AR
Argentina in River Plate Spanish; the rest in neutral Spanish; English for everyone else.
Argentina in River Plate Spanish; the rest in neutral Spanish; English for everyone else.
Cobratia processes your customers' data on your behalf and only to provide you the service: the controller of that database is still you. We don't sell it, we don't share it and we don't use it for anything else. Here are the details, including what we still haven't resolved.
Last updated: October 12, 2026
It's the distinction that orders everything else, and the first one that comes up in an audit. Framework: Argentina's Law 25.326 and, where applicable, the European GDPR.
| Who | Role | What it means |
|---|---|---|
| The customer company | Controller | Decides what data it loads, for what and for how long. Sets the retention for its portfolio. |
| Cobratia | Processor | Processes that data on the customer's behalf and only for management and collections. Doesn't apply it to another purpose or share it. |
| Cobratia (exception) | Controller | Only for the do-not-contact list and the audit log of administrative actions, out of its own compliance obligation. |
| Cobratia (people who contact us) | Controller | Of the data of whoever fills out the form on cobratia.com or writes to us to learn about the service. See «If you filled out the form on cobratia.com». |
The retention of your portfolio is defined by you, not by us: you're the controller and have your own legal minimums. What follows is how Cobratia carries out those decisions and what mechanisms exist today.
| What | How long |
|---|---|
| Contact data: name, phone numbers, email, address, debt, last payment | For as long as the service lasts. No automatic expiry: they're deleted when the customer deletes the contact or closes the account. |
| Conversations, notes, orders and movements | For as long as the service lasts. Deleted in cascade along with the contact or the account. |
| Do-not-contact list (opt-out) | Indefinite, on purpose. It's the record that someone asked not to be contacted, and it survives deletion of the contact: if it were deleted, the next data load would write to them again. |
| Platform audit log | Target of 12 months for traceability. The period is still being defined. |
| Log of messages sent and conversations | No formal period yet. Today they're deleted when the contact or the account is deleted. |
| Visits to this website | We measure traffic with Google Analytics, which leaves two cookies in your browser to recognize your visit from one page to another. They last up to two years and you can delete them whenever you want from your browser. They aren't used for advertising: ad and profiling consent is denied in the tag itself. |
| Backup copies | They rotate on their own. A deleted record can survive in a backup until that copy expires; a backup isn't opened to delete a single record. |
About backups. A deletion is applied to the live system right away, but backup copies are snapshots of the past and rotate on their own. We don't open a backup to remove a single record: it's overwritten when that copy expires. We spell it out because it's the part almost nobody spells out.
Access, rectification, erasure and portability. No forms or paperwork.
It's all in the panel: export your contacts and your history whenever you want, edit or delete a contact, and request account closure. You don't need to write to us to get what's yours back.
The data was loaded by that company, which is the controller, so the fastest way is to ask them directly. If you prefer, write to us at cobratia@cobratia.com and we'll pass it on. To stop receiving messages, it's enough to reply to the assistant that you don't want to be contacted: it's recorded and no rule writes to you again.
What we do if an authority asks us for a person's data.
To date we have not received any request of this kind.
Cobratia connects to each customer company's Meta accounts with Meta's official APIs. This is exactly what it takes, what for, and how it's cut off.
| What | How it works |
|---|---|
| Who connects | The customer company, with its own Instagram professional account, its WhatsApp Business number or its Facebook page, authorizing Cobratia from its panel. Cobratia doesn't connect accounts on its own or access accounts that weren't authorized. |
| What data it receives | The messages people write to that company through that channel (text, attachments, reactions, read status), the identifier and display name of whoever writes, and the basic data of the connected account (username and identifier). Nothing else: it doesn't read posts, followers, content from other accounts or data of people who didn't write. |
| What for | So that the company —and its assistant— answer those conversations from a single place, and to link whoever writes with their customer record at that company. They aren't used for advertising, aren't sold, aren't cross-referenced with other customer companies, and don't train any model. |
| Where it's stored | On Cobratia's servers, in that customer company's separate space. The access credentials Meta issues are stored encrypted and only the system uses them to read and reply on that company's behalf. |
| For how long | For as long as the company keeps the channel connected and the conversation exists. When the channel is disconnected, Cobratia stops receiving messages immediately and the credentials are invalidated. |
| Meta's rules | Cobratia complies with Meta's platform policies and WhatsApp's and Instagram's messaging policies: it replies to whoever wrote, within the windows Meta allows, and doesn't send unsolicited messages through those channels. |
Here Cobratia is not working for another company: the data you left us is for answering you.
