Privacy Policy

Effective 1 September 2026 · Last updated 31 August 2026 · Version 1.0

Cura Spectra B.V.

Crooswijkseweg 97 B03, 3034 HG Rotterdam, the Netherlands
Chamber of Commerce (KvK) 94496005 · VAT NL866798274B01
support@wocomment.com

Effective date: 1 September 2026

Last updated: 31 August 2026

Version: 1.0

This Privacy Policy explains how Cura Spectra B.V. ("WoComment", "we", "us", "our") processes personal data in connection with the WoComment service available at wocomment.com and app.wocomment.com (the "Service").

WoComment is a comment moderation platform for social media. It ingests comments from connected Facebook Pages, Instagram Business accounts and TikTok ad accounts in real time via platform webhooks, classifies them using a rule engine and AI (sentiment, spam, purchase intent, complaint), can automatically hide, delete or reply to comments according to rules configured by the customer, and can draft AI reply suggestions. AI-drafted replies always require human approval before they are published.

1. Who we are

Legal entity	Cura Spectra B.V.
Registered address	Crooswijkseweg 97 B03, 3034 HG Rotterdam, The Netherlands
Chamber of Commerce (KvK) number	94496005
VAT / BTW number	NL866798274B01
General and privacy contact	support@wocomment.com
Data protection contact / DPO	privacy@wocomment.com

We are established in the Netherlands and our processing is governed by the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).

> Note: we have not appointed a Data Protection Officer / we have appointed the contact named above — confirm which statement applies before publishing and delete the other. we have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; privacy questions go to the contact above

2. Our two roles: controller and processor

WoComment processes personal data in two distinct roles. It matters which one applies, because it determines who decides what happens to the data and who you should contact.

Data	Our role	Who decides
Account data of our customers (the businesses and users who sign up)	Controller	WoComment
Billing and subscription data	Controller (jointly with Stripe as an independent controller for payment processing)	WoComment / Stripe
Website visitor and marketing data on wocomment.com	Controller	WoComment
Content data — comments, commenter public names/handles and platform IDs ingested from connected pages and ad accounts	Processor	The customer (the page or ad account owner)
Moderation actions, classifications and AI reply drafts derived from content data	Processor	The customer
Product security, abuse prevention, aggregate statistics and service improvement	Controller, on aggregated or pseudonymised data only	WoComment

In plain terms: if you left a comment on a business's Facebook, Instagram or TikTok content and that business uses WoComment, that business is the data controller and decides how your comment is handled. We act on its instructions. See section 10 for how to exercise your rights.

3. What data we collect

(a) Account data of our customers

Collected directly from the customer when they register and use the Service.

Name, business name, email address, password (stored as a salted hash), preferred language and time zone.
Workspace and team member data: role, permissions, invitation status.
Connected asset metadata: page/account name, page ID, Instagram business account ID, TikTok advertiser and ad IDs, page profile picture, follower counts and similar public page metadata.
Support correspondence, onboarding notes and feature configuration (rule sets, blocklists, auto-reply templates).
If the customer chooses to sign in with Google or Facebook: the provider's account identifier, the email address and display name the provider returns, and the profile picture URL. We never receive the password held by the provider.

Purpose: to create and operate the account, authenticate users, provide support, send service notices.

Signing in with Google or Facebook is optional — an email address and password works equally well, and no feature depends on it. Where it is used, Google or Meta act as independent controllers for the sign-in step under their own privacy policies; we receive only the identifier, email address, display name and picture listed above, and use them solely to create and authenticate the account. We do not post anything to the customer's Google or Facebook account and do not read their contacts, friends, posts or ad data through the sign-in connection. A customer can have the connection removed at any time by writing to privacy@wocomment.com; the account then continues to work with an email address and password.

(b) Content data — comments and commenter identifiers

Received automatically from Meta and TikTok via platform webhooks and APIs, for the assets the customer has connected.

