Privacy Policy — Comment Console

Operator: Comercial Fersas SpA · Chilean Tax ID (RUT) 76.985.852-0
Registered address: Sargento Rojas 4530, Estación Central, Santiago, Chile
Privacy contact: privacidad@fersas.cl
Last updated: 27 August 2026

1. What this application is

Comment Console is internal software built and operated by Comercial Fersas SpA to manage the comments left on the social media accounts that the company itself operates. It is not sold, licensed, distributed or made available to any third party. There is no public sign-up. It is operated by one named person: the company's legal representative.

The company runs two online stores — casayquincho.cl and parasados.cl — and publishes product content on social media. This application reads the comments left on that content, identifies which ones are customer questions about price, availability, shipping or product use, and helps the company answer them accurately from its own inventory and pricing database.

2. Whose data we process, and what data

We process data relating to people who choose to comment publicly on posts published by accounts we operate. We process no data about any other person, and no data from accounts we do not operate.

For each comment we store exactly these fields:

Field	Purpose
Comment ID	Reply to the correct comment; never reply twice
Comment text	Understand and answer the question
Public username / handle of the author	Address the person; avoid duplicate replies
Post or video ID	Know which product the question refers to
Timestamp of the comment	Answer inside the platform's reply window; prioritise
Timestamp we received it	Measure our own response latency
The reply we published, and when	Auditable record of what we said
An intent label and an emotion label we generate	Route the comment: a price question is answered from our catalogue; a complaint is escalated to a person
A confidence score for that label	Identify classifications that need human review

For Facebook we also retain the original platform payload for the comment. We have verified that this payload contains no fields beyond those listed above (comment ID, post ID, parent ID, action verb, timestamp and message text).

We do not store: private profile data, email addresses, phone numbers, follower lists, other posts by the person, private messages, location, or any data from accounts we do not operate. We do not download or store videos, images or audio from any platform.

If a person voluntarily writes their own contact details inside a public comment, that text is stored as part of the comment text. We do not extract it into a separate contact database and we do not use it for marketing.

3. Why we process it (legal basis)

Our legal basis is legitimate interest: answering a question that the person deliberately directed at our business, on our own post, in public.

The balancing assessment behind that basis:

Necessity. The person asked us a question. Answering it requires reading what they wrote and knowing who to address. There is no less intrusive way to reply to a comment than to read it.
Nature of the data. Only what the person chose to publish, on our post, visible to anyone. We add nothing from other sources and we look up nothing about them elsewhere.
Reasonable expectation. Someone who writes "how much is it?" under a shop's video expects the shop to answer. Our processing does exactly that and nothing more.
Impact. Limited. The data is not sold, profiled, used for advertising or used to train models. It is disclosed to no one except the two processors named in section 5, each acting only on our instructions. It is deleted after 12 months.
Safeguards. Complaints go to a person, not to automation. Anyone can ask us to stop at any time, and deleting the comment removes our copy.

This assessment was prepared by the operator from public sources and is pending review by legal counsel; it will be updated if that review disagrees.

We process this data for one purpose: to answer questions and moderate abuse on our own posts. We do not use it to build advertising audiences, to profile individuals, to train machine-learning models, or for any purpose unrelated to answering the comment.

4. Automated replies

Replies to clearly commercial questions — price, stock, shipping, product specifications — are drafted and published automatically, using a reviewed library of response variants and data from our own product catalogue.

Safeguards applied to every automated reply:

Only comments classified as a commercial question are answered automatically. Praise, jokes and general conversation are not answered.
Complaints are never answered automatically and are never hidden. They are routed to a person for a human response.
A rotating library of reviewed variants is used, so the same text is not published repeatedly.
A compliance check runs before publication and blocks any reply that breaks our content rules.
Rate limits cap replies published per hour.
Every published reply is stored with its full text and timestamp.

A person can ask us to stop replying to them at any time; see section 7.

5. Sharing and processors

We do not sell or rent this data. We do not share it with advertising networks, data brokers or analytics providers, and we do not use it to enrich any other dataset.

Two processors act on our instructions, and only these two:

Processor	What it does for us	Where it runs
Oracle Cloud Infrastructure	Hosts the server that stores comments, labels and published replies	`sa-valparaiso-1` — Valparaíso, Chile
Anthropic PBC	Runs the language model that reads a comment and returns an intent label, an emotion label, an urgency value and a confidence score	United States

5.1 International transfer — stated plainly

Comment text is sent to Anthropic to be classified. This is a transfer of personal data outside Chile. We declare it rather than omit it.

What is transmitted, per comment, is exactly this:

a sequence number within the batch,
the name of our own brand account the comment was left on (casayquincho.cl or parasados.cl), and
the comment text, truncated to 260 characters.

What is not transmitted: the commenter's username or handle, the comment ID, the post or video ID, the platform, the timestamp, or any other identifier that would let the recipient link the text back to a person or to our records. The model receives text and returns labels; it is given nothing with which to identify anyone.

Under Anthropic's commercial terms, inputs submitted through its API are not used to train its models.

5.2 Where the classification step runs

Classification is triggered from a single company workstation operated by the same named person identified in section 6. That workstation holds a working queue of comments awaiting classification and a file of returned labels. These are working copies of data already described in section 2 and are subject to the same deletion obligations set out in sections 6 and 7.

6. Storage, retention and security

Comments and generated labels are retained for 12 months from the date of the comment, then deleted.
Access logs are retained for 12 months.
If a person deletes their comment on the platform, we delete our copy within 7 days of detecting it. We re-check every 24 hours, matching our ingestion cycle.
If the account holder revokes this application's access, all data obtained through it is deleted within 7 days.
Data is transmitted over TLS. Encryption at rest is provided by the platform: Oracle Cloud Infrastructure encrypts all boot and block volumes, and their backups, with AES-256 using Oracle-managed keys. This is enforced by OCI and cannot be disabled. This protects the stored data against access to the underlying storage. Access to the running instance is controlled separately, by the file permissions and single-operator restriction described below.
Access is limited to one named person, the company's legal representative, with an individual credential.
Access tokens are stored with restricted file permissions (owner read/write only), are never written to logs or shell history, and are rotated every 90 days.

7. Your rights

If you commented on one of our posts and want to know what we hold about that comment, or want it corrected or deleted, or want us to stop replying to you, write to privacidad@fersas.cl. We will respond within 10 business days, at no cost.

You may also delete your comment on the platform itself, which removes it from public view; our copy is then deleted as described in section 6.

Under Chilean law you may lodge a complaint with the competent data protection authority. At the date of this policy the applicable statute is Ley 19.628 on the protection of private life, under which rights are exercised directly with us and, failing that, before the ordinary courts.

Ley 21.719 — published in the Diario Oficial on 13 December 2024 — enters into force on 1 December 2026 and creates the Agencia de Protección de Datos Personales. From that date, complaints may be brought before that Agency. We will update this policy accordingly.

(Statutory dates taken from public sources; pending confirmation by counsel.)

8. Children

This application is not directed at children and we do not knowingly process data of people below the minimum age required by each platform's own terms.