Early access is open
Cobundle

Privacy notice for buyers

Version 1.0 · 10 November 2026

You are reading this because a website showed you an offer of free months "via Cobundle". This notice explains what happens to your data, before and after you click Claim, and what rights you have under the EU General Data Protection Regulation (GDPR). It applies wherever you live.

Who is responsible

  • Cobundle is a service of Gabriel Beslic, trading as Beslic Labs, Homburger Landstrasse 455, 60433 Frankfurt am Main, Germany. Email: info@cobundle.io.
  • The website where you saw the offer (the "host") and Cobundle are jointly responsible for collecting your details through the offer box (Art. 26 GDPR). They have agreed that Cobundle provides the offer box, informs you, records your consent and answers your requests, and that the host makes sure it may pass your details into the box and mentions Cobundle in its own privacy policy. You can contact either of them, and they will make sure your request is handled.
  • The sponsor named in the offer becomes responsible for your details once Cobundle shares them, under the sponsor's own privacy policy.

Before you click Claim

The host places your email address, and sometimes your name, company and the plan you are buying, into the offer box on its page. These details stay on that page.

To show an offer, your browser asks Cobundle for one. Like any web request, this reveals your IP address and browser details to Cobundle's hosting provider, which keeps them in technical logs only for a short time. Cobundle doesn't store them. Cobundle counts that an offer was shown, without any details about you. The offer box stores nothing on your device: no cookies and no local storage.

Legal basis: the legitimate interest of the host and Cobundle in showing you the offer (Art. 6 (1) (f) GDPR).

You don't have to claim anything. If you don't, nothing is shared, and your purchase with the host isn't affected.

When you click Claim

Cobundle receives and stores:

  • your email address;
  • your name, company and plan, if the line next to the Claim button named them;
  • which website and which spot on it showed the offer, and which offer it was; and
  • the time and the exact text you saw next to the button.

Cobundle shares your email address, and the other details the line named, with the sponsor, together with which website and which spot on it showed the offer, and when, so the sponsor can contact you to set up your free months. Unless you undo the claim within a few seconds, Cobundle then sends you a confirmation email. The sponsor pays Cobundle for each claim.

Legal basis: your consent (Art. 6 (1) (a) GDPR), which you give by clicking Claim.

The sponsor may use your details only to contact you about the offer you claimed and to give you the free months. It may send you other emails, such as marketing, only if you agree to that with the sponsor separately.

Changing your mind

You can withdraw your consent at any time, as easily as you gave it: click Undo on the page, use the Withdraw link in your confirmation email, or write to info@cobundle.io.

Cobundle then hides your details from the sponsor and, if the sponsor already knew about your claim, tells it to stop contacting you about the offer. The sponsor must delete the details it received for your claim within 30 days, unless you have become its customer in the meantime. Withdrawing doesn't make the sharing before it unlawful.

What Cobundle keeps, and for how long

  • Your claim, with the details listed above and, if you withdrew, the time of your withdrawal: 3 years from the claim, then deleted automatically. Cobundle keeps this record, including after a withdrawal, to prove that it had your consent and acted on your withdrawal, and to settle claims with the sponsor. Legal basis: Cobundle's legal duty to be able to prove consent (Art. 6 (1) (c) with Art. 7 (1) GDPR), and its legitimate interest in defending legal claims and billing sponsors correctly (Art. 6 (1) (f) GDPR).
  • The charge to the sponsor for your claim: kept for 8 years under German tax law (Art. 6 (1) (c) GDPR), but without your details once your claim is deleted.
  • The confirmation email is sent through Cobundle's email provider, Brevo, which deletes its copy after 30 days. Legal basis: Cobundle's legitimate interest in telling you what you shared and how to withdraw (Art. 6 (1) (f) GDPR).

The sponsor keeps your details under its own privacy policy.

Who receives your data

  • The sponsor named in the offer.
  • Cobundle's service providers, which process data only on Cobundle's instructions under data processing agreements: Supabase (database, stored in Frankfurt, Germany), Vercel (hosting, server code run in Frankfurt) and Brevo (emails, EU).
  • The host doesn't receive your details from Cobundle. It only sees how often offers were shown and claimed.

Transfers outside the EU

  • Service providers. Supabase stores Cobundle's database in Frankfurt; Supabase Pte. Ltd. (Singapore) and its group companies can access it to run the service. Vercel Inc. (USA) runs Cobundle's server code in Frankfurt; its logs and support can involve the USA. Transfers to Vercel rely on the EU-US Data Privacy Framework (Art. 45 GDPR) and standard contractual clauses; transfers to Supabase rely on standard contractual clauses (Art. 46 (2) (c) GDPR).
  • Sponsors. If the sponsor is established outside the European Economic Area, sharing your details with it is a transfer to that country. It relies on an adequacy decision of the European Commission (for example for the UK, Switzerland, or US companies certified under the EU-US Data Privacy Framework), or on the standard contractual clauses that are part of Cobundle's terms with every sponsor. You can ask for a copy at info@cobundle.io.

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its use restricted (Art. 18), and to receive it in a portable format (Art. 20). You can withdraw your consent at any time (Art. 7 (3)).

Right to object (Art. 21 GDPR). Where Cobundle relies on legitimate interest, you can object at any time on grounds relating to your particular situation. Cobundle then stops, unless it has compelling legitimate grounds or needs the data to establish, exercise or defend legal claims.

To use any of these rights, write to info@cobundle.io. You can also complain to a data protection authority (Art. 77 GDPR), for example where you live or work. The authority responsible for Cobundle is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Wilhelmstraße 7, 65185 Wiesbaden, Germany.

No automated decisions

Which offer you see is picked at random from the offers that can show on that page. Cobundle doesn't use your details to choose it and doesn't profile you.

Children

Offers through Cobundle are not meant for children under 16.

Reporting an offer

If you believe an offer is illegal, write to info@cobundle.io with the sponsor's name, where you saw the offer, why you believe it is illegal, your name and email address, and a statement that you believe in good faith that your report is accurate and complete. Cobundle confirms receipt and tells you what it decided.

Changes

When this notice changes, the new version gets a new number and address, and the old versions stay online.