Safari with "Block All Cookies" enabled is not supported
This setting prevents the app from working correctly, including account creation and login.

Data Processing Agreement

Last updated: November 13, 2026

This Data Processing Agreement (“DPA”) is part of the agreement between you (“Customer”, “you”, or “your”) and Undefined Bartosz Igielski, a sole proprietorship registered in the Polish business register (CEIDG), VAT ID PL6172207546, REGON 363119493 (“Company”, “we”, “us”, or “our”), for the use of YouTube Comments Downloader (the “Services”).

This DPA applies automatically to business customers who use the Services. It is incorporated into our Terms of Service by reference. If you use the Services on behalf of a business, you accept this DPA when you accept the Terms of Service. If there is a conflict between this DPA and the Terms of Service about the processing of personal data, this DPA prevails.

1. Definitions

In this DPA:

  • “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council.
  • “Personal Data” means any information relating to an identified or identifiable natural person.
  • “Processing” means any operation performed on Personal Data, such as collecting, storing, using, retrieving, disclosing, or deleting it.
  • “Controller” means the person or entity that decides why and how Personal Data is processed.
  • “Processor” means the person or entity that processes Personal Data on behalf of a Controller.
  • “Data Subject” means the individual whose Personal Data is processed.
  • “Subprocessor” means a third party that processes Personal Data on our behalf.
  • “Customer Personal Data” means Personal Data that we process on your behalf in providing the Services.
  • “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses approved by the European Commission for transfers of Personal Data outside the European Economic Area.

2. Roles

2.1 You are the Controller

You are the Controller for Personal Data in the content you ask us to retrieve, process, store, or export, and in the information you submit to the Services. This includes Personal Data about public YouTube comment authors, such as their display names, channel IDs, profile pictures, and comment text, and any other Personal Data contained in the URLs, search terms, requests, or files you submit.

You decide what content to request, how long to keep it, and who to share it with. You are responsible for having a lawful basis for the processing, for giving any notices that apply, and for making sure your instructions to us are lawful.

2.2 We are the Processor

For Customer Personal Data, we act as the Processor. We process Customer Personal Data only on your documented instructions, including the Terms of Service, this DPA, and the requests you make through the Services. We do not use Customer Personal Data for our own purposes, sell it, or share it except as described in this DPA or as you instruct us in writing.

2.3 We are the Controller for our own account data

For our own account, billing, support, security, and website data, we act as the Controller. This includes the information you give us to create and manage your account, billing details, purchase records, support conversations, and technical logs. Our Privacy Policy explains how we handle that data.

Payment providers may act as independent controllers for payment data where they are the merchant of record for a transaction. Their own terms and privacy policies apply to that processing.

2.4 Your responsibilities

You must not instruct us to process Personal Data in a way that breaks the law. You must also comply with the terms that apply to the content you access, including YouTube’s terms. The Services help you retrieve and export public content, but you are responsible for how you use that content and for the rights of the people in it.

3. Subject matter, duration, nature, and purpose

Subject matter. We process Customer Personal Data to provide the Services, including retrieving public YouTube comments, transcripts, and channel details, storing download files, producing exports, providing API and MCP access, and supporting your account.

Duration. We process Customer Personal Data for as long as you use the Services and until deletion or return as described in section 6. Downloaded comment data is stored for 30 days after the download is created and then deleted automatically. Download and export links do not expire, and anyone who has the URL can open them, so you are responsible for who you share links with. Account and billing data are kept for as long as your account exists and for as long as tax law requires.

Nature of the processing. Processing includes collecting, retrieving, recording, organizing, storing, adapting, retrieving, consulting, transmitting, exporting, restricting, and deleting Personal Data. Most of this processing is automated.

Purpose. We process Customer Personal Data to provide the features you request, keep the Services secure and reliable, troubleshoot problems, and provide support. We do not process Customer Personal Data for advertising or for building profiles of the people in the content.

4. Categories of Personal Data and Data Subjects

The Personal Data in the content you request can include:

  • Public YouTube comment author names or display names, channel IDs, and profile pictures.
  • Comment text, replies, timestamps, like counts, and other public metadata.
  • Public channel details, video details, transcripts, and live chat replays.

The Personal Data you submit can include:

  • URLs, search terms, and other request details.
  • Account information such as your name, email address, account ID, and billing country.
  • Support messages and the information you choose to include in them.
  • Technical data such as IP address, browser details, and error reports.

The Data Subjects can include:

  • Public YouTube comment authors and channel owners.
  • Your personnel, users, and other individuals whose data you submit.
  • Individuals whose data appears in the content you request.

We do not ask for special categories of Personal Data, such as health, political opinions, or biometric data. If the content you request contains that kind of data, you are responsible for having a lawful basis to process it.

5. Our obligations as Processor

5.1 Instructions

We process Customer Personal Data only on your documented instructions, unless the law requires us to do otherwise. If a law requires us to process Customer Personal Data for another purpose, we will tell you unless the law prohibits us from doing so. If an instruction, in our reasonable opinion, breaks data protection law, we will tell you and may pause the relevant processing until you confirm or change the instruction.

