Privacy policy

Publicidad Insights · COGITIA S.L. Last updated: 4 October 2026. Versión en español.

Who is responsible

COGITIA S.L., Tax ID B22573976, C/ Diputació 205, local 2, 08011 Barcelona, Spain. Contact: privacy@cogitialabs.com. Telephone: +34 621 341 118.

Cogitia is responsible for panel-user access and service administration. A client business is responsible for its own contacts' data. Cogitia processes that data only on the business's instructions, under its data-processing agreement. This account-testing environment must not be used for real patient information or other sensitive personal data.

What we process and why

• Panel access: user name, email, business/workspace and a password hash, to provide private access and administer the service. The service does not store your password in plain text.
• Account connection: the professional account and Page or phone-number identifiers you choose, names, granted access and access credentials. The connector stores Meta tokens encrypted. Authorization codes are used for the connection and are not retained in panel logs.
• Enabled social functions: messages, sender identifiers, attachments, delivery status, posts, comments, replies, submitted WhatsApp templates and publications. These are used to display the information and perform the actions your business requests. Social history lives in the connector; the panel does not create a separate archive of it.
• Security: temporary login-attempt counters, session cookies and short-lived account-connection records, to authenticate users, limit password guessing and protect authorization flows.

We do not sell this information, use it for our own advertising or use information obtained from Meta to train AI models. We do not make automated decisions about the people who contact your business. Insights, advertisements and lead-form collection are not enabled in this release.

The basis for panel access is the service relationship with the business. Security controls serve our legitimate interest in protecting access. The business determines the lawful basis for its contacts' information. Requests and legal duties are handled under the applicable law.

Providers and location

The panel is hosted on Oracle Cloud Infrastructure in Madrid, Spain. Cloudflare provides the public connection, traffic protection and domain services. The relevant platform, such as Meta, receives the authorization and the messages or content you ask us to send to it.

Platform and network providers may process information outside the European Economic Area under their applicable terms and transfer mechanisms. See Cloudflare's privacy policy and Meta's privacy policy. Do not connect real sensitive contact data in this testing environment. Any live-client rollout requires agreed processing instructions, provider safeguards and an appropriate data-processing agreement.

Retention

Panel access information is kept while the account is active, until it is removed or a verified request is resolved. Standard login sessions expire after eight hours. A hosted connection session and its authorization attempt expire after ten minutes; expired connection records and login counters are removed by the service's maintenance.

Removing a connection deletes its local token. It does not automatically delete the connector's social history or copies in its event-delivery queue. Social history remains until a verified manual deletion is carried out. The connector normally clears delivered event copies after seven days and exhausted event copies after thirty days. Account owners can request deletion at any time. There is no additional panel analytics archive. Information required for a legal obligation is kept only for that obligation; the applicable records and period are explained when relevant.

Your choices and rights

You choose which business accounts to authorize and can revoke access in the relevant platform. Read our data-deletion instructions before disconnecting if you also want stored information deleted. Automatic platform deletion callbacks are not active in this release; email is the working deletion-request route.

You can request access, correction, deletion, restriction, objection or portability where applicable by emailing privacy@cogitialabs.com. We may ask for enough information to verify your identity and account ownership. We respond within the applicable legal period, normally one month. If you are a contact of a business, that business controls its data; we will help route the request to it. You can complain to the Spanish Data Protection Agency.

Cookies and security

We use necessary, HttpOnly session cookies to keep your session and a short-lived connection session. We do not install advertising or analytics cookies. Facebook's SDK is loaded only when you choose WhatsApp signup; Meta may use its own cookies during authorization.

The service uses HTTPS, signed sessions, per-workspace access and server-held connector keys. The connector encrypts access tokens and verifies Meta notification signatures. Security does not remove the need to keep account credentials private and use only authorized test accounts.

This service is for businesses, professionals and their authorized adult staff. Material changes are identified by an updated date and communicated through the service when relevant.