Subprocessors
Last updated September 27, 2026
The companies that help us run CommentGate and may handle personal information for us, what each one does, and where. CommentGate is operated by CROapps Oy, a limited company registered in Finland (Business ID 3550932-5, VAT number FI35509325), Pohjoinen Rautatiekatu 29B, 00100 Helsinki, Finland. Each subprocessor is bound by a written agreement to use the information only to provide its service to us, to protect it, and to pass these duties on to anyone it relies on. See the privacy policy for the rest.
Infrastructure and operations
| Company | What it does for us | Information it handles | Where |
|---|---|---|---|
| Cloudflare, Inc. | Runs the application and website, background queues, short-lived storage, rate limits, logs, and printing client report PDFs | Everything the service processes, while it runs; tokens only in encrypted form | Worldwide network, close to each visitor (company in the United States) |
| Neon, Inc. (a Databricks company) | Database hosting | Everything we store: accounts, settings, comments, messages, contacts, catalogs | United States (AWS US East, Northern Virginia) |
| Amazon Web Services, Inc. (Amazon SES) | Sending email: sign-in links and codes, alerts, digests, and messages sent through our contact form | Email addresses and the content of those emails, which can quote a comment or message | United States (US East, Northern Virginia) |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices and tax | Name, email, billing address, tax number and payment details (card numbers go only to Stripe) | United States and Ireland |
Classification and AI
These receive the text of a comment or message (and an attached image, for image checks) with the brand's guidance, one request at a time, to return a rating, a draft reply, a translation or a summary. They receive no account tokens and no contact lists. We do not allow any of them to use the data to train their models: every request through OpenRouter may only go to hosts that do not train on it, and every request except the fallback image check only to hosts that keep no copy of it (see AI and automated decisions).
| Company | What it does for us | Information it handles | Where |
|---|---|---|---|
| typesafe.ai (Jev model) | Rates each comment for scams, spam, hate, competitor mentions and other categories | Comment text, the brand policy and similar past corrections | Cloud hosted; transfers covered by Standard Contractual Clauses |
| OpenRouter, Inc. | Routes requests to the language models below | Comment and message text, images attached to comments, brand guidance | United States |
| Microsoft Corporation (Azure) or Amazon Web Services (Amazon Bedrock), running OpenAI's model, through OpenRouter | Drafts replies, translates, writes weekly insights and the brand policy, and checks images | The same, for each request; no copy is kept | United States or the European Union |
| Alibaba Cloud International (Qwen model, through OpenRouter) | A fallback for image checks, used only when the main model declines an image | The image and the comment text | Depends on the host; covered by our agreement with OpenRouter |
Platforms and tools that receive data on your instruction
These are not our subprocessors: they are the platforms and tools you connect, and they receive data because you asked CommentGate to act there. Each handles it under its own terms and privacy policy.
- Meta Platforms, Inc. and Meta Platforms Ireland Ltd. (Facebook, Instagram, Messenger, Threads and WhatsApp): hides, deletions, likes, replies and messages you send, WhatsApp templates you create, and, if you turn it on, Conversions API events with hashed contact details.
- TikTok Pte. Ltd. and its affiliates: hides, replies, likes and messages you send, and your blocked words list for ads.
- Google LLC (YouTube): hides, publishes, replies and removals you choose, and revoking our access when you disconnect.
- Tools you connect: Klaviyo, Slack, Discord, Zapier, Make, your own webhooks, and AI assistants you connect through our MCP server.
- Browser notification services (Apple, Google or Mozilla, depending on your browser), which deliver the notifications you allow.
Changes to this list
We update this page before we add or replace a subprocessor, and change the date at the top. If you object on reasonable data protection grounds, tell us through the contact form within 30 days. If we cannot address the objection, you may stop using the affected feature or cancel, as set out in the terms of service.