5.2 Confidentiality

We limit access to Customer Personal Data to the people who need it to provide the Services. Those people are bound by confidentiality obligations and receive appropriate training and instructions. We do not allow access for any other purpose.

5.3 Security

We use technical and organizational measures appropriate to the risk, as required by Article 32 of the GDPR. These measures include:

  • Access controls based on least privilege, unique accounts, strong passwords, and multi-factor authentication for administrative access.
  • Encryption of data in transit using TLS, encryption at rest where our hosting and storage providers support it, and hashed storage of account passwords and API keys.
  • Network protections such as firewalls, a CDN and web application firewall, rate limits, and separation of production systems.
  • Logging, monitoring, and error tracking so we can detect and investigate problems.
  • Regular patching and updates of the software and dependencies we use.
  • Backups and recovery procedures.
  • An incident response process for security incidents.
  • Checks on the subprocessors we use before we engage them.

No system is completely secure. We will review and update these measures as the Services and the risks change.

5.4 Assistance with Data Subject requests

If a Data Subject contacts us about Customer Personal Data, we will tell you without undue delay unless the law prohibits us from doing so. We will not respond to the request ourselves unless you ask us to or the law requires it. We will provide reasonable assistance so you can respond to requests to access, correct, delete, restrict, or export Personal Data. The Services also let you access, export, and delete much of the data yourself.

5.5 Personal Data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay. The notice will include, to the extent we know it at the time:

  • What happened and when.
  • The categories and approximate number of Data Subjects and records affected.
  • The likely consequences.
  • The measures we have taken or propose to take to address the breach and reduce its effects.

We will cooperate with you and provide updates as we learn more. A notice is not an admission of fault.

5.6 Deletion, return, and retention

When the Services end, we will delete or return Customer Personal Data at your choice, unless the law requires us to keep it. You can export your data through the Services before the end. Downloaded comment data is deleted automatically 30 days after the download is created. Account and billing data are kept for as long as your account exists and for as long as tax law requires, and then deleted. Other Customer Personal Data is deleted or returned within 30 days after the end of the Services, except where the law requires retention. Data in backups is isolated from normal use and deleted in the ordinary course of our backup rotation. Download and export links do not expire, so anyone with the URL can open them; you are responsible for who you share them with.

5.7 Audit

We will provide the information you reasonably need to show that we comply with this DPA. This can include our security documentation, the current subprocessor list, and responses to reasonable security questionnaires. If a law or a supervisory authority requires an audit, we will allow it on reasonable notice, during business hours, under confidentiality, and at your cost. We do not agree to unlimited or repeated on-site audits.

5.8 Government requests

If a public authority asks us for Customer Personal Data, we will challenge the request where we have a reasonable basis to do so. We will tell you unless the law prohibits us from doing so. We will disclose only what we are legally required to disclose.

6. Subprocessors

You give us general authorization to engage subprocessors. The current list, with each subprocessor’s purpose, the Personal Data involved, and its processing location, is on our Subprocessors page.

We may add or replace subprocessors from time to time. We give notice of a change by updating the Subprocessors page and its “as of” date. We aim to publish the update before the new subprocessor starts processing Customer Personal Data. If you reasonably object to a change on data protection grounds, you may stop using the affected part of the Services or terminate the affected part. We will work with you in good faith on a solution.

We require each subprocessor to be bound by data protection obligations that are at least as protective as this DPA. We remain responsible for our subprocessors’ performance of those obligations.

7. International transfers

Our application servers run in the European Union, in Amsterdam and Germany. Some of our subprocessors process data in the United States or globally. For example, our payment providers, error monitoring, support chat, and some email delivery run on United States infrastructure, and our CDN operates a global network.

When we transfer Personal Data outside the European Economic Area, we use one of the following safeguards:

  • An adequacy decision of the European Commission.
  • The Standard Contractual Clauses, together with any additional measures we consider necessary.
  • The EU-US Data Privacy Framework, where the recipient is certified under it and the certification covers the relevant data.

We do not treat a vendor as certified under the Data Privacy Framework unless its certification is current. You can ask us for information about the safeguard that applies to a particular transfer.

8. Liability

Each party is responsible for its own breaches of this DPA. Our liability under this DPA is subject to the limitations in the Terms of Service. Nothing in this DPA limits the rights of Data Subjects under the GDPR.

9. Term and changes

This DPA applies for as long as we process Customer Personal Data. The obligations about confidentiality, security, deletion, and audits continue after the Services end for as long as we hold the data.

We may update this DPA to reflect changes in the law, the Services, or our subprocessors. We will post the new version on this page and update the date at the top. If a change materially affects your rights, we will give reasonable notice. You may object to the change or stop using the Services before it takes effect.

10. Governing law and jurisdiction

This DPA is governed by the laws of Poland. The courts of Bielsko-Biała have non-exclusive jurisdiction, matching the Terms of Service. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

11. Contact

If you have questions about this DPA or want to exercise a right under it, contact us at contact@youtubecommentsdownloader.com. Our registered business address is listed in our Terms of Service.