Comment text and any emoji, mentions or links it contains.
Commenter's public display name and handle/username, and the platform-scoped user ID (e.g. Instagram-scoped ID, Facebook Page-scoped ID, TikTok commenter ID).
Comment metadata: timestamp, parent post or ad ID, thread/parent comment ID, like count where provided, language.
Data we generate about the comment: classification labels (sentiment, spam, purchase intent, complaint), rule matches, confidence scores, the moderation action taken (hidden, deleted, replied, ignored) and by whom, and AI reply drafts.

Comment text is free-form and may contain personal data about the commenter or about third parties, including contact details, order numbers, opinions, and — unpredictably — special categories of data (e.g. health or political opinions) that a commenter chooses to disclose. We do not ask for such data, do not target it, and instruct customers not to use the Service to deliberately collect it. Customers are responsible for the lawfulness of the processing of content data.

Purpose: to perform the moderation service the customer has instructed us to perform.

(c) OAuth access tokens and credentials

OAuth access tokens, refresh tokens, token expiry and granted scopes for the connected Meta and TikTok assets.
Webhook verification secrets.

These are encrypted at rest and are purpose-limited: they are used only to read comments and to perform the moderation actions the customer has configured on the connected assets. They are never used for advertising, never sold, never shared with other customers, and never used to access data beyond the granted scopes. Tokens are revoked and deleted when the customer disconnects an asset or closes the account.

(d) Usage and technical logs

IP address, browser user agent, device and OS type, referring page.
Application logs: sign-in events, API calls, webhook deliveries and retries, background job runs, errors and stack traces, rate-limit events.
Audit log entries: which user took which moderation action on which comment and when.
Product usage counters: number of comments processed, plan quota consumption.

Purpose: operating and securing the Service, debugging, abuse and fraud prevention, quota metering and billing accuracy.

(e) Billing data

Handled by Stripe. We initiate the checkout and subscription; Stripe collects and processes the payment instrument.

We receive and store: subscription plan and status, billing email, billing name and country, VAT number where provided, invoice history, the last four digits and brand of the card, and Stripe customer/subscription identifiers.
We never see or store full card numbers, CVC codes or full bank account details. These go directly to Stripe.

The 7-day free trial is limited to 500 processed comments and requires no credit card, so no payment data is collected during the trial.

(f) Website and marketing data

Cookie and similar identifiers on wocomment.com and app.wocomment.com — see section 12.
Newsletter or product-update subscriptions, where the recipient has opted in.

Processing	Legal basis
Creating and operating a customer account; providing the Service; support	Contract (Art. 6(1)(b))
Billing, invoicing, dunning	Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for tax and accounting records
Processing content data (comments and commenter identifiers)	We process this as a processor on the customer's documented instructions (Art. 28). The customer must have its own legal basis — typically legitimate interest in moderating its own channels (Art. 6(1)(f))
Security, fraud prevention, abuse detection, service integrity and capacity planning	Legitimate interest (Art. 6(1)(f)) in keeping the Service secure and available
Aggregated and anonymised product analytics and service improvement	Legitimate interest (Art. 6(1)(f)); once anonymised, the data is no longer personal data
Non-essential cookies, analytics cookies and marketing email to non-customers	Consent (Art. 6(1)(a)) — withdrawable at any time
Retaining records to establish, exercise or defend legal claims	Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))

Where we rely on legitimate interest, we have carried out a balancing assessment; you may request a summary of it via privacy@wocomment.com.

We do not process content data for our own purposes, and we do not sell personal data.

5. Automated processing and AI

5.1 What the AI does

Comment text — and, where needed for context, the commenter's public display name and the parent post text — is sent to a large language model provider for:

Classification: sentiment, spam/scam detection, purchase intent, complaint detection, language detection.
Reply drafting: generating a suggested reply for the customer's team.

