Privacy Policy
Last updated:
1. Who is responsible for your data
The controller of your personal data is Ing. Radek Svoboda, trading as Comnview, IČO 02393131, DIČ CZ9307155099, with registered address at Slovanská 1870, 684 01 Slavkov u Brna, Czech Republic, entered in the Trade Register of the Czech Republic. Write to support@comnview.com about anything in this policy. We are a small business and have not appointed a data protection officer; your message comes straight to us.
When you share someone else’s personal data through Comnview (for example a client’s website with names and photos on it), you decide what is shared and why, and we process it on your behalf.
2. What we collect
You give us
- Account: your email address, and your name and profile picture if you sign in with Google. Accounts created earlier with a password keep only a secure hash of it, never the password itself.
- What you share: the pages you capture with the extension (their HTML, styles, images and a screenshot), the images and PDFs you upload, and their names.
- Comments and drawings: what you write and draw, images you attach, and the name and colour you choose as a reviewer.
- Emails you give for a purpose: to be notified of replies, to invite people to a link or a team, or on the pricing page to hear when a plan opens (with the plan and billing you picked).
- Messages you send us.
Collected when you use Comnview
- An anonymous id in a cookie, so the previews you make without an account stay yours.
- Sign-in sessions: when you sign in we keep a record of the session with your IP address and browser, to keep you signed in and to protect your account. It ends when you sign out, or after 30 days without use.
- Technical data in our server logs: IP address, browser, pages requested and times. Used to keep the service running and secure.
- Which shared link brought you here, if you arrive from a “Made with Comnview” badge or an invite, so the link’s owner sees how many sign-ups it led to.
- Analytics, only if you accept analytics cookies: which pages are visited and how the site is used, through Google Analytics.
From the payment provider
When you buy a plan, Paddle collects your payment and billing details directly, as merchant of record and under its own privacy notice. We never see your card number. We receive what we need to run your plan: your plan, its status and renewal date, your country, and the invoice amounts.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running Comnview for you: accounts, sharing links, comments, drawings, teams | Contract (Art. 6(1)(b)) |
| Emails that are part of the service: sign-in links, comment notifications you asked for, invites you send | Contract (Art. 6(1)(b)) |
| Telling you when a paid plan opens, after you left your email on the pricing page | Your consent (Art. 6(1)(a)); withdraw it any time |
| Keeping the service secure, preventing abuse, fixing errors (server logs, rate limits) | Legitimate interest (Art. 6(1)(f)) |
| Counting sign-ups per shared link for its owner | Legitimate interest (Art. 6(1)(f)) |
| Analytics about how the site is used | Your consent (Art. 6(1)(a)), given in the cookie banner |
| Keeping payment and tax records | Legal obligation (Art. 6(1)(c)) |
4. Who can see what you share
- Anyone with a link can open it and see its comments, unless you protect it with a password.
- Members of your team workspace see the links in it.
- We do not sell your data, show ads, or use your content to train AI models.
- We may disclose data when the law requires it, or to protect people or our service from harm.
5. Services that process data for us
We use these providers to run Comnview. Each may use the data only to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Railway Corporation | Hosting: the app, the database files and everything you upload | United States (Standard Contractual Clauses) |
| Sendinblue SAS (Brevo) | Sending emails: sign-in links, comment notifications, invites | France (EU) |
| Google Ireland Limited | Sign in with Google; Google Analytics, only if you accept analytics cookies | Ireland (EU), with transfers to the United States under the EU-US Data Privacy Framework |
| Paddle.com Market Limited | Selling paid plans as merchant of record: payment, invoices, sales tax and VAT. It collects your billing details directly and is a separate controller of that data under its own privacy notice | United Kingdom (EU adequacy decision) |
6. Transfers outside the EU
Some providers process data in the United States. We rely on the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework for those transfers. Write to us for a copy of the safeguards.
7. How long we keep it
- Links, uploads and comments: until you delete them; links do not expire on any plan. Deleted content is removed from our servers straight away, and from backups as they expire.
- Your account: until you delete it (Delete account on your Profile) or ask us to. That removes your account and your links; comments you left on other people’s links stay there, shown as “Former user” and no longer tied to you.
- Pricing-page emails: until we have told you the plan is open, or you ask us to remove it.
- Server logs: for a short period, for security and fixing errors.
- Analytics: up to 14 months in Google Analytics.
- Payment and tax records: as long as Czech accounting and tax law requires (up to 10 years).
8. Your rights
You can ask us to:
- give you a copy of your personal data, or send it to you in a portable format;
- correct it, or delete it (your account and everything in it; you can also do this yourself with Delete account on your Profile);
- restrict how we use it, or object to uses based on legitimate interest;
- withdraw a consent you gave, at any time (this doesn’t affect what was done before).
Write to support@comnview.com from your account’s email address. We answer within one month. You can also complain to the Czech data protection authority, the Úřad pro ochranu osobních údajů (uoou.gov.cz), or the authority where you live.
9. The Chrome extension
The extension works only when you use it: it captures the page you choose and uploads it to your Comnview account or browser. It does not collect your browsing history or read pages you don’t capture. It asks for these permissions:
- activeTab, tabs: to capture the tab you’re on and use its address and title to name the capture.
- pageCapture, scripting: to save the page as an interactive preview and take a full-page screenshot.
- Access to websites: to download the images, fonts and styles of the page you capture, including from other domains, so the preview looks like the original.
- storage: to remember your settings and which account or browser your captures belong to.
11. Security
Everything travels over HTTPS. Passwords are stored as hashes, link passwords are checked on our server, and access to accounts and links is checked on every request. No system is perfectly secure; if a breach affects your data, we will tell you and the authority as the law requires.
12. Children
Comnview is not meant for children under 16, and we don’t knowingly collect their data. If you think a child has given us data, write to us and we will delete it.
13. Changes to this policy
When we change this policy, we update the date at the top. For important changes we also tell you by email or on the site before they apply.