Privacy Policy
Last updated: May 7, 2026
Nebulagent, Inc. ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit nebulagent.com or use our services.
1. Information We Collect
Information you provide:
- Account information (name, email, company name, hashed password)
- Payment information (processed by Stripe; we do not store full credit card numbers)
- Communications you send us (support tickets, feedback)
- User content (workflows, prompts, configurations)
Information collected automatically:
- Usage data (pages visited, features used, timestamps)
- Device data (browser type, operating system, IP address)
- Cookies and similar technologies
Information from third parties:
- OAuth data when you connect a third-party service (Google Workspace, etc.), including email address, basic profile information, and the specific data scopes you authorize (such as calendar events or email metadata).
2. How We Use Your Information
We use your information to:
- Provide, operate, and maintain the Service.
- Process transactions and send transactional emails.
- Respond to inquiries and provide customer support.
- Improve the Service through analytics and product research.
- Detect and prevent fraud, abuse, and security incidents.
- Comply with legal obligations.
We do not:
- Sell your personal information.
- Use your Google Workspace data for advertising.
- Use your Google Workspace data to train AI models.
- Share your data with third parties except as described in this policy.
3. Google API Services User Data Policy
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use Google user data only to provide the Service you requested.
- We do not transfer Google user data to third parties except as necessary to provide the Service, comply with law, or as part of a merger or acquisition.
- We do not use Google user data for advertising.
- We do not allow humans to read Google user data unless we have your specific consent, it is necessary for security, or it is required by law.
4. How We Share Your Information
We share information only in these circumstances:
Service providers (sub-processors):
- Anthropic — AI model provider
- Vercel — hosting and infrastructure
- Neon — database hosting
- Clerk — authentication
- Stripe — payment processing
- PostHog or Vercel Analytics — product analytics
- Resend or SendGrid — transactional email delivery
Each is bound by data protection terms.
Legal requirements: We may disclose information if required by law, court order, or to protect rights, property, or safety.
Business transfers: If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information is transferred.
With your consent: We may share information with third parties when you explicitly direct us to.
5. Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. After account deletion:
- Account data is deleted within 30 days.
- Anonymized usage data may be retained for analytics.
- Certain data is retained longer when required by law.
You can request deletion at any time by contacting privacy@nebulagent.com.
6. Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your information (subject to legal retention requirements).
- Export your data in a portable format.
- Opt out of marketing communications.
- Object to certain processing.
- Withdraw consent previously given.