Privacy Policy
This policy describes how cobl AI processes the personal data for which it is the controller, in line with Regulation (EU) 2016/679 and French Act no. 78-17 of 6 January 1978 as amended.
It covers two areas:
- the website https://cobl.ai: browsing, contact forms, newsletter sign-up;
- the platform https://app.cobl.ai: account creation, use of the Services, billing.
It does not cover the data cobl AI processes on behalf of its clients, as a processor. That processing is covered by Schedule 2 of the Terms of Use, available at https://cobl.ai/legal/general-terms-of-use and shareable separately.
1. Controller
cobl AI, a French simplified joint-stock company with a share capital of 130,751 euros, 883 208 142 Bordeaux Trade and Companies Register, registered office at 34 bis rue Vignon, 75009 Paris, France.
For any question about personal data: contact@cobl.ai, or by post at the address above.
cobl AI has not appointed a data protection officer.
2. What we collect and why
2.1 Website visitors
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, company, email, phone, country, message (contact form) | Answering the request, qualifying the need | Legitimate interest: handling a commercial enquiry | 3 years from the last contact |
| Email address (newsletter) | Sending cobl AI news | Consent | Until consent is withdrawn, then 3 years as proof of withdrawal |
| IP address, browsing data, cookie identifiers | Audience measurement, campaign measurement, improving the site | Consent for non-essential cookies, legitimate interest for essential cookies | See the cookie policy |
2.2 Platform users
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, organisation, role | Creating and managing the account, authentication, access control | Performance of the contract | Duration of the contract, then 30 days |
| Connection logs | Security, traceability, diagnostics | Legitimate interest: service security | [To be completed] |
| Usage data: token volume, costs, response times | Billing, usage tracking, product improvement | Performance of the contract and legitimate interest | Duration of the contract, then 30 days |
| Billing data | Billing, accounting | Performance of the contract and legal obligation | 10 years (accounting obligation) |
| Product usage events | Product improvement | Legitimate interest | [To be completed] |
| Application and error logs | Technical diagnostics | Legitimate interest: keeping the service running | [To be completed] |
| Session replay, on a sample and on error | Technical diagnostics | Legitimate interest: keeping the service running | [To be completed] |
| Email address and usage properties | Product-related messages | Legitimate interest, with the option to unsubscribe | Duration of the contract, then 30 days |
A user account deleted by its organisation is erased immediately, except for connection logs.
When the contract ends, the organisation's data is kept for thirty days so it can be returned, then deleted. Invoices and accounting records are kept for ten years.
The content of the documents and conversations produced on the platform does not appear in this table: cobl AI processes it as a processor, on the client's behalf, under Schedule 2 of the Terms of Use.
3. Who receives the data
The data is available to authorised cobl AI staff, within the limits of their duties.
cobl AI uses the following providers, acting on its instructions: hosting, database, product analytics, application monitoring, lifecycle messaging, subscription management, payment provider, artificial intelligence model providers, and the connector integration gateway.
The named list, with each provider's role and location, is published at https://cobl.ai/legal/subprocessors.
Located in the European Union: application hosting, the database, the execution environments and product analytics. Embeddings are computed on cobl AI's own infrastructure.
Located in the United States: the artificial intelligence model providers, the connector integration gateway, application monitoring, model observability, lifecycle messaging and subscription management.
Data may also be shared with public bodies, solely to meet a legal obligation, and with cobl AI's advisers.
cobl AI does not sell personal data and does not share it with third parties for their own marketing.
4. Transfers outside the European Union
The platform's server functions are hosted in Dublin, Ireland. The database, the execution environments and product analytics are located in the European Union. Embeddings are computed on cobl AI's own infrastructure.
Transfers to the United States take place for calls to artificial intelligence models, the connector integration gateway, application monitoring and session replay, observability of exchanges with models, lifecycle messaging, subscription management and payment. The marketing website is hosted in the United States.
These transfers are covered by the standard contractual clauses adopted by the European Commission, supplemented where needed by additional measures.
The commitments on not reusing data, not training models and confidentiality apply identically wherever the processing takes place and whatever the client's country of establishment.
A copy of the applicable safeguards is provided on reasoned request.
5. Security
cobl AI applies technical and organisational measures to protect the data: separation by organisation checked on every operation, encryption in transit and at rest, role-based access control, isolation of execution environments, logging, and penetration testing by an independent third party, the most recent of which was in April 2026.
The detail is set out in paragraph 5 of Schedule 2 of the Terms of Use.
No system is completely secure. cobl AI cannot guarantee absolute security but undertakes to notify any data breach as required by law.
6. Your rights
You have the following rights over your data: access (article 15), rectification (article 16), erasure (article 17), restriction (article 18), portability (article 20), objection (article 21), and withdrawal of consent at any time for processing that relies on it (article 7).
You can also set instructions on what happens to your data after your death, under article 85 of the French Act of 6 January 1978.
To exercise these rights, write to contact@cobl.ai or to the postal address above. cobl AI may ask for proof of identity where there is reasonable doubt. We answer within one month, which may be extended by two months for complex requests.
If you are a platform user within a client organisation, requests about the content of your projects, documents and conversations should go to your organisation, which is the controller for them. cobl AI assists it in handling those requests.
You can lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.
7. Cookies
The site uses cookies and similar technologies. Non-essential cookies are only set after you consent, and you can change your choice at any time.
The list of cookies used, their purpose, their duration and how to manage your preferences are set out in the cookie policy: https://cobl.ai/legal/cookie-policy.
8. Minors
The Services are for professionals only. cobl AI does not knowingly collect data about people under 16. If we become aware of such collection, the data is deleted.
9. Changes
cobl AI may change this policy, in particular to reflect legal or technical developments. The effective date appears at the top of the document. Platform users are told about any material change by email or by a notice in the product.