Privacy policy

01Who we are and what this covers

Comma is a service business. Our team helps B2B brands get named and cited in AI answers, and our clients follow and approve the work in a workspace on the Comma platform. Comma is run by Get Comma, a business based in Uttar Pradesh, India ("Comma", "we", "us").

This policy explains how we handle personal information when you:

• visit getcomma.ai or read our blog;
• contact us, book a call or talk to our team;
• use a Comma workspace as a client or a member of a client's team; or
• appear in public AI answers or public community content that we analyse for clients.

02Our two roles

Where we decide (controller). For our website, sales conversations, client account administration, billing, security and our own records, we decide how and why personal information is used. Under Indian law we're the data fiduciary, and under UK and EU law the controller.

Where the client decides (processor). For personal information inside a client's workspace, such as their team's comments and approvals, their Search Console data or content they share with us, we act on the client's instructions. The client is the controller and we're its processor. Our data processing agreement governs that work. If you're on a client's team and have a question about your data in their workspace, it's best to ask them first. We'll help them answer.

03What we collect and where it comes from

Information you give us

• Contact and enquiry details: name, work email, company, role, website and anything you choose to tell us when you write to us or book a call.
• Account details: name, work email, role, profile photo, password (stored only as a one-way hash), two-factor settings and notification preferences.
• Work content: comments, approvals, briefs, messages to our team, questions to the workspace assistant, and files you upload.
• Billing details: billing contact, company name, address and tax details.

Information collected automatically

• Sign-in records: time, IP address and browser or device for each sign-in, used for security and shown to your workspace's Owners.
• Usage and logs: actions taken in the platform, credit usage, errors and performance data.
• Device and connection data: IP address, browser, operating system and approximate location derived from IP.
• Cookies: only the ones described in our cookie policy.

Information from tools a client connects

• When a client connects Google Search Console, an SEO tool such as Ahrefs with their own key, a CMS such as Webflow or Sanity, Notion or Slack, we receive the data that connection allows. Most of it is about websites and search performance rather than people, but it can include names, for example authors in a CMS or Notion.

Information from other sources

• Public AI answers: the answers AI engines give to questions relevant to a client, and the sources they cite, collected through a third-party AI answer monitoring provider.
• Public community content: public threads and comments from communities such as Reddit and online forums, collected through a public community data source and our own analysis. These can include usernames and anything people chose to post publicly.
• Public web content: web pages found through our web search provider or fetched directly, for example a client's own website.
• Business contact details that people share with us or publish professionally, such as on a company website.

04Public AI answers and community content

Measuring how AI engines and communities talk about a brand is central to our work. We monitor public community threads, keyword and brand mentions and sentiment, and the answers AI engines give, so we can report on a client's visibility and act on what we find as part of the services.

• We look at content to understand brands, topics and sentiment, not to build profiles of individuals.
• We only collect content that was public when we collected it, and we don't try to identify people behind usernames.
• Community content is kept only as long as it's useful for the analysis, within the retention periods in section 10.
• If you'd like content about you removed from our systems, write to privacy@getcomma.ai with a link and we'll act on it.

05How we use information

• To deliver the services: run engagements, produce content and reports, operate the workspace and its integrations.
• To communicate: reply to enquiries, arrange calls, send service emails such as sign-in codes, invitations, alerts and reports.
• To keep things secure: authenticate people, prevent abuse and fraud, investigate errors and protect our systems.
• To manage our business: invoicing, accounting, record keeping and planning.
• To improve Comma: understand how the services and platform are used, using aggregated or de-identified data where we can.
• Marketing: occasional emails about our work to business contacts, only where the law allows, with an easy way to opt out.
• Legal reasons: meet legal obligations, respond to lawful requests and enforce our agreements.

We don't sell personal information, we don't share it for cross-context behavioural advertising, and we don't make decisions about people based solely on automated processing that have legal or similarly significant effects.

06Legal bases (UK and EU)

If UK or EU data protection law applies to how we use your information as a controller, we rely on these legal bases:

Where we rely on legitimate interests, you can ask us for more detail about how we balanced them.

07Notice for people in India

This section gives the information required by India's Digital Personal Data Protection Act, 2023 and its Rules, which come into force in phases through May 2027. We'll apply them as each part takes effect.