5.2 Human involvement

AI reply drafts are never published automatically. A human user of the customer's workspace must review and approve every AI-drafted reply before it is sent.
Rule-based and classification-driven actions (hide, delete, template reply) can be automated where the customer configures them. This is automated processing of the commenter's comment. It affects the visibility of a comment on the customer's own page; it does not produce legal effects concerning the commenter or similarly significantly affect them within the meaning of Art. 22 GDPR. The customer configures and is responsible for these rules, can disable automation entirely, and every automated action is recorded in the audit log and can be reversed by the customer.

5.3 AI provider and training

Our AI inference is routed through OpenRouter, which forwards requests to the selected model provider.

> We select model providers whose default policy is not to train on API inputs; because routing may change, we state this as our selection criterion rather than an absolute guarantee — Intended statement, to be verified against the current OpenRouter and downstream model-provider terms before this policy is published: "Comment text sent for classification and reply drafting is not used to train third-party models, where the provider offers that guarantee. We configure our routing to providers that offer a zero-retention or no-training guarantee." Do not publish this sentence until the contractual guarantee, its scope, the specific providers it covers, and the applicable retention window have been confirmed in writing and this marker is removed.

We do not use customer content data to train our own models. Any model tuning we perform uses synthetic or fully anonymised data only.

6. Sub-processors

We engage the following sub-processors. Each is bound by a written data processing agreement containing Art. 28 GDPR obligations.

Sub-processor	Purpose	Data categories	Location / transfer basis
BitCommand LLC	Application hosting, database, object storage, backups	All categories (a)–(f)	Frankfurt, Germany (European Union) — region not yet confirmed; verify before publishing. If outside the EEA: SCCs + supplementary measures
OpenRouter	AI inference — comment classification and reply drafts	Comment text, commenter public display name, parent post context	United States, routing to model providers in various regions — outside the EEA; EU Standard Contractual Clauses
Stripe (Stripe Payments Europe, Ltd. and affiliates)	Payment processing, subscription management, invoicing, tax	Billing name and email, billing country, VAT number, payment instrument (held by Stripe), subscription records	EU/US; Stripe acts as an independent controller for payment processing and as processor for the rest; SCCs and Stripe's DPA
Our own mail server, operated by us on BitCommand LLC infrastructure	Transactional email: sign-up confirmation, password reset, alerts, quota and billing notices	Customer name and email address, message content	Frankfurt, Germany (European Union) — same basis as hosting

An up-to-date list of sub-processors is maintained at wocomment.com/subprocessors. Customers can subscribe to change notifications there; see the objection mechanism in section 17.6.

Also relevant: Meta (Facebook, Instagram) and TikTok are the sources of content data, not our sub-processors. They process personal data as independent controllers under their own terms and privacy policies. When WoComment hides, deletes or replies to a comment, that action is executed on their platforms under their terms.

7. International transfers

Our primary infrastructure is intended to be located in the European Union (Frankfurt, Germany (European Union) — to be confirmed). Some sub-processors, in particular the AI inference provider and payment provider, process data outside the European Economic Area.

Where personal data is transferred outside the EEA, we rely on:

Adequacy decisions of the European Commission, where one applies to the recipient country or certification framework; otherwise
Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two controller-to-processor or Module Three processor-to-processor as applicable), supplemented by a transfer impact assessment and technical measures including encryption in transit and at rest, minimisation of the payload sent to AI providers, and contractual limits on government access disclosure.

A copy of the relevant transfer mechanism can be requested from privacy@wocomment.com, with commercially confidential terms redacted.

8. Retention

Data	Retention
Raw comment text and commenter public identifiers	90 days from ingestion, then permanently deleted or irreversibly anonymised
Classifications, moderation outcomes and statistics after that period	Retained in anonymised, aggregated form only (counts by label, by day, by connected asset) — no comment text, no commenter name, handle or platform ID
Audit log entries (who did what, when)	Retained for the life of the account plus 12 months, with commenter identifiers removed once the raw comment is deleted
Customer account data	Life of the account, then deleted within 30 days of account closure, subject to the statutory periods below
OAuth tokens	Deleted immediately on asset disconnection, account closure, or token revocation
Invoices, billing and tax records	7 years, as required by the Dutch fiscal retention obligation (Art. 52 Algemene wet inzake rijksbelastingen)
Technical and security logs	30 days
Backups	Rolling backups retained 30 days; deleted data disappears from backups as the rotation cycle completes
Support correspondence	24 months after the ticket closes

Customers can configure a shorter retention period for content data, and can delete individual comments or an entire connected asset's data at any time from the dashboard. Customers cannot extend retention beyond 90 days without a separate written agreement.

