GDPR & EU data residency
A French company, data hosted in France, a public DPA, named sub-processors — the compliance answers your DPO will ask for.
If you're evaluating a comment platform for a European audience, your legal team will ask three questions: where does the data live, who touches it, and under what agreement. Here are the answers.
GraphComment is operated by SEMIOLOGIC, a French company (67 cours Mirabeau, 13100 Aix-en-Provence, France). Personal data is hosted in France.
Where your data lives
The application and its database — where your community's personal data is stored — are hosted in France, with primary hosting operated by Iguane Services (Paris). This is not a regional replica of a US platform: France is where the data lives. The widget's scripts are served from the same infrastructure, not from a third-party CDN.
If you subscribe to a paid plan, the payment itself is processed by Stripe (San Francisco, USA) — that concerns your subscription payment only, never your commenters' data.
Roles: who is responsible for what
For the comments and user data on your site, the standard GDPR split applies, as set out in our Data Processing Agreement (Article 28 GDPR):
- You (the publisher) are the data controller for your community's data.
- SEMIOLOGIC acts as your data processor, with the corresponding obligations: confidentiality, security measures, and notification of any personal data breach within 72 hours of becoming aware of it.
For the data SEMIOLOGIC collects for its own account (e.g. your publisher account), SEMIOLOGIC is the controller, with the same transparency: the categories collected (e-mail address, avatar image, contact details, IP addresses) and the rights attached (access, rectification, deletion, portability) are listed in the DPA. Data subject requests are answered within one month.
The full agreement is public: Data Processing Agreement.
Sub-processors
The DPA lists the sub-processors, their roles and their locations:
| Sub-processor | Role | Location | Status |
|---|---|---|---|
| Iguane Services | Primary hosting of the application | Paris, France | Active |
| Brevo | Sending transactional e-mails | Paris, France | Active |
| Stripe | Payment processing for paid plans | San Francisco, USA | Optional — client subscription payments only, no end-user data |
| Mistral AI | AI-assisted content moderation (text analysis) | France (EU) | Optional |
Hosting, database and e-mailing all sit in France; the optional AI moderation stays in the EU.
Retention periods
From the DPA's annex on processing activities:
| Data | Retention |
|---|---|
| Comments | Retained while displayed on your website |
| Technical logs (IP, login attempts) | Up to 12 months |
| Moderation data | 24 months by default |
| Original e-mail fingerprint (hash) after an import | 24 months, then deleted |
| Generated export files | Deleted 48 hours after you download them |
Data minimization in practice
Beyond the paperwork, minimization is built into how the platform works:
- Account deletion cascades automatically. When a user account is deleted, a dedicated asynchronous pipeline propagates the deletion across every category of stored data — it's machinery, not a manual ticket.
- Audience analytics without cookies. GraphComment's audience counting uses aggregated daily counters — no cookies, no persistent identifiers planted in the browser, no cross-site tracking.
- Short-lived operational logs. The internal activity journal is automatically purged after 60 days (database-level expiry).
What the widget stores in the browser
In the standard embed (the widget in an iframe on your page), the visitor's session token is held in memory only — it is never written to the browser's storage. Only the standalone mode used by mobile WebViews persists its session token (in the WebView's local storage), so the user stays signed in between app launches.
Consent and the widget
The widget integrates with consent management platforms implementing IAB TCF v2 through the standard window.__tcfapi interface: consent refused means the comments are not loaded, consent pending means the widget waits. Telemetry can additionally be gated behind your CMP with the telemetricTroughCmp option — see Widget configuration.
Migrations handled transparently
Data protection extends to how your data gets in and out of GraphComment:
- The Disqus export service runs open-source, auditable code (graphcomment/disqus-wxr-middleware, MIT): your OAuth token is stored encrypted for the duration of the export job only, the generated file is transient, the service never parses your file — and it structurally never receives your commenters' e-mail addresses. Details and the full GDPR analysis: Migrate from Disqus.
- In the other direction, you keep ownership of your data: you can retrieve all your comment data at any time (export tool in the administration area), and the WordPress plugin can continuously back every comment up into your own WordPress database.
Contact
Data protection questions, DPA matters, exercise of rights: [email protected].
Updated 19 days ago