Privacy Policy

Cobalia (“Cobalia,” “we,” “us,” or “our”) operates the website cobalia.io (the “Site”) — a pre-launch marketplace connecting SaaS founders with performance-based marketers. This Privacy Policy explains what personal data we collect, why we collect it, and your rights regarding that data.

We only collect what we need:

• Waitlist sign-up — your email address when you join the early-access waitlist.
• Contact form — your name, email address, and the message you submit when you reach out to us.
• Usage data — standard server logs (IP address, browser type, referring URL, pages visited, timestamps) collected automatically when you access the Site.
• Cookies — we use strictly necessary cookies only (session management). We do not use tracking or advertising cookies.

We do not collect payment card data, government IDs, or any sensitive personal information at this pre-launch stage.

• Send you waitlist updates and, once we launch, your invite.
• Respond to contact form inquiries.
• Maintain the security and integrity of the Site (fraud prevention, abuse detection).
• Comply with legal obligations and enforce our Terms of Service.

We will never sell your data or use it for advertising on third-party platforms.

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing your personal data are:

• Legitimate interests — operating and improving the Site, preventing fraud.
• Consent — sending you marketing communications (you may withdraw at any time).
• Legal obligation — complying with applicable law.

We share personal data only with service providers acting on our behalf and under appropriate data-processing agreements:

• Email delivery — to send waitlist confirmations and product updates.
• Hosting & infrastructure — to serve the Site reliably.

We may disclose data if required by law, court order, or to protect the rights, property, or safety of Cobalia, our users, or the public.

We retain waitlist email addresses until the waitlist closes or you request deletion — whichever comes first. Contact form submissions are retained for up to 24 months. Server logs are automatically deleted after 90 days.

Depending on your location you may have the right to access, correct, delete, or port your personal data, or to restrict or object to its processing. To exercise any of these rights, use our contact form. We will respond within 30 days.

Our servers and service providers may be located outside your country. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms approved under applicable data protection law.

The Site is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have done so, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify waitlist members via the Site. Continued use of the Site after changes constitutes acceptance of the updated policy.

Questions or concerns? Use the contact form on our homepage.