We disclose personal data only to:

The sub-processors listed in section 6.
The customer whose connected assets the content data came from, and the users they have authorised in their workspace.
Professional advisers (accountants, lawyers, auditors) under a duty of confidentiality.
Public authorities, where legally required. We will notify the affected customer of any binding request relating to their data unless legally prohibited, and we will challenge requests that appear unlawful or overbroad.
An acquirer, in the event of a merger, acquisition or asset sale — subject to this Policy and with prior notice to customers.

We do not sell personal data and do not share it for third-party advertising.

10. Your rights

Under Articles 15–22 GDPR you have the right to:

Access — obtain confirmation of whether we process your data and a copy of it.
Rectification — have inaccurate data corrected.
Erasure — have your data deleted ("right to be forgotten").
Restriction — have processing limited while a dispute is resolved.
Portability — receive data you provided in a structured, commonly used, machine-readable format.
Object — object to processing based on legitimate interest, at any time and on grounds relating to your particular situation.
Withdraw consent — where processing rests on consent, at any time, without affecting the lawfulness of processing before withdrawal.
Not be subject to a decision based solely on automated processing producing legal or similarly significant effects (see section 5.2).

10.1 If you are a WoComment customer or a user of a customer's workspace

Contact us at support@wocomment.com or privacy@wocomment.com. We respond within one month, extendable by two further months for complex requests, and will tell you if we need the extension. We may ask for information to verify your identity; we will not use that information for any other purpose.

10.2 If you are a commenter (a third party whose comment we process)

Please contact the page, profile or advertiser whose content you commented on. That business is the data controller for your comment: it decides whether the comment is kept, hidden or deleted, and it holds the relationship with you. We process your comment only on that business's instructions and generally cannot identify which of our customers holds your data without information from you.

If you do contact us directly, we will:

Acknowledge your request without undue delay.
Forward it to the relevant customer where you give us enough information to identify them (typically the page or account name and the approximate date of the comment), and tell you that we have done so.
Assist that customer in responding, as required by Art. 28(3)(e) GDPR.
Not make substantive decisions about your comment ourselves, since we are not the controller.

Note also that your comment continues to exist on Facebook, Instagram or TikTok independently of WoComment. Deleting data from WoComment does not remove it from those platforms, and vice versa. Meta and TikTok operate their own rights processes for the data they hold.

11. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

Encryption in transit: TLS 1.2+ on all public endpoints, HSTS, secure webhook endpoints with signature verification.
Encryption at rest: OAuth access and refresh tokens are encrypted at rest with authenticated encryption; keys are held separately from the database and rotated on a defined schedule. Database volumes and backups are encrypted at rest.
Access control: role-based access within customer workspaces; least-privilege internal access; individual named accounts for staff; multi-factor authentication for administrative access; no shared credentials; production access limited to staff who need it and reviewed periodically.
Tenant isolation: every content data record is scoped to a customer workspace and access is enforced at the query layer.
Audit logging: moderation actions, authentication events, permission changes and administrative access are logged with actor, timestamp and target.
Secure development: code review, dependency scanning, secrets kept out of source control, separate staging and production environments with no production personal data in staging.
Resilience: encrypted automated backups, documented restore procedure, restore tests.
Vendor management: DPAs and security review for every sub-processor.
Staff: confidentiality undertakings and privacy/security training.
Incident response: documented procedure, breach register, defined notification path (see section 17.9).

