Privacy Policy

1 How We Process Facebook, Instagram, and YouTube Comments (End-User Data)

When you connect your Facebook Page (and any linked Instagram account) or your YouTube channel to ZenFeed, our system analyzes incoming comments — and, for YouTube, live chat messages — to detect and manage toxicity based on your settings.

• memory
  AI Processing, Entirely Within the EU

  Contextual and text analysis is performed by our moderation AI, built on Google Vertex AI and hosted exclusively in the EU (europe-west4, Netherlands). Comment content is sent to this model solely to produce a toxicity score and is never used by Google or anyone else to train AI models, never shared with any other Google product, and never leaves EU infrastructure.

• location_on
  Strict EU Data Location

  All our servers and data processing facilities are located strictly within the European Union (EU). Your data never crosses EU borders.

• timer
  Data Retention & Deletion

  Comment text, together with the comment author's name and ID, is stored for a maximum of 30 days. This retention exists solely to provide you with analytics (e.g., viewing logs of the most toxic comments). By default, after 30 days the comment text and the author's name and ID are permanently deleted; we keep only numerical data (toxicity score, spam flag, the moderation action taken, and timestamps), the platform's own comment ID, and an irreversible cryptographic hash of the author's ID, which lets us keep counting statistics for blocked and trusted authors but cannot be turned back into the ID itself. If you've opted in to extended retention (see 'Opt-In Research & Algorithm-Improvement Retention' below), the comments covered by that consent are kept in full.

• tune
  Custom Retention Periods

  If your organization's internal compliance requires it, you can request to shorten this retention period (e.g., immediate deletion after analysis) by contacting our support team.

• person_off
  Comment Author Data & No Profiling

  The comment author's display name and platform ID are stored alongside the comment for the same retention period described above — permanently deleted after 30 days by default, or kept if you have opted in to extended retention for research. ZenFeed does not build or maintain profiles of comment authors, and does not use any personal data of commenters for any purpose other than the moderation decision and the statistics shown in your own dashboard (comment counts and average toxicity for the authors you have blocked or marked as trusted).

• science
  Opt-In Research & Algorithm-Improvement Retention

  In your Account settings, you can optionally allow us to keep your comments for longer than 30 days — including their text and the author's name and ID — to help us improve our moderation algorithm and to support scientific research into online hate speech, potentially including published academic research. Without this consent, that data is permanently deleted after 30 days. This is entirely optional, off by default, has no effect on your service, and can be withdrawn at any time. Withdrawing consent means comments older than 30 days will be covered by the standard deletion on the next sweep; it does not restore data already deleted.

• smart_display
  YouTube (Google) Data

  For a connected YouTube channel, we access your channel ID, the comments and replies left under your videos, live chat messages during a stream, and the title/description of the video as moderation context — using this solely to detect and act on toxic comments on your behalf. The same 30-day retention and deletion policy above applies. Your Google refresh token is encrypted at rest (AES-256-GCM) and used only to obtain short-lived access tokens for these calls. ZenFeed's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke ZenFeed's access to your Google account at any time from myaccount.google.com/permissions.

2 Data We Collect About You (Client Data)

To provide our service, we collect limited information about you as the account administrator:

• check_circle Account Information: Name, email address, and billing details.
• check_circle Facebook/Instagram Metadata: Page Access Tokens (encrypted at rest), Page IDs, and your moderation preferences (Toxicity Thresholds).

3 Data Sharing and Third Parties

We do not sell, rent, or share your data with data brokers, advertisers, or unauthorized third parties. We only share administrative data with trusted subprocessors strictly necessary to run our business. Our current subprocessors include:

4 Platform Compliance & Data Deletion (Meta & YouTube)

ZenFeed operates via the official Meta Graph API. We adhere strictly to the Meta Platform Terms on data use and deletion. Disconnecting a Facebook Page or a connected Instagram account from ZenFeed monitoring — or stopping monitoring for an individual Page or account — is an immediate deletion trigger: we revoke its access token and permanently purge all stored comment data, moderation logs, and any other Platform Data associated with it from our active databases. If you revoke the ZenFeed application's access via Facebook's App Settings, or request full account deletion, the same complete purge applies to all data across all your connected Pages and Instagram accounts. All deletions are initiated without delay and are irreversible.

ZenFeed operates via the official YouTube Data API and is subject to the YouTube Terms of Service and the Google Privacy Policy. You can revoke ZenFeed's access to your YouTube channel at any time from myaccount.google.com/permissions — this immediately stops any further polling of your channel. Already-collected comment data for that channel remains subject to the standard 30-day retention policy described above, and is purged in full upon deletion of your ZenFeed account.

5 Your Rights Under GDPR

If you are an EU resident, you have the right to:

• check_circle Access the personal data we hold about you.
• check_circle Request correction of inaccurate data.
• check_circle Request erasure of your data (the "Right to be Forgotten").
• check_circle Object to or restrict our processing of your data.

To exercise any of these rights, please contact us at hello@zenfeed.eu.

6 Security Measures

We implement industry-standard security measures, including HTTPS/TLS encryption for data in transit and AES-256 encryption for sensitive data (like Access Tokens) at rest.

7 Cookies and Website Analytics

We use essential cookies to provide our services, including session management (`zf_session`) and remembering your preferences (`lang`, `region`). These cookies are strictly necessary for the website to function. We also use Matomo, a self-hosted, privacy-friendly analytics tool that does not use cookies or collect personal data.

Matomo is self-hosted on our own EU servers (Hetzner) — no analytics data is shared with a third-party provider.