• What we process and why: the personal data listed in section 03, for the purposes in section 05. Where we rely on your consent, we'll ask for it clearly and for a specific purpose, and you can withdraw it at any time as easily as you gave it, by emailing privacy@getcomma.ai. Withdrawing doesn't affect processing that already took place.
• Your rights: you can ask for a summary of the personal data we process and the processing activities, the identities of those we've shared it with, and correction, completion, updating or erasure of your data. You can also nominate another person to exercise your rights if you die or become unable to.
• Grievances: write to our Grievance Officer at privacy@getcomma.ai about any concern with how we handle your data. We'll acknowledge your grievance promptly and respond within 90 days, or sooner where the Rules require.
• Data Protection Board: if you're not satisfied with our response, you can complain to the Data Protection Board of India.
• Consent managers: we don't currently work through a registered consent manager. If that changes, we'll update this section.
• Language: you can ask for this notice in English or any language listed in the Eighth Schedule to the Constitution of India.

08Who we share information with

We share personal information only as needed to run Comma, under written contracts that limit how it can be used.

A current list naming each provider is available on request at privacy@getcomma.ai, and clients receive it with their DPA. We may also share information:

• with tools a client connects, when the client asks us to, for example publishing an approved page to their CMS or sending an alert to their Slack;
• with professional advisers, such as lawyers, accountants and auditors, under confidentiality;
• with authorities, when the law requires it, or to protect rights, property or safety. We'll push back on requests that aren't lawful;
• with a buyer or successor if Comma is involved in a merger, acquisition or sale of assets, under protections at least as strong as these.

09International transfers

Comma is based in India, our main hosting is in the United States, and our clients are mostly in the US and UK. So personal information may be stored in the United States and accessed by our team in India.

• From the UK and EU: where personal information leaves the UK or the European Economic Area for a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement, as appropriate. These apply both to our providers and, for client workspace data, between the client and us under our DPA.
• From India: we transfer personal data outside India only to countries the Government of India hasn't restricted, and with the safeguards described here.

You can ask for a copy of the relevant safeguards at privacy@getcomma.ai.

10How long we keep it

We keep personal information only as long as we need it for the purposes above. Within a client workspace:

Your account:

• Sign-in details (email, password hash, two-factor settings): kept while you belong to at least one workspace, and deleted when you're removed from your last one.
• Sign-in links and codes: stored only in hashed form and deleted a day after they expire.

For our own records:

• Sales enquiries and prospect contacts: up to 24 months after our last contact, unless you become a client.
• Client account and contract records: for the engagement and up to 8 years after, as Indian tax law requires.
• Error reports: kept by our error monitoring provider for 30 days.
• Text sent to our AI model provider: deleted by the provider within 30 days, or kept for up to 2 years if its automated safety systems flag it for review, or longer where the law requires.

11Security

We protect information with controls such as HTTPS everywhere, a separate database for each client workspace, encryption of stored integration keys and secrets, two-factor sign-in, role-based access and rate limits. Our security page describes them in detail. No system is perfectly secure. If a breach affects your personal information, we'll tell you and the relevant authorities as the law requires.

12Cookies

We use only the cookies needed for our website and platform to work. There are no advertising cookies. Our cookie policy lists them.

13Your rights

Your rights depend on where you live. To use any of them, write to privacy@getcomma.ai. We'll check your identity in a proportionate way and reply within one month, or sooner where the law requires. If your request is about data in a client's workspace, we'll pass it to that client and help them respond.

UK and EU

You can ask for access to your personal information and a copy of it, correction, erasure, restriction, portability, and to object to processing based on legitimate interests, including all direct marketing. Where we rely on consent, you can withdraw it at any time. You can also complain to your data protection authority, such as the Information Commissioner's Office in the UK.

India

Your rights are described in section 07, including the right to raise a grievance at privacy@getcomma.ai.

US states

Residents of California and other US states with privacy laws may have the right to know what personal information we collect, use and disclose, to access, correct and delete it, and to opt out of its sale, sharing for targeted advertising, or profiling. We don't sell personal information or share it for targeted advertising, and we don't use sensitive personal information to infer characteristics about you. You can use an authorised agent, and you can appeal if we decline a request by replying to our decision. We won't treat you differently for using your rights. The categories we collect and their sources are described in section 03, the purposes in section 05 and the recipients in section 08.

14Marketing choices

We send marketing emails only to business contacts and only where the law allows. Every marketing email has an unsubscribe link, or you can write to privacy@getcomma.ai. Service emails, such as sign-in codes and account notices, will continue while you have an account.

15Children

Comma is a business service for adults. It isn't meant for anyone under 18, and we don't knowingly collect their personal information. If you believe we have, write to privacy@getcomma.ai and we'll delete it.

16Changes to this policy

We'll update this policy when our practices or the law change, and change the date at the top. If a change is significant, we'll tell clients by email before it takes effect and, where the law requires, ask for consent again.

17Contact

• Privacy questions, requests and grievances (Grievance Officer): privacy@getcomma.ai
• Security issues: security@getcomma.ai

Our postal address is available on request at privacy@getcomma.ai.