No system is perfectly secure. If you believe you have found a vulnerability, please report it to security@wocomment.com; we will not pursue legal action against good-faith researchers who follow our responsible disclosure guidance.

12. Cookies

wocomment.com and app.wocomment.com use strictly necessary cookies for authentication, session management and security (CSRF protection, load balancing). These do not require consent under Art. 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet).

Any analytics, preference or marketing cookies are set only after you give consent through our cookie banner, and consent can be withdrawn at any time from the cookie settings link in the site footer.

Full details of each cookie, its purpose, provider and lifetime are set out in our Cookie Policy at wocomment.com/cookies.

13. Children

The Service is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16. Comments ingested from connected pages may have been written by minors; we do not knowingly single out or profile such data, and customers must handle it in accordance with the applicable platform terms and law.

14. Complaints

If you have a concern about how we handle personal data, please contact us first at privacy@wocomment.com — we would like the chance to resolve it.

You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens

Postbus 93374, 2509 AJ Den Haag, The Netherlands

Telephone: +31 (0)88 - 1805 250

Website: autoriteitpersoonsgegevens.nl

You may alternatively complain to the supervisory authority of the EU/EEA Member State where you live or work, or where you believe an infringement occurred.

15. Changes to this Policy

We may update this Policy to reflect changes in the Service, our sub-processors, or the law.

Material changes: we will notify account holders by email and in-app at least 30 days before they take effect.
Non-material changes (clarifications, typographical corrections, contact detail updates): published on this page with an updated "Last updated" date.

The current version, its effective date and an archive of prior versions are available at wocomment.com/privacy.

Data Processing Addendum (DPA) — Summary

This section is a plain-language summary of the Data Processing Addendum that forms part of the agreement between Cura Spectra B.V. ("Processor") and the customer ("Controller") when the customer uses WoComment. The full DPA at wocomment.com/dpa is the binding document; where this summary and the DPA differ, the DPA prevails.

1. Parties and roles

Controller: the WoComment customer — the business that owns or is authorised to manage the connected Facebook Page, Instagram Business account or TikTok ad account.
Processor: Cura Spectra B.V., KvK 94496005, Crooswijkseweg 97 B03, 3034 HG Rotterdam, The Netherlands.
Where the customer is itself a processor for its own client (e.g. an agency managing a brand's pages), WoComment acts as a sub-processor and the DPA applies mutatis mutandis.

2. Subject matter

Processing of personal data contained in social media comments and related metadata, carried out by WoComment on the Controller's behalf, for the purpose of providing the comment moderation Service described in the main agreement.

3. Duration

For the term of the customer's subscription, plus the retention and deletion periods set out in section 8 of the Privacy Policy. The DPA survives termination for as long as WoComment holds any Controller personal data.

4. Nature and purpose of processing

Real-time ingestion of comments via Meta and TikTok webhooks and APIs.
Storage, indexing and display of comments in the Controller's workspace.
Classification by rule engine and by AI (sentiment, spam, purchase intent, complaint, language).
Generation of AI reply drafts, subject to mandatory human approval before publication.
Execution of Controller-configured moderation actions on the source platform: hide, unhide, delete, reply.
Transmission of comment text and limited context to the AI inference sub-processor.
Generation of reports and statistics; anonymisation of content data at end of retention.
Backup, security monitoring, deletion and, where requested, export.

5. Types of personal data

Content: comment text, which is free-form and may contain any personal data the commenter chooses to include; emoji, mentions, links.
Commenter identifiers: public display name, public handle/username, platform-scoped user ID, profile picture URL where provided by the platform.
Comment metadata: timestamps, parent post/ad ID, thread ID, engagement counts, detected language.
Derived data: classification labels, confidence scores, rule matches, moderation actions and the identity of the workspace user who took them, AI reply drafts.
Controller's own users: name, email, role, workspace activity (processed by WoComment as controller under the Privacy Policy, and as processor where the Controller instructs).