| Who the controller is | Cobratia, a brand of Rodrigo Seoane Ruano, Tax ID (CUIT) 27-96491224-1, Calle 31 511, Santa Teresita (ZIP 7107), Buenos Aires Province, Argentina. Contact: cobratia@cobratia.com. |
| What data we keep | What you wrote: first name, last name, company, phone, email and your message. Plus the record of what you agreed to: which boxes you ticked, the date and the IP address you sent the form from. |
| What for | To answer your inquiry, show you the platform and, if you ticked the news box, tell you Cobratia news. Nothing else: we do not sell or share it. |
| How we write to you | By WhatsApp, phone and email, because you agreed to it when you sent the form. On WhatsApp we write from Cobratia's number (+54 9 11 7129-9955) or from the sales number (+54 2246 59-0441). |
| How to opt out | Reply BAJA to any WhatsApp message, or write to us at cobratia@cobratia.com. It is recorded on the do-not-contact list and we will not write to you again. |
| How long we keep it | While there is an open business conversation. There is no automatic deletion yet: if you ask us to delete it, we delete it and confirm in writing. |
| Your rights | Access, rectification and erasure, under Argentina's Personal Data Protection Law 25,326, by writing to cobratia@cobratia.com. You can file a complaint with the Agency for Access to Public Information (AAIP), the authority that enforces that law. |
How to request deletion of the data Cobratia holds, including data that came in through a Meta channel.
Disconnect the channel from your panel (Inboxes → the channel → Delete) or remove the authorization from your Instagram or Facebook account (Settings → Apps and websites → Cobratia → Remove): from then on not one more message comes in. To delete what's already stored, delete the contacts or conversations from the panel, or request full account closure by writing to cobratia@cobratia.com: everything belonging to your company is deleted from the live system, and backups rotate on their own as explained above.
Write to us at cobratia@cobratia.com with the email or phone number you left. We delete your record and your conversations and confirm in writing. Only your request not to be contacted remains, so nobody writes to you again.
That company is the controller of your data: ask them, or write to us at cobratia@cobratia.com naming the company and your username or number, and we'll pass it on and confirm in writing. If Meta shows you the "Delete data" option for the Cobratia app, that request reaches the same inbox and is handled the same way.
This site leaves two measurement cookies, Google Analytics' (_ga and _ga_FQ93X4HRQ4). They're used to know how many people come in, where they come from and which pages they look at, and to avoid counting you twice if you come back. They last up to two years.
We also measure actions such as opening the demo, starting the chat, tapping the WhatsApp contact or successfully submitting the form. These events don't include what you wrote in the form, your phone, your email or the content of your messages.
What people ask us most before getting started. If something's missing, write to us and we'll answer it.
No. We process it solely to provide you the service, on your behalf and following your instructions. It isn't passed to third parties for commercial purposes nor used to train models.
No. Each customer has its own isolated database schema. The separation is structural, not a column filter someone could forget to apply.
You delete them from the panel and it's removed in cascade: their record, their conversations, their notes and their movements. The only thing that remains is their request not to be contacted, precisely so that no later upload writes to them again.
It's returned or destroyed, as you instruct. You can export your contacts and your history in a standard format whenever you want, also while you're a customer: we don't hold you hostage over data.
On a dedicated server in Germany, within the European Union. It's detailed on the security page, along with the encryption, two-factor sign-in and backup scheme.
The channel and the response time are on the security page, along with the site's security.txt file.
Yes, it leaves two measurement cookies (_ga and _ga_FQ93X4HRQ4), which are Google Analytics'. They tell us how many people visit, where they come from and which pages they look at, and avoid counting you twice if you return. There are no advertising cookies: consent for ads, ad data and profiling is denied in the tag, so Google can't use your visit to chase you with ads. Nor do we sell or cross-reference that data with anything. If you'd rather they not remain, delete them from your browser or browse in a private window.