Privacy Policy and GDPR information
1. Data controller
The controller of personal data connected with DeleteComments is:
Sebastian Widawski
Tadeusza Kościuszki 28, 42-600 Tarnowskie Góry, Poland
email: wida31@gmail.com
2. How DeleteComments works
DeleteComments is used to find and delete the user's own comments and posts on Facebook. The extension works in the user's browser and uses the user's existing Facebook session.
Facebook comment and post content is not sent to the DeleteComments licensing server.
Facebook session data is used locally in the browser only to perform actions initiated by the user. DeleteComments does not store the user's Facebook password or 2FA codes and does not send Facebook session data to the licensing server.
3. Data that may be processed locally in the browser
- the identifier of the Facebook account currently in use,
- date-range, search-query, and task-state settings,
- a local cache of comment and post scan results required to perform the requested operation,
- the license key and license status,
- a random installation identifier,
- technical information required to resume, stop, or secure a task.
This information is processed locally in the user's browser profile and is not sent to the licensing system unless expressly stated below.
4. Data processed by the licensing and sales system
In connection with purchase, activation, renewal, and license support, the following data may be processed:
- the buyer's email address provided during checkout,
- the license key and technical license identifiers,
- a random installation identifier and the number of active installations,
- license status, activation date, and expiry date,
- transaction identifier, purchase type, payment status, amount, and currency,
- the date and technical record of statements confirmed before payment,
- technical data required for security, abuse prevention, and complaint handling.
DeleteComments does not receive full payment-card details.
5. Sources of data
Data may be obtained:
- directly from the user,
- from the DeleteComments extension to the extent required to provide license services,
- from Paddle in connection with purchase and transaction handling.
6. Purposes and legal bases
- Providing and supporting licenses, activation, renewal, and user support — where necessary to provide the requested service or take steps requested by the user (Article 6(1)(b) GDPR) and, where applicable, the controller's legitimate interest in product fulfilment and user support (Article 6(1)(f) GDPR).
- System security, abuse prevention, enforcement of installation limits, and fraud prevention — the controller's legitimate interests (Article 6(1)(f) GDPR).
- Documenting transactions and pre-purchase statements and establishing, exercising, or defending legal claims — the controller's legitimate interests (Article 6(1)(f) GDPR), and where a legal obligation applies, Article 6(1)(c) GDPR.
- Compliance with legal obligations — Article 6(1)(c) GDPR where applicable.
DeleteComments does not use the buyer's email address for newsletters or marketing without a separate lawful basis. If a newsletter is introduced in the future, subscription will be separate and voluntary.
7. Paddle and payments
Payments are handled by Paddle as Merchant of Record. Under the Merchant of Record model, the buyer's payment transaction is with Paddle, and Paddle may pass product providers the data required for order fulfilment, support, fraud prevention, and product operation.
Paddle Privacy Policy: paddle.com/legal/privacy-policy.
8. Recipients and infrastructure providers
Data may be disclosed to providers necessary to operate the service, including:
- Cloudflare — website hosting, Worker/API, D1 database, and network infrastructure,
- Paddle — sales and payment processing as Merchant of Record,
- public authorities or other entities where disclosure is required by law.
The controller does not sell users' personal data.
9. Transfers outside the EEA
Some infrastructure providers may process data outside the European Economic Area. Where such a transfer occurs, data should be transferred only under a mechanism permitted by Chapter V GDPR, including an adequacy decision or appropriate safeguards where required.
10. Retention
- license data is retained for as long as necessary to operate and support the license and for the period required to handle complaints and protect against abuse,
- transaction data and records of pre-purchase statements are retained for as long as necessary to document the transaction, support the user, and establish, exercise, or defend legal claims; where law requires a longer period, the legally required period applies,
- technical security data is retained only for as long as justified by security and abuse-prevention purposes,
- local comment, post, and scan-state cache remains on the user's device and can be removed by clearing extension data or uninstalling the extension.
11. Whether providing data is mandatory
Providing data required for purchase and license support is voluntary, but without it the purchase, issuance, activation, or support of a license may not be possible. Marketing data is not required to use DeleteComments.
12. Your rights
Subject to the conditions provided by the GDPR, you have the right to:
- access your personal data and obtain a copy,
- rectify inaccurate data,
- request erasure,
- request restriction of processing,
- data portability where the statutory conditions are met,
- object to processing based on legitimate interests,
- withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, contact: wida31@gmail.com.
13. Right to lodge a complaint
If you believe your personal data is processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, or use the information available at uodo.gov.pl.
14. Automated decision-making and profiling
DeleteComments does not make decisions producing legal effects concerning users solely by automated means and does not perform marketing profiling.
15. Data we do not collect in the licensing system
- Facebook passwords,
- two-factor authentication codes,
- Facebook cookies,
- Facebook comment and post content,
- private Facebook/Messenger messages,
- full payment-card details.
16. Changes to this policy
This policy may be updated when the service, the scope of data processing, or applicable legal requirements change. The current version is published on this page.
17. Privacy contact
Policy version: 2026-09-28-v4