Privacy Policy
This policy explains how CobraSphere collects and uses personal data, why, how long it is kept and the rights you have.
This privacy policy covers cobrasphere.com, the CobraSphere sign-in and the CobraSphere Account and Partner consoles.
CobraSphere works with businesses. Most of the personal data it holds is the work contact details of people at those businesses.
Last updated 23 October 2026.
Who is responsible
CobraSphere Limited is the controller of the personal data described in this policy.
CobraSphere Limited
20-22 Wenlock Road
London
N1 7GU
Registered in England and Wales, company number 07999555.
How to contact CobraSphere
For any question about this policy or your personal data, or to use any of your rights, please use the contact form at cobrasphere.com/en-gb/company/contact.
CobraSphere may ask you to prove who you are before acting on a request about your data.
Visiting cobrasphere.com
When you visit cobrasphere.com your browser sends technical details such as your IP address, browser type, language and the page you asked for. These details are needed to show you the site and to protect it.
The site is delivered through Cloudflare, which protects it and speeds it up, and is hosted by Netlify. Both receive these technical details as part of their service. Cloudflare does not keep a log of these requests for CobraSphere. Netlify keeps its request and function logs for between 24 hours and 30 days, depending on the plan. Each provider may also use these details to protect its own network, as its own privacy policy describes.
The images on the site are delivered by Storyblok, which manages the site's content. Your browser fetches them directly, so Storyblok receives the same technical details.
The lawful basis is CobraSphere's legitimate interest in running a secure website.
Analytics and cookies
cobrasphere.com uses two services that set cookies and measure how the site is used.
The Google tag (Google Analytics) records the pages you visit, how you arrived, your approximate location based on your IP address and your device and browser type. CobraSphere uses this to understand which pages are useful and to improve the site.
HubSpot tracking records the pages you visit and links your visits to any details you later send through a form on the site.
The lawful basis for these cookies is your consent. When you first visit, a cookie banner from HubSpot asks whether you accept them, and you can change your choice later from the same banner. You can also block or delete cookies in your browser settings at any time.
Google signals and Google advertising features are switched off, and Google Analytics is not linked to any advertising account.
Contact form
When you use the contact form, CobraSphere asks for your first name, last name, business email address and your message. Your phone number is optional. You can also choose whether CobraSphere may contact you by email, by phone or in-vehicle with news and offers.
With the message, CobraSphere also records the page you sent it from and the IP address it came from, to reply in context and to prevent misuse.
The message is stored in CobraSphere's own systems in the United Kingdom and Germany and in HubSpot, which CobraSphere uses to manage business contacts.
CobraSphere uses these details to reply to you and, where your request is about working together, to take the steps you asked for before any agreement. The lawful basis is CobraSphere's legitimate interest in answering business enquiries.
News and offers are sent only if you choose to receive them, and the lawful basis is your consent. Every marketing email has a link to change your preferences or stop receiving them.
Registration and authentication
People sign in to CobraSphere with their email address and a one-time code sent to that address. CobraSphere does not store a password.
A CobraSphere account holds the person's name, email address, the organisations they belong to, which CobraSphere systems they can use, the invitations sent to them and a record of their sign-ins.
Personal Data collected: email address, first name, last name, organisation and sign-in records.
If CobraSphere later lets people at some organisations sign in with their work account from Microsoft, Microsoft will verify who they are and CobraSphere will receive only their name and email address. This policy will be updated before that option is offered.
A sign-in lasts up to 30 days at a time and never more than 90 days before a new code is needed. You can see your recent sign-ins in the Account console and sign out of any device there.
The lawful basis is the contract with you or your organisation, or the steps needed before one. Keeping a record of sign-ins is also in CobraSphere's legitimate interest in protecting accounts.
Requesting access
A person who signs in with a new email address and has no access code can ask for access. CobraSphere asks for their first name, last name, organisation, the organisation's website and the purpose of their request.
With the request, CobraSphere also records the IP address it came from, an approximate country based on that address, the browser and language used and the page the person came from. CobraSphere checks whether the email domain receives mail, whether it matches the organisation's website and whether the address or domain has asked or signed in before.
These details are used only to decide whether to give access, to reply and to prevent misuse. Every request is reviewed by a person at CobraSphere. Nothing is decided automatically. The lawful basis is CobraSphere's legitimate interest in giving access only to people with a genuine reason, and in protecting its systems.
If access is given, the person receives an invitation by email and the details become part of their CobraSphere account. Requests are deleted 12 months after they are made.
Emails from the sign-in
Sign-in codes, invitations and messages about your account are sent from CobraSphere's Microsoft 365 email service. Microsoft handles these emails on CobraSphere's behalf.
Partners
If you are a CobraSphere partner, the Partner console holds your name, how you would like to be addressed, your email address, your business name, company number, registered address and VAT number, and the version and date of the partner agreement you accepted.
To pay commission, CobraSphere holds the bank account you give for payment. The account holder name, sort code and account number are encrypted when stored, and the console shows only the last four digits.
CobraSphere prepares a commission statement for each quarter from the invoices paid by the businesses you introduced. Invoices, statements and payments are kept in CobraSphere's online accounting service.
If you send feedback through the console, CobraSphere records your rating, comment, the page you were on and your browser type.
The lawful basis is the partner agreement. Commission and payment records are also kept to meet CobraSphere's legal duties on tax and accounts.
People introduced by partners
When a partner introduces a business, they may give the name, role, email address and phone number of a contact there, and how that person prefers to be contacted. The partner tells CobraSphere that the contact knows about the introduction.
CobraSphere uses these details to contact the business about the introduction and to record which partner made it. They are also kept in HubSpot.
The lawful basis is CobraSphere's legitimate interest in following up business introductions. You can ask CobraSphere at any time to stop contacting you.
