Privacy Policy

What we collect

• Your account: name, email address and a hashed password; the time zone and language of your workspace.
• Your workspace: the products you add, their memory and claims, the drafts Komma writes, what you approve and publish, and your plan and steps.
• Connected services: when you connect an account (for example LinkedIn, X, Bluesky, GitHub, Google Analytics, Search Console, PostHog, Lemon Squeezy, Stripe, RevenueCat or App Store Connect), we store its access tokens encrypted and read the data Komma needs from it: sign-ups, sales with their amounts and order ids, page and search statistics. We never receive card numbers.
• Billing: Polar handles payments as merchant of record. We receive your subscription status, not your payment details.
• Waitlist: the email address you leave on the landing page.
• Tracked links: when someone clicks a link Komma created, we record the time, referrer, country and a salted hash used to count unique visitors. We don't store IP addresses or user agents.

komma.js on your website

If you add komma.js to your site, it remembers in the visitor's browser storage which post brought them (source, campaign and time) for 90 days, and adds that reference to your checkout links so a sale can be credited to the post. It sets no cookies and collects no names or emails. You are responsible for mentioning it in your own site's privacy notice.

How we use it

• To run Komma: plan your week, write drafts, publish what you approve, and show which posts brought sign-ups and sales.
• To send account emails (email confirmation, password reset) and the weekly summary.
• To keep the service secure and within its limits, for example the daily AI budget.

The legal bases are performing our contract with you, our legitimate interest in running and securing the service, and your consent where we ask for it. We don't sell personal data and we don't use it for advertising.

Who processes it for us

• Vercel (hosting) and Supabase (database), with servers in India (Mumbai).
• Anthropic, whose models write drafts from your product's memory and claims. Under its commercial terms the content isn't used to train models.
• Resend, which sends our emails.
• Polar, which handles subscriptions, invoices, taxes and refunds.
• The services you connect, under their own terms, only when you connect them.

Some of these are outside Türkiye and the European Economic Area; transfers rely on the providers' contractual safeguards.

Cookies

getkomma.com sets only the cookies that keep you signed in. There are no analytics or advertising cookies.

How long we keep it

We keep your data while your account exists. When you ask us to delete your account, we delete your workspace and disconnect your accounts within 30 days; backups roll over shortly after. Invoices are kept by Polar as tax law requires.

Your rights

Under the GDPR, Türkiye's KVKK and similar laws you can ask for a copy of your data, its correction or deletion, a portable export, or object to a use of it. Write to hello@getkomma.com; we answer within 30 days. You can also complain to your data protection authority.

Changes

If we change this policy in a way that matters, we'll email account holders before it takes effect. The date at the top shows the latest version.