customer, transaction and subscription identifiers, plan, quantity, payment status and billing-period information. Payment details are entered in Dodo Payments’ hosted checkout.
- Communications and attribution: support messages, notification preferences, email delivery, bounce, complaint, open and click events when supplied by our email provider, and campaign or referral values in the URL used to reach us.
- Website traffic and performance: page visits and paths, referring links, country, browser, operating system, device type and page-load measurements collected through Cloudflare Web Analytics. Cloudflare also processes network requests, including IP addresses and traffic data, to deliver and protect the website.
Temporary playground
The playground starts when you choose to try it. We create a temporary identity and an isolated project without asking for your name or email address. Comments, replies, reactions, annotations, element context and uploaded files are stored on our servers. This is the real CommentKit package, including live collaboration; it does not grant access to a customer workspace.
The creator can invite one person with a one-use link. Anyone who has a valid unused link can join that playground and see its feedback and files, so keep the link private. Invited people share the original expiry. We also use a keyed hash of the requesting IP address and browser session to limit abuse. General infrastructure logs may separately process network information as described above.
Access ends two hours after creation. Expired content and uploaded files are removed by scheduled cleanup, which runs every 15 minutes when the service is operating normally. This is not a promise that every copy disappears at the instant access expires; general backup and log retention still applies. The creator can reset the playground to delete its active content sooner. Leaving as a collaborator ends that person’s access but keeps their shared feedback. Hiding the controls does not delete anything.
The website’s HttpOnly session cookie lets the same browser resume the playground until it expires. Playground bearer credentials and offline changes stay in memory, rather than being saved by the SDK in local or session storage. Old browser-only demo data is removed when this playground page opens. Anyone using the same browser profile may be able to resume the session. Use sample content, not sensitive data. Copying feedback into another tool shares that content with the tool you choose. Website delivery and performance measurements described in this notice still apply.
How we use it
We use this information to create accounts, verify access, display and synchronize feedback, manage projects, process purchases, send requested and service-related messages, investigate problems, and protect the service from abuse. Activity records help us understand and troubleshoot changes. Website measurements help us understand traffic and improve page performance.
We also use account and activity information for onboarding, usage notices, product messages and campaign attribution. You can manage optional email categories in notification settings. Essential sign-in, billing and security messages may still be sent.
The legal grounds for processing depend on the purpose and the law that applies to you. These can include performing our service agreement, complying with legal obligations, legitimate operational and security interests where that basis is available, and consent where required. Contact us for details about a particular use or to withdraw consent. Withdrawal does not affect processing already carried out lawfully or processing permitted on another basis.
Where data is processed
We operate from India and use external service providers. Information may be processed in countries other than your own. The locations depend on the provider and service used. Contact us about the providers or transfer arrangements relevant to your workspace before submitting information with specific location requirements.
Retention and deletion
We retain account and project records to provide the service and support the purposes described above. Current plans do not automatically expire comments solely because of age. Deleting an account, project or comment first removes it from normal use; it does not mean every related record or file is immediately erased.
Scheduled cleanup is configured for general activity records older than 90 days and administrative activity records older than two years. Administrative impersonation records do not have an automatic expiry. These schedules do not describe the lifetime of every email, transaction, attachment, backup or security record.
Longer retention may be needed for security, accounting, disputes or legal obligations. We assess deletion requests against the purpose of each record and applicable law. Anonymizing an account can leave its shared comments in the project; please identify any content containing personal information in your request. Provider records and backup copies may require separate handling.
Your choices and requests
You can update profile information, manage notification preferences, and use the account deletion control in settings. To request access, a copy, correction, deletion, restriction, objection, or withdrawal of consent where applicable, email [email protected]. Describe the account or project involved. We may need to verify your identity and authority before acting on a request.
Your rights and any exceptions depend on the applicable law. You can raise a privacy concern with us and, where available, with the relevant data-protection authority. Do not include passwords, sign-in codes or session tokens in your request.
Storage and safeguards
The cookies and storage notice explains browser sessions, preferences and the SDK’s offline queue. Our access and data page describes current project and screenshot controls.
The built-in screenshot capture masks password fields and marked elements, but cannot determine every piece of private information on a page. Review content before uploading it. No system can guarantee that every transmission or stored record is free from risk.
Updates and contact
We may update this notice as the service or applicable requirements change. The date on this page identifies the version. We will communicate material changes as required. Send privacy questions or grievances to [email protected], addressed to buildnboost Ventures Private Limited, Mumbai, Maharashtra, India.