Privacy Policy

This Privacy Policy ("Policy") explains how ERIS SARL ("the Publisher", "we", "us") collects, uses, stores and protects personal data when you use the websites komento.ai, app.komento.ai, as well as our Facebook/Instagram integrations, APIs and related services (collectively, "the Services"). This Policy is intended to provide clear, structured and complete information to all users ("User", "you") regarding the data we collect, the purposes of such processing, storage periods, sharing rules, and your data protection rights.

1. Definitions

For the purposes of this Policy:

• "User" means any person who uses the Services, including the website, the Web App, and the Facebook/Instagram integrations.
• "Data" means any information relating to an identified or identifiable individual, or information generated by the use of the Services.
• "Web App" refers to app.komento.ai, accessible after authentication, including the moderation and analysis features.
• "Facebook Data" means information provided to Komento through Meta APIs or Webhooks, strictly related to the professional Pages connected by the User.
• "Derived Data" means analytical outputs produced internally by Komento (e.g., classification results, algorithmic scores).

2. Data Controller

ERIS SARL
1 Allée du Professeur Ducros, 98800 Nouméa, New Caledonia
DPO Email: [email protected]
Legal Representative: Mr. Nicolas PAYEN

This Policy applies to all components of Komento, including:

• komento.ai (public website)
• app.komento.ai (Web App)
• Facebook/Instagram integrations
• Webhooks
• Komento API
• User account management
• Komento's hosting and infrastructure systems

3. Data We Collect

Komento processes five main categories of data:

• Data provided directly by the User
• Data collected automatically when using the Services
• Data generated through the use of the Web App
• Facebook Data received via Meta APIs and Webhooks
• Derived Data generated by Komento's internal analysis

4. Data Provided Directly

4.1 Contact form (komento.ai)

• First and last name
• Email address
• Phone number (optional)
• Message content

4.2 Account creation (app.komento.ai)

• First and last name
• Email address
• Password (hashed and salted)
• Company / role (optional)
• IP address at registration (security)

4.3 Communication with support

• Content of support messages
• Attachments provided
• Technical information voluntarily shared
• Email open confirmations (if enabled)

5. Data Collected Automatically

5.1 Cookies and analytics

• Strictly necessary technical cookies
• Analytics cookies (with consent), managed via Google Analytics (IP anonymised)
• Advertising cookies (with consent), via the Meta pixel, to measure our Facebook and Instagram campaigns

5.2 Technical and usage data

• IP address
• Browser, OS, User-Agent
• Referrer URL, visited pages
• Display parameters
• Session duration
• Technical errors encountered

5.3 Local storage mechanisms

The Web App may use localStorage or sessionStorage to store:

• internal session identifiers
• user interface preferences

No Facebook tokens or sensitive data are ever stored locally.

5.4 Technical logs (30 days)

• server logs
• error logs
• API logs
• Webhook event logs
• associated technical metadata (timestamps, status codes)

Logs are retained for 30 days before automatic deletion.

6. Facebook and Instagram Data

Facebook/Instagram data is received only when the User voluntarily connects a professional Page via OAuth.

6.1 Technical identifiers

• Page Access Token
• User Access Token
• Permissions granted
• Page ID, Page Name

These tokens are encrypted at rest and deleted immediately if the User removes access via Facebook.

6.2 Content retrieved via the Graph API

• Public comments
• Replies
• Posts
• Mentions
• Public attachments (images, videos, files)
• Associated metadata (IDs, timestamps, hide/unhide status)

6.3 Events received via Webhooks

Depending on the User's configuration:

• New comments
• Comment updates
• Mentions
• Reactions
• Post updates

Webhook data is processed in real-time and retained only as long as necessary to complete the synchronisation.

6.4 Data not collected

Komento never accesses:

• personal profiles
• private information about commenters
• private messages
• sensitive identifiers or private data

7. Derived Data Generated by Komento

Komento produces internal analytical data exclusively for moderation purposes:

• toxicity score
• content classification
• detected keywords
• model confidence indicators
• suggested actions or flags

These data:

• remain internal to Komento
• are never shared
• are not used for advertising
• are never used to train external AI models (OpenAI, Meta AI, Claude, Gemini, etc.)

8. Purposes of Processing

Data is processed for the following purposes:

8.1 Provision of Services (Web App)

• Displaying Page comments
• Algorithmic analysis
• Detection of spam, harassment or harmful content
• Hiding and un-hiding comments
• Generating moderation dashboards
• Synchronising with Meta APIs

8.2 Security and service improvement

• Technical diagnostics
• Abuse prevention
• Bug resolution
• Performance optimisation
• Improvement of Komento's internal analytical capabilities

8.3 Website operations

• Responding to User inquiries
• Audience measurement
• Website improvement

No data is processed for advertising, behavioural tracking or profiling.

9. Permitted and Prohibited Actions

9.1 Permitted actions (Meta-approved)

Komento may:

• read posts and comments
• receive Webhooks
• hide comments
• unhide comments
• access authorised Page insights

9.2 Strictly prohibited actions (never performed)

Komento does not:

• delete comments
• publish posts
• reply to comments (manual or automated)
• send private messages
• access personal profiles
• perform unauthorised automation
• use data for advertising
• use data to train external AI systems

10. Legal Basis

Processing is based on:

• Contractual necessity (Web App provision)
• Legitimate interest (ensuring the safety of discussion spaces)
• Explicit consent (cookies and OAuth permissions)

11. Data Retention Periods

12. Data Sharing and Transfers

Komento does not sell, rent or disclose personal data.

Sub-processors:

• OVH Cloud (hosting)
• Google Analytics (anonymised)

No international transfers occur except those required by OVH's infrastructure.

13. Data Security

We implement robust technical and organisational measures, including:

• HTTPS/TLS encryption
• encrypted storage of tokens
• restricted internal access
• environment separation (production / development)
• continuous monitoring
• audit logs
• secure backups
• compliance with Meta Developer Policies

14. User Rights

In accordance with applicable data protection law (including GDPR), Users have the right to:

• access their data
• rectify incorrect data
• request deletion
• restrict or object to processing
• request data portability
• withdraw consent

Requests should be sent to: [email protected]

15. Data Deletion Instructions (Meta Requirement)

Users may delete their data by:

• deleting their account from app.komento.ai; or
• emailing a request to [email protected].

Deletion on request: Deleting an account immediately disables the account and instantly removes all access tokens, credentials, and related Webhooks.

Full purge: All operational data related to the account (analytics data, imported comments, history, settings) is permanently erased within a maximum of 30 days.

Technical logs: Technical logs and security data are stored for a maximum of 30 days before automatic deletion.

Inactivity: In the absence of any activity, account data is anonymized after 12 months and permanently deleted after 24 months.

16. Minors

The Services are strictly intended for Users aged 18 or over. No data relating to minors is knowingly collected.

17. Communications and Marketing

Komento may send:

• operational and service-related emails
• important notifications
• newsletters (opt-in only)

Users may unsubscribe at any time.

18. Third-Party Services

The Services may include links or integrations to third-party platforms. Each third-party operates under its own Privacy Policy, which we recommend reviewing.

19. Changes to this Policy

This Policy may be updated from time to time. The version displayed online is deemed to be the applicable one.