CobraSphere Insider
Some businesses receive a letter with an access code for CobraSphere Insider on cobrasphere.com. The code is checked when it is entered and is never stored.
To prevent guessing, the IP address of a failed attempt is held for up to 15 minutes and then forgotten.
Letters are addressed to people at businesses. For a business that is new to CobraSphere, the name and work contact details come from public sources such as the business's own website and Companies House. For an existing customer or enquirer, they are the details the business or the person gave CobraSphere. These details are kept in HubSpot and in CobraSphere's online accounting service, and may later move to CobraSphere's own systems in the United Kingdom and Germany. How long they are kept is set out under How long data is kept.
The lawful basis is CobraSphere's legitimate interest in contacting businesses about its services. You can ask CobraSphere at any time to stop contacting you.
Lawful bases in brief
Accounts and sign-in. Contract, or steps before a contract.
Partner details, payment and statements. Contract, and legal duties for tax and accounts records.
Requesting access. Legitimate interests.
Security, sign-in records and preventing misuse. Legitimate interests.
Contact form replies and business contacts. Legitimate interests.
People introduced by partners. Legitimate interests.
Letters to businesses. Legitimate interests.
News and offers. Consent.
Analytics cookies. Consent, given through the cookie banner.
Where CobraSphere relies on legitimate interests, it has weighed those interests against your rights. You can ask for details of that assessment through the contact form.
Who CobraSphere shares data with
CobraSphere does not sell personal data.
It uses the following providers, who handle data only on CobraSphere's instructions.
Cloudflare. Protects and delivers cobrasphere.com.
Netlify. Hosts cobrasphere.com and the Account and Partner consoles.
Google. Google Analytics on cobrasphere.com.
HubSpot. Website tracking, the cookie banner, the contact form and business contacts.
Microsoft. Microsoft 365 email for sign-in codes, invitations and account messages.
Storyblok. Manages the content of cobrasphere.com and delivers its images. It receives visitors' technical details when images load, and no form or account details.
An online accounting service. Invoices, commission statements and payment records.
CobraSphere may also share data where the law requires it, or to protect its rights and its users.
Where data is held
CobraSphere Limited is a UK company. CobraSphere's own systems run on its servers in the United Kingdom and Germany. The CobraSphere sign-in, accounts and partner records are held in Germany.
A preview copy of the Partner systems runs on a CobraSphere server in the United Kingdom for testing. It never holds real personal data.
Germany is in the European Union, which the United Kingdom treats as giving adequate protection. Storyblok is also based in the European Union. It delivers images through a worldwide network run by Amazon Web Services, and its own transfers to the United States rely on the Data Privacy Framework.
Google, HubSpot, Cloudflare, Netlify and Microsoft are based in the United States, and CobraSphere's HubSpot account is held in HubSpot's United States data centre. Each of these five providers is certified under the UK Extension to the EU-US Data Privacy Framework, and transfers to them rely on that certification. Where a provider's agreement also includes the standard contractual clauses with the UK Addendum, those apply if the certification ever lapses.
The accounting service may process data outside the United Kingdom. It transfers data only to countries the United Kingdom treats as adequate, or under standard contractual clauses.
How long data is kept
Requests for access. 12 months from the request, then deleted.
One-time sign-in codes. 60 minutes, and no longer valid after five wrong tries.
Codes to verify an added email address. 15 minutes.
Invitation links. 30 days.
A sign-in on a device. Up to 30 days at a time and no more than 90 days in all.
Accounts where the email address was never verified. Deleted after 7 days.
Accounts. For as long as the account is open. A closed account can no longer be used and its sessions and invitations end at once. Its details are deleted 60 days after it closes.
Sign-in records. 12 months.
Contact form messages and business contacts, including the details used for letters. 3 years after the last contact, unless they become a customer or partner. People who chose to receive news and offers are then kept only as subscribers, with name, email and preferences, until they unsubscribe or have not engaged for 2 years. A record of anyone who asked not to be contacted is kept so that request is respected.
Analytics data. 14 months, the setting in Google Analytics.
Partner details. For as long as the partner agreement runs, then 6 years. Bank details are deleted once the final commission has been paid.
Commission and payment records. 6 years from the end of the financial year they relate to.
Introductions. 2 years from the introduction if it leads to no business. Where it leads to commission, it is kept with the commission records.
Partner feedback. 2 years.
Failed Insider attempts. Up to 15 minutes.
How data is protected
Access to personal data at CobraSphere is limited to the people who need it for their work.
Data travels over encrypted connections. Partner bank details are encrypted when stored. Sign-in codes are stored only in a form that cannot be read back, and passwords are not used.
Staff access to full partner bank details is recorded.
Your rights
Under UK data protection law you have the right to
ask for a copy of the personal data CobraSphere holds about you
ask for data that is wrong or incomplete to be corrected
ask for your data to be deleted
ask CobraSphere to restrict how it uses your data
object to CobraSphere using your data on the basis of its legitimate interests, including for marketing
receive data you gave CobraSphere in a common, machine-readable format, or have it sent to another organisation, where the basis is consent or contract
withdraw your consent at any time where consent is the basis, without affecting what was done before
To use any of these rights, please use the contact form at cobrasphere.com/en-gb/company/contact. CobraSphere replies within one month. Some rights have limits set by law, and CobraSphere will explain if one applies.
You can also update your name and email addresses, see your recent sign-ins and ask to close your account in the Account console.
Complaints
If you are unhappy with how CobraSphere has handled your data, please contact CobraSphere first so it can put things right.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk.
Changes to this policy
CobraSphere updates this policy when the way it handles personal data changes. The date at the top shows when it last changed.
When a change is significant, CobraSphere also tells account holders and partners by email before it takes effect.