Cobra Clicks S.A.R.L (شركة كوبرا كليكس ش.م.م) is a limited liability company registered in Lebanon under commercial register number 583657 at the Commercial Register of Mount Lebanon, Baabda, with its registered office at Section 15, Property No. 1402, Baysour, Mount Lebanon, Lebanon. In this policy “Cobra Clicks”, “we”, “us” and “our” refer to that company.

Last updated: 3 November 2026

This Privacy Policy explains how Cobra Clicks collects, uses, stores, shares and protects personal data when you:

visit cobraclicks.com and its subdomains (including web-potfolio.cobraclicks.com) (the “Website”);
contact us, request a proposal or subscribe to our newsletter;
become a client and we manage your advertising, analytics, website or marketing accounts; or
connect your Google Ads or Meta (Facebook/Instagram) accounts to our tools (the “Cobra Clicks Apps”).

1. Who we are

The Website and the Cobra Clicks Apps are operated by COBRA CLICKS S.A.R.L, trading as Cobra Clicks, Commercial register No. 583657, Commercial Register of Mount Lebanon, Baabda (not registered for VAT), with its registered address at Section 15, Property No. 1402, Baysour, Mount Lebanon, Lebanon.

We are a digital marketing agency offering website development and design, search engine optimization (SEO) and answer engine optimization (AEO), paid advertising and performance marketing, and consultancy services. We work with clients from our locations in Beirut (Lebanon), Dubai (United Arab Emirates), Riyadh (Saudi Arabia) and Madrid (Spain), and with clients in the United States.

Contact for privacy matters: info@cobraclicks.com
Contact for Google Ads and Meta integration and data deletion requests: ads@cobraclicks.com
Phone: (+961) 3700413 / (+34) 647491120

2. Our two roles: controller and processor

Controller. We decide how and why personal data is processed for our own Website, our own marketing, our contact and newsletter forms, and our business relationship with clients and prospects.
Processor (service provider). When we manage a client’s advertising accounts, analytics, website or CRM, we process the data in those accounts on behalf of and under the instructions of that client. The client is the controller of that data and its own privacy policy applies to the people whose data it holds. Our obligations in this role are set out in our agreement with the client.

3. Personal data we collect

3.1 Data you give us

Contact form (Contact us page): first name, last name, phone number, email address and your message.
Newsletter form: email address.
Email, phone and messaging: any information you choose to share when you write to or call us.
Clients: business contact details, billing information, contract details, and the access credentials or permissions you grant us to your accounts (for example, user access to your Google Ads, Google Analytics, Meta Business or website accounts).

3.2 Data collected automatically on the Website

When you visit the Website, we and our partners use cookies and similar technologies to collect information such as your IP address, device and browser type, pages viewed, referring pages, approximate location derived from your IP address, and interactions with the Website. We use:

Google Analytics 4 (website statistics);
Google Ads conversion tracking and remarketing, loaded through Google Tag Manager;
Meta Pixel (measurement and advertising on Facebook and Instagram);
Google reCAPTCHA (protecting our forms from spam and abuse);
Google Fonts and embedded YouTube videos (displaying content).

See our Cookie Policy for the full list and how to manage your preferences.

3.3 Data we access when we manage client accounts

When a client gives us access, we may access campaign settings, performance reports, audience and conversion settings, website analytics reports and website content. These accounts may contain personal data that the client collected (for example, customer lists uploaded for advertising, or lead form submissions). We process this data only as the client’s processor, as described in Section 2.

4. Google user data accessed through Google APIs

This section applies when you authorize a Cobra Clicks App to access your Google account through Google’s OAuth consent screen.

4.1 What we access

Depending on the permissions you grant on the Google consent screen, we access:

Basic Google account information (your name, email address and profile picture), if you sign in with Google, to identify you and link the authorization to your account with us.
Google Ads data through the Google Ads API (scope https://www.googleapis.com/auth/adwords): the list of Google Ads accounts you have access to (account IDs, names, currency and time zone); account structure and settings (campaigns, ad groups, ads, assets, keywords, negative keywords, budgets, bidding strategies, targeting, conversion actions and their settings); and performance metrics (for example impressions, clicks, cost, conversions and conversion value).

We do not request access to Gmail, Google Drive, Google Calendar or any Google data that is not needed for the features described below.

4.2 How we use it

We use Google user data only to provide and improve the user-facing features of the Cobra Clicks Apps that you or your organization asked for:

generating performance reports and dashboards for the accounts you connected;
auditing account structure, keywords, search terms, budgets and conversion tracking, and presenting recommendations;
making changes to campaigns (for example adding negative keywords, adjusting budgets or bids, or pausing ads) only when you or your authorized representative instruct or approve them.

