Privacy Policy

Last updated: August 8, 2026

This Privacy Policy explains how Cobra Clouds Ecom LTD ("we," "us," "our") collects, uses, and protects your personal data when you use the ARENA website and platform (the "Service").

Data controller: Cobra Clouds Ecom LTD 71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom Company No. 16846181 Phone: +41 78 311 67 96

1. What Data We Collect

Account data. When you sign up, we collect your email address, password (stored in encrypted/hashed form, never in plain text), and any display name or profile information you choose to provide.

Payment data. When you subscribe, payment is processed by Stripe, Inc. We do not receive or store your full card number. We retain limited billing metadata (such as your subscription status, plan, and billing history) necessary to manage your account.

Usage & progress data. We collect data about your activity on the Service: lessons completed, quiz results, streaks, achievements, and time spent — so we can deliver the progressive-unlock system and track your learning progress.

Community data. If you post in community channels, we store the content of your messages and associate them with your account.

Technical data. We automatically collect certain technical information, such as your IP address, browser type, device information, and general usage logs, for security, troubleshooting, and service-improvement purposes.

2. How We Use Your Data

We use your data to:

Create and manage your account and subscription;
Process payments and billing through Stripe;
Deliver course content and track your learning progress;
Enforce the progressive-unlock and access-control system;
Communicate with you about your account, billing, or the Service (including onboarding, reminders, and support);
Improve and maintain the Service, including troubleshooting and security monitoring;
Comply with legal obligations.

We do not sell your personal data to third parties.

3. Legal Basis for Processing (UK/EU GDPR)

Where applicable, we process your data on the following legal bases:

Contract — processing necessary to provide the Service you subscribed to;
Legitimate interests — improving and securing the Service, preventing fraud;
Consent — for optional communications you can opt out of at any time;
Legal obligation — where we must retain data to comply with tax, accounting, or other legal requirements.

4. Third-Party Processors

We share limited data with trusted third-party service providers who process it on our behalf, strictly to operate the Service:

Stripe, Inc. — payment processing and subscription billing;
Supabase Inc. — database hosting, authentication, and secure data storage;
Video hosting provider(s) — delivery of course video content (as the platform grows).

These providers are contractually bound to protect your data and use it only for the purposes we specify. We do not permit them to use your data for their own marketing purposes.

5. International Data Transfers

Our service providers may process data in countries outside the United Kingdom or European Economic Area, including the United States. Where this occurs, we rely on appropriate safeguards recognized under UK/EU data protection law, such as Standard Contractual Clauses, to ensure your data remains protected.

6. Data Retention

We retain your personal data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. If you request account deletion, we will delete or anonymize your personal data, except where retention is required by law (for example, billing records).

7. Your Rights

Depending on your location, you may have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete data;
Delete your personal data ("right to be forgotten"), subject to legal retention requirements;
Restrict or object to certain processing;
Port your data to another service in a structured, machine-readable format;
Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us using the details below. We will respond within the timeframe required by applicable law.

If you are located in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office — ico.org.uk).

8. Cookies

We use cookies and similar technologies necessary to operate the Service (for example, to keep you logged in and maintain your session). We do not use cookies for third-party advertising. Where non-essential cookies are used in the future (e.g., analytics), we will request your consent in accordance with applicable law.

9. Data Security

We implement technical and organizational measures to protect your data, including encryption in transit, access controls, and row-level security on our database. No system is completely secure, but we work to protect your data using industry-standard practices.

10. Children's Privacy

The Service is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, by email or a notice within the Service) before the changes take effect.

12. Contact Us

For any questions about this Privacy Policy or to exercise your data rights, contact us at:

Cobra Clouds Ecom LTD 71-75, Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom Company No. 16846181 Phone: +41 78 311 67 96

This document is a general template and does not constitute legal advice. We recommend having it reviewed by a qualified lawyer familiar with UK GDPR, EU GDPR (if you serve EU customers), and any other data protection laws applicable to where your customers are located.

Home Terms of Service