--- updatedAt: 2026-07-31T11:52:41.000Z agentTools: projectIndex: https://developers.graphcomment.com/llms.txt --- # GDPR & EU data residency A French company, data hosted in France, a public DPA, named sub-processors — the compliance answers your DPO will ask for. If you're evaluating a comment platform for a European audience, your legal team will ask three questions: where does the data live, who touches it, and under what agreement. Here are the answers. GraphComment is operated by **SEMIOLOGIC**, a French company (67 cours Mirabeau, 13100 Aix-en-Provence, France). **Personal data is hosted in France.** ## Where your data lives The application and its database — where your community's personal data is stored — are hosted in **France**, with primary hosting operated by Iguane Services (Paris). This is not a regional replica of a US platform: France is where the data lives. The widget's scripts are served from the same infrastructure, not from a third-party CDN. If you subscribe to a paid plan, the payment itself is processed by Stripe (San Francisco, USA) — that concerns **your subscription payment only**, never your commenters' data. ## Roles: who is responsible for what For the comments and user data on your site, the standard GDPR split applies, as set out in our Data Processing Agreement (Article 28 GDPR): * **You (the publisher) are the data controller** for your community's data. * **SEMIOLOGIC acts as your data processor**, with the corresponding obligations: confidentiality, security measures, and notification of any personal data breach **within 72 hours** of becoming aware of it. For the data SEMIOLOGIC collects for its own account (e.g. your publisher account), SEMIOLOGIC is the controller, with the same transparency: the categories collected (e-mail address, avatar image, contact details, IP addresses) and the rights attached (access, rectification, deletion, portability) are listed in the DPA. Data subject requests are answered within **one month**. The full agreement is public: **[Data Processing Agreement](https://www.graphcomment.com/en/dpa)**. ## Sub-processors The DPA lists the sub-processors, their roles and their locations: | Sub-processor | Role | Location | Status | | --------------- | ---------------------------------------------- | ------------------ | -------------------------------------------------------------- | | Iguane Services | Primary hosting of the application | Paris, France | Active | | Brevo | Sending transactional e-mails | Paris, France | Active | | Stripe | Payment processing for paid plans | San Francisco, USA | Optional — client subscription payments only, no end-user data | | Mistral AI | AI-assisted content moderation (text analysis) | France (EU) | Optional | Hosting, database and e-mailing all sit in France; the optional AI moderation stays in the EU. ## Retention periods From the DPA's annex on processing activities: | Data | Retention | | -------------------------------------------------- | ---------------------------------------- | | Comments | Retained while displayed on your website | | Technical logs (IP, login attempts) | Up to 12 months | | Moderation data | 24 months by default | | Original e-mail fingerprint (hash) after an import | 24 months, then deleted | | Generated export files | Deleted 48 hours after you download them | ## Data minimization in practice Beyond the paperwork, minimization is built into how the platform works: * **Account deletion cascades automatically.** When a user account is deleted, a dedicated asynchronous pipeline propagates the deletion across every category of stored data — it's machinery, not a manual ticket. * **Audience analytics without cookies.** GraphComment's audience counting uses aggregated daily counters — no cookies, no persistent identifiers planted in the browser, no cross-site tracking. * **Short-lived operational logs.** The internal activity journal is automatically purged after 60 days (database-level expiry). ## What the widget stores in the browser In the standard embed (the widget in an iframe on your page), the visitor's session token is held **in memory only — it is never written to the browser's storage**. Only the standalone mode used by [mobile WebViews](./mobile-webview) persists its session token (in the WebView's local storage), so the user stays signed in between app launches. ## Consent and the widget The widget integrates with consent management platforms implementing **IAB TCF v2** through the standard `window.__tcfapi` interface: consent refused means the comments are not loaded, consent pending means the widget waits. Telemetry can additionally be gated behind your CMP with the `telemetricTroughCmp` option — see [Widget configuration](./widget-configuration). ## Migrations handled transparently Data protection extends to how your data gets *in and out* of GraphComment: * The Disqus export service runs **open-source, auditable code** ([graphcomment/disqus-wxr-middleware](https://github.com/graphcomment/disqus-wxr-middleware), MIT): your OAuth token is stored encrypted for the duration of the export job only, the generated file is transient, the service never parses your file — and it structurally **never receives your commenters' e-mail addresses**. Details and the full GDPR analysis: [Migrate from Disqus](./migrate-from-disqus). * In the other direction, you keep ownership of your data: you can retrieve all your comment data at any time (export tool in the administration area), and the [WordPress plugin](./wordpress) can continuously back every comment up into your own WordPress database. ## Contact Data protection questions, DPA matters, exercise of rights: ****.