Special categories: not requested and not intentionally processed. Comment text is unstructured and may incidentally contain data of the categories listed in Art. 9 GDPR. The Controller is responsible for assessing this risk in its own channels and for configuring the Service accordingly.

6. Categories of data subjects

Individuals who comment on the Controller's connected pages, posts and ads.
Individuals mentioned or described within those comments.
The Controller's own employees, contractors and agency staff who use the workspace.

7. Controller obligations

The Controller:

Determines the purposes and means of the processing of content data, and issues instructions through the Service's configuration and through written instructions to WoComment.
Warrants that it has a valid legal basis for the processing, and has complied with transparency obligations toward commenters — typically by including the moderation activity in its own privacy notice.
Ensures its use of the Service complies with the Meta Platform Terms, Meta Developer Policies and TikTok's terms, and that it holds valid authorisation over the connected assets.
Configures moderation rules, retention settings and automation levels responsibly, and reviews AI reply drafts before approving them.
Handles data subject requests from commenters as controller, and does not instruct WoComment to process data in a way that infringes the GDPR.
Manages access within its workspace, including promptly removing users who leave.

8. Processor obligations

WoComment:

Processes personal data only on the Controller's documented instructions, including for transfers, unless required otherwise by EU or Member State law — in which case it informs the Controller first, unless legally prohibited.
Immediately informs the Controller if it considers an instruction to infringe the GDPR or other data protection law.
Ensures persons authorised to process the data are under an obligation of confidentiality.
Implements the Art. 32 security measures described in section 11 of the Privacy Policy, and keeps them under review.
Respects the conditions in Art. 28(2) and (4) for engaging sub-processors (section 9 below).
Assists the Controller with data subject requests (Art. 12–23), by appropriate technical and organisational measures and insofar as possible — including self-service search, export and deletion tools in the dashboard.
Assists the Controller with DPIAs, prior consultation and security obligations (Art. 32–36), taking into account the nature of processing and the information available to it.
Deletes or returns the data at the end of the service (section 12 below).
Makes available all information necessary to demonstrate compliance and allows for and contributes to audits (section 11 below).
Maintains a record of processing activities carried out on behalf of the Controller (Art. 30(2)).
Does not process content data for its own purposes, does not use it to train its own or third-party models beyond what section 5.3 of the Privacy Policy states, and does not sell it.

The Controller gives general written authorisation for WoComment to engage sub-processors, subject to the notice and objection procedure below.
The sub-processors authorised at signature are those listed in section 6 of the Privacy Policy: BitCommand LLC, OpenRouter, Stripe, and WoComment's own transactional mail infrastructure.
WoComment maintains a current list at wocomment.com/subprocessors, with a subscription option for change notifications.
Notice: WoComment gives at least 30 days' prior notice of the addition or replacement of a sub-processor.
Objection: the Controller may object on reasonable, documented data protection grounds within that notice period. The parties will discuss in good faith; if WoComment cannot offer a reasonable alternative or mitigation, the Controller may terminate the affected part of the Service without penalty, with a pro-rated refund of prepaid fees for the unused term.
WoComment imposes on each sub-processor the same data protection obligations by written contract, and remains fully liable to the Controller for the sub-processor's performance (Art. 28(4)).

10. International transfers

Where processing takes place outside the EEA, WoComment relies on an adequacy decision or on the EU Standard Contractual Clauses (Decision (EU) 2021/914), Module Two or Module Three as applicable, incorporated into the DPA and the relevant sub-processor contracts, supported by a transfer impact assessment. The UK Addendum and the Swiss adaptations apply where the Controller is subject to UK GDPR or the Swiss FADP.