4.3 Storage and security

Google user data is transmitted over encrypted connections (HTTPS/TLS) and stored on Verpex servers located in Europe, encrypted at rest. OAuth refresh tokens are stored encrypted and are accessible only to the systems that need them to run the features you requested. Access by our staff is restricted to authorized personnel who need it to provide the service.

4.4 Sharing

We do not sell Google user data. We share it only:

with you and the people in your organization you authorize (for example, through reports);
with our infrastructure providers that host or process data on our behalf, under confidentiality and data protection obligations and only to provide the service;
when required by applicable law, or to protect the security of our services (for example, investigating abuse); or
as part of a merger, acquisition or sale of assets, only after obtaining your explicit prior consent.

4.5 Limited Use disclosure

Cobra Clicks’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we do not use Google user data to serve advertisements (including retargeting, personalized or interest-based advertising), we do not transfer or sell it to advertising platforms, data brokers or information resellers, we do not use it to determine creditworthiness or for lending purposes, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models. Our staff read Google user data only with your permission (for example, when you ask us to review your account), when necessary for security purposes, to comply with applicable law, or when the data is aggregated and used for internal operations.

4.6 Retention, revocation and deletion

We keep Google user data only while your Google account remains connected and you or your organization use our services.
You can revoke our access at any time at https://myaccount.google.com/permissions, or by removing Cobra Clicks’ access in your Google Ads account (Admin > Access and security).
When access is revoked or our engagement ends, we delete the OAuth tokens immediately and delete the Google user data we stored within 30 days, except reports we must keep under a legal obligation or that you asked us to keep.
You can request deletion at any time by following our Data Deletion Instructions or by writing to ads@cobraclicks.com.

5. Meta Platform data accessed through Meta APIs

This section applies when you connect your Facebook account, Meta Business portfolio, Facebook Pages or ad accounts to a Cobra Clicks App through Facebook Login or Meta’s business integrations.

5.1 What we access

Depending on the permissions you grant, which may include ads_read, ads_management, business_management, pages_show_list, pages_read_engagement and read_insights, we access:

your app-scoped Facebook user ID and name, to identify the connection;
the Meta Business portfolios, ad accounts and Pages you choose to connect (IDs, names and settings);
ad account structure and settings (campaigns, ad sets, ads, creatives, budgets, targeting settings, pixels and conversion events) and performance insights (for example reach, impressions, clicks, spend and results);
Page information and aggregated engagement insights for the Pages you connect.

5.2 How we use it

We use Meta Platform data only to provide the services you or your organization requested: reporting, auditing, recommendations and, only when you or your authorized representative instruct or approve it, creating or editing campaigns, ad sets and ads. When we act for a client, we process Meta Platform data on behalf of and at the direction of that client, keep each client’s data separate, and do not use it for our own purposes or for any other client.

5.3 What we do not do

We do not sell, license or purchase Meta Platform data. We do not use it to build or augment user profiles without valid consent, to make eligibility decisions about people (such as housing, employment, insurance or credit), for surveillance, or for any purpose other than those described here and permitted by Meta’s Platform Terms and Developer Policies.

5.4 Storage, sharing and retention

Meta Platform data is stored and secured in the same way as Google user data (Section 4.3). We share it only with you and the people you authorize, with service providers bound in writing to process it only on our behalf, or when required by law. We keep it only while your connection is active and necessary for the service, and delete it within 30 days after you disconnect, ask us to delete it, or our engagement ends, unless the law requires us to keep it.

5.5 How to revoke access and request deletion

Remove the Cobra Clicks App in Facebook at Settings & privacy > Settings > Apps and websites, or remove our access in Meta Business Settings (Business integrations / Partners).
Request deletion by following our Data Deletion Instructions or by writing to ads@cobraclicks.com.

6. Why we use personal data and our legal bases

Purpose	Legal basis (where the law requires one)
Answer your enquiries and send proposals	Steps prior to a contract at your request; our legitimate interest in responding to business enquiries
Provide our services to clients and manage the relationship, billing and support	Performance of a contract
Provide the Cobra Clicks Apps and their Google and Meta integrations	Performance of a contract; your consent given on the Google or Meta authorization screen
Send our newsletter	Your consent (you can unsubscribe at any time)
Website analytics and advertising cookies (Google Analytics, Google Ads, Meta Pixel)	Your consent
Protect our forms and services from spam, fraud and abuse (reCAPTCHA, security logs)	Our legitimate interest in keeping our services secure
Comply with legal, tax and accounting obligations	Legal obligation

Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.

