Privacy Policy

1. Controller

The data controller responsible for data processing within this extension is:

Marcel Porcher
Raabestraße 6
10405 Berlin, Germany
Email: support@newways.ai

2. What Data We Process

Comment Booster processes the following types of data, all stored locally in your browser using Chrome's built-in chrome.storage.local API:

• User Profile: Name, role, expertise, and writing style preferences you enter in the extension settings.
• API Keys: Your personal API keys for AI providers (OpenRouter, Anthropic, OpenAI). These are stored locally in your browser and never transmitted to us.
• Knowledge Base Documents: Text, PDF, or DOCX files you upload to personalize AI-generated content. These are stored locally in your browser.
• Extension Preferences: UI settings such as theme, comment count, length preferences, and selected goals.
• Cost Tracking Data: Usage statistics (token counts, estimated costs) stored locally for your reference.

3. Legal Basis for Processing (GDPR Art. 6)

• Local data storage (profile, settings, knowledge base): Processing is based on Art. 6(1)(b) GDPR — performance of a contract. Storing your preferences is necessary for the extension to function as intended.
• Data transfer to AI providers (when you click “Generate”): Processing is based on Art. 6(1)(a) GDPR — your explicit consent. You actively choose to send data by clicking the generate button, selecting your AI provider, and providing your own API key.
• Payment processing (via ExtensionPay): Processing is based on Art. 6(1)(b) GDPR — necessary for the performance of a subscription contract.

4. Data Sent to Third-Party AI Providers

When you click “Generate” to create comments or posts, the following data is sent to the AI provider you selected:

• The text of the social media post you are responding to (or your input text for post generation).
• Your user profile information (name, role, expertise) to personalize the output.
• Relevant excerpts from your Knowledge Base, if enabled.
• Web search context from Perplexity, if you enabled this feature.

This data is sent directly from your browser to the AI provider's API. It does not pass through any server operated by us.

AI Provider Data Retention

You choose which provider to use. No data is sent to any provider you have not selected and configured with your own API key.

5. International Data Transfers (GDPR Art. 44–49)

When you use Comment Booster to generate AI content, your data is transferred to servers operated by third-party AI providers based in the United States.

The legal basis for these transfers is Standard Contractual Clauses (SCCs) as adopted by the European Commission (Art. 46(2)(c) GDPR):

• OpenRouter: Zero Data Retention by default (prompts are not stored).
• Anthropic: DPA with SCCs incorporated into Commercial Terms of Service.
• OpenAI: GDPR-ready DPA covering instructions-only processing, confidentiality, and breach notification.

By using Comment Booster and configuring an AI provider, you acknowledge that your generated content will be processed in the United States under the safeguards described above.

6. Data We Do NOT Collect

• We do not operate any backend servers or databases.
• We do not collect analytics or usage telemetry.
• We do not use cookies or tracking technologies.
• We do not collect your browsing history.
• We do not sell, share, or transfer any data to third parties (other than the AI API calls you initiate).
• We do not have access to your API keys or any data stored in your browser.
• We do not engage in automated decision-making or profiling as defined in Art. 22 GDPR.

7. LinkedIn Content Script

Comment Booster includes a content script that runs on linkedin.com. This script:

• Detects LinkedIn post content when you choose to generate a comment.
• Injects AI-generated comments into the LinkedIn comment editor when you use the one-click feature.
• Does not scrape, collect, or store any LinkedIn data.
• Does not automatically read or process posts without your explicit action.

8. Payment Processing

If you subscribe to Comment Booster's premium features, payment is processed by ExtensionPay (extensionpay.com). We do not have access to your payment details (credit card numbers, billing address). Please refer to ExtensionPay's Privacy Policy for details on how they handle payment data.

9. Data Storage and Deletion

• Storage: All data is stored locally in your browser using Chrome's chrome.storage.local API, which is encrypted by the browser.
• Deletion: You can delete all your data at any time by clearing individual items in the extension settings or by uninstalling the extension.
• Data Retention by us: We retain no data whatsoever, as we do not operate servers or databases.
• Data Retention by AI providers: See the retention table in Section 4 above.

10. Security

• API keys are stored in Chrome's encrypted local storage and masked in the UI.
• API keys are automatically redacted from error messages to prevent accidental exposure.
• All API communication uses HTTPS/TLS encryption.
• No personal data is transmitted unencrypted.

11. Your Rights (GDPR Art. 15–21)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access (Art. 15): You can view all data stored by the extension at any time in your browser's extension settings.
• Right to Rectification (Art. 16): You can edit your profile, knowledge base, and settings at any time through the extension's options page.
• Right to Erasure (Art. 17): You can delete all stored data through the extension settings or by uninstalling the extension.
• Right to Restriction of Processing (Art. 18): You can stop all AI processing at any time by simply not clicking the generate button.
• Right to Data Portability (Art. 20): Your data is stored locally and can be exported via Chrome's developer tools.
• Right to Object (Art. 21): You can stop using the extension at any time. No data processing occurs without your explicit action.
• Right to Withdraw Consent (Art. 7(3)): You can withdraw your consent to AI processing at any time by not using the generate function.

For data sent to third-party AI providers, you may exercise your rights directly with those providers using the links in Section 4.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Berlin, Germany is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
www.datenschutz-berlin.de

13. Permissions Explained

Comment Booster requests only the minimum permissions necessary:

• storage: Save your settings and preferences locally.
• activeTab: Read selected text from the current tab to generate comments.
• contextMenus: Provide a right-click option to generate comments from selected text.
• scripting: Inject generated comments into LinkedIn's comment editor.
• sidePanel: Display the extension's main interface.
• alarms: Schedule periodic cleanup of temporary cached data.
• Host permissions (AI APIs): Send requests to the AI provider you selected.

14. Children's Privacy

Comment Booster is not directed at children under 16 (in accordance with GDPR Art. 8). We do not knowingly collect any data from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the “Last updated” date at the top of this page. For material changes, we will notify users through the extension's update notes. Continued use of the extension after changes constitutes acceptance of the updated policy.

16. Contact

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about data processing, please contact:

Marcel Porcher
Raabestraße 6
10405 Berlin, Germany
Email: support@newways.ai