EasyComment

GDPR overview

There is no GDPR implementation to describe, because the site never mentions the regulation. This is silence rather than a stated refusal: nothing on any page says the service is outside the GDPR, and nothing says it complies. What the privacy policy does commit to is Directive 95/46/EC — the text the GDPR repealed on 25 May 2018 — so the legal reference it offers is no longer in force. Rights are granted, but only to residents of the European Union and Australia, and only three: access, which may carry a fee, correction, and objection to marketing. There is no erasure, portability or restriction right, no legal basis, no response deadline beyond a "reasonable period", no DPO and no Article 27 representative. The policy can be changed without notice, and carries no effective date.

Who owns the data?

The terms never say who owns the content you generate, and no licence is granted to you over it. What the documents do settle is narrower. Anything you post in a public area of the site is your responsibility alone, and the privacy policy states outright that it may be collected, used and disclosed by the publisher or by third parties without restriction. The site's own material stays the publisher's: you get a temporary, non-commercial viewing licence, with no transfer of title. The browser extension is treated separately and claims to hold no personally identifiable information at all. Account deletion and data portability are not addressed anywhere.

Reuse rights

For the site's own material the answer is no: the terms grant only a temporary, non-commercial viewing licence, and explicitly forbid copying, modifying, publicly displaying, reverse-engineering or mirroring it. For the data you extract with the tools — follower lists, comment exports — the documents say nothing at all, neither granting nor restricting reuse, which leaves the question governed by the source platform's own terms and by data protection law rather than by EasyComment. As for the data the publisher collects about you, it is used to run and optimise the service, respond to enquiries, personalise content and advertising on the site and elsewhere, and send marketing messages. It is shared with hosting, billing, analytics and support providers, with Google Analytics and retargeting partners, on legal request, and in the event of a sale, merger or liquidation. Opt-outs are offered for advertising only, through industry pages and a procedure routed via the Ghostery extension.

Data retention & training

Hosting summary

The privacy policy states that collected data is stored on servers in the United States or in other territories, which it does not name. It warns that countries outside your own may not offer the same level of protection, while maintaining that its handling stays governed by the policy itself. Transfers to third-party processors and to group companies in other countries are announced, but no transfer mechanism is identified — no standard contractual clauses, no adequacy decision. Security is described only in general terms: internal reviews of collection, storage and processing practices, firewalls, and physically secure data facilities, with an explicit caveat that no system is perfect. There is no choice of hosting region, no certification such as SOC 2 or ISO 27001, and no named subprocessor. The domain resolves behind Cloudflare on an anycast address, which identifies the CDN edge rather than where the data actually resides.