7. Who we share personal data with

We do not sell personal data for money. We share personal data only with:

service providers that act on our behalf, such as website hosting (Verpex, Europe), email (Verpex), analytics and advertising providers (Google, Meta) and spam protection (Google reCAPTCHA);
advertising platforms (Google and Meta) when you accept advertising cookies, so we can measure our campaigns and show you relevant ads;
professional advisers (lawyers, accountants) where necessary;
authorities when required by law; and
a successor entity in a merger, acquisition or sale of assets, subject to this Privacy Policy (and, for Google user data, only with your explicit prior consent).

8. International transfers

We operate across several countries, and our service providers (including Google and Meta) may process data in the United States, the European Union and other countries. When we transfer personal data outside the country where it was collected, we use the safeguards required by applicable law, such as adequacy decisions, the European Commission’s Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the recipient is certified, or your consent where permitted.

9. How long we keep personal data

Enquiries and contact form messages: up to 24 months after our last contact, unless you become a client.
Client data and contracts: for the duration of the relationship and afterwards for the period required by tax, accounting and commercial law.
Newsletter: until you unsubscribe.
Google user data and Meta Platform data: as described in Sections 4.6 and 5.4.
Cookies: for the periods listed in our Cookie Policy.

10. Security

We use appropriate technical and organizational measures to protect personal data, including encrypted connections (HTTPS), access controls based on the principle of least privilege, multi-factor authentication on the accounts we use, and encrypted storage of access tokens. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach when the law requires it.

11. Your rights

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; restrict or object to its processing; receive a copy in a portable format; withdraw consent at any time; and not be subject to decisions based solely on automated processing that significantly affect you. To exercise any right, email info@cobraclicks.com. We may ask you to verify your identity. We respond within the period required by the applicable law (generally within one month). If we process your data as a client’s processor, we will forward your request to that client.

European Union and European Economic Area (GDPR)

If you are in the EU/EEA, the General Data Protection Regulation (EU) 2016/679 applies. You can lodge a complaint with your local data protection authority; in Spain, the Agencia Española de Protección de Datos (www.aepd.es).

Lebanon (Law No. 81 of 2018)

If you are in Lebanon, we process personal data in accordance with Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data, including your rights to be informed, to access and to correct or delete your personal data.

United Arab Emirates (Federal Decree-Law No. 45 of 2021)

If you are in the UAE, we process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), including your rights to obtain information, to request transfer, correction or erasure of your data, and to restrict or stop processing, as provided by that law.

Saudi Arabia (Personal Data Protection Law)

If you are in the Kingdom of Saudi Arabia, we process personal data in accordance with the Personal Data Protection Law issued by Royal Decree No. (M/19) of 9/2/1443H, as amended, and its implementing regulations, including your rights to be informed, to access, to request correction, and to request destruction of your personal data, and to withdraw your consent.

United States (California and other state privacy laws)

If you are a resident of California or another U.S. state with a comprehensive privacy law, and that law applies to us, you have the right to know what personal data we collect, use and disclose; to access, correct and delete it; and to opt out of the “sale” of personal data, the “sharing” of personal data for cross-context behavioral advertising, and targeted advertising. We do not sell personal data for money. Our use of advertising cookies (Google Ads and Meta Pixel) may be considered “sharing” or targeted advertising under these laws; you can opt out by rejecting advertising cookies in our cookie settings or by emailing info@cobraclicks.com. We will not discriminate against you for exercising your rights. You may use an authorized agent to submit a request on your behalf.

The categories of personal data we collect are described in Section 3 (identifiers and contact details, commercial information for clients, internet and network activity, and approximate geolocation). We do not collect sensitive personal data for the purpose of inferring characteristics about you.

12. Children

Our Website and services are intended for businesses and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Third-party websites

The Website links to third-party websites and social networks (for example Facebook, Instagram, LinkedIn, X, YouTube and TikTok). Their own privacy policies apply when you visit them.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date. If we change how we use Google user data or Meta Platform data, we will notify affected users and, where required, ask for their consent before using the data in the new way.

15. Contact us

COBRA CLICKS S.A.R.L (Cobra Clicks)
Section 15, Property No. 1402, Baysour, Mount Lebanon, Lebanon
Email: info@cobraclicks.com · Google Ads and Meta integrations: ads@cobraclicks.com
Phone: (+961) 3700413 / (+34) 647491120

Privacy Policy