11. Audit rights

WoComment provides, on request and no more than once per twelve-month period, its current security documentation, sub-processor list, and any third-party audit reports or certifications it holds (we do not currently hold ISO 27001 or SOC 2 certification; our controls are described below — e.g. ISO 27001, SOC 2 — confirm which, if any, exist before publishing).
If that documentation is insufficient to demonstrate compliance, the Controller may conduct an on-site or remote audit, itself or through an independent auditor who is not a WoComment competitor and who is bound by confidentiality.
Conditions: at least 30 days' written notice; during normal business hours; scoped to the processing of the Controller's data; without unreasonable disruption; no access to other customers' data or to WoComment's confidential commercial information.
Additional audits may be conducted at any time following a personal data breach affecting the Controller's data, or where required by a supervisory authority, on shorter notice.
Each party bears its own costs; WoComment may charge a reasonable fee for audits exceeding the annual allowance.

12. Personal data breach notification

WoComment notifies the Controller of a personal data breach affecting the Controller's personal data without undue delay and in any event within 48 hours of becoming aware of it.
The notification includes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. Where the information cannot all be provided at once, it is supplied in phases without further undue delay.
WoComment provides reasonable assistance so the Controller can meet its own obligations to notify the supervisory authority (Art. 33, within 72 hours) and affected data subjects (Art. 34).
The Controller — not WoComment — makes the notification to the supervisory authority and to data subjects, unless the parties agree otherwise in writing.
WoComment maintains an internal breach register and does not treat notification as an admission of fault or liability.

13. Deletion or return on termination

At the Controller's choice, stated at or before termination:

Export: the Controller may export its content data and configuration in a structured, machine-readable format (CSV/JSON) from the dashboard at any time during the subscription and for 30 days after termination.
Deletion: WoComment deletes all Controller personal data from production systems within 30 days of termination or of the Controller's deletion request, whichever is earlier. OAuth tokens are revoked and deleted immediately on disconnection or termination.
Backups: data remains in encrypted rolling backups for up to 30 days and is then overwritten in the normal rotation cycle. Restored backups are re-purged. No processing of that data occurs in the meantime other than storage and restoration integrity.
Exception: WoComment retains data where EU or Member State law requires it — principally invoices and tax records for 7 years — and, in that case, retains it only for the required period and purpose and continues to protect it.
WoComment provides written confirmation of deletion on request.

14. Liability, precedence and governing law

The liability provisions of the main agreement apply to the DPA. In the event of conflict, the order of precedence is: (1) the Standard Contractual Clauses, (2) the DPA, (3) this summary, (4) the main agreement. The DPA is governed by Dutch law, with the competent court in Rotterdam, the Netherlands.

Placeholder checklist before publication

Placeholder	Where
`Cura Spectra B.V.`, `94496005`, `NL866798274B01`, `Crooswijkseweg 97 B03`, `Rotterdam`, `3034 HG`	Sections 1, DPA 1, DPA 14
`support@wocomment.com`, `privacy@wocomment.com`, `security@wocomment.com`	Sections 1, 10, 11, 14
`we have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; privacy questions go to the contact above`	Section 1 — decide whether a DPO is appointed
`BitCommand LLC`, `Frankfurt, Germany (European Union)`	Sections 6, 7 — NL region not confirmed
`United States, routing to model providers in various regions`	Section 6
`We select model providers whose default policy is not to train on API inputs; because routing may change, we state this as our selection criterion rather than an absolute guarantee`	Section 5.3 — do not publish the no-training sentence until verified in writing
`90`, `12 months`, `30`, `30`, `30`, `24 months`, `30`	Section 8, DPA 13
`30`, `30`, `30`	Sections 15, DPA 9, DPA 11
`we do not currently hold ISO 27001 or SOC 2 certification; our controls are described below`	DPA 11 — do not claim ISO/SOC certification that does not exist
`Rotterdam`	DPA 14
`1 September 2026`, `31 August 2026`, `1.0`	Header

> Template notice. This document is a template prepared for WoComment and is not legal advice. It contains unverified placeholders and at least two claims explicitly flagged for verification (the hosting region and the AI no-training guarantee). It must be reviewed, completed and approved by qualified Dutch/EU data protection counsel — and the underlying technical facts confirmed by the engineering team — before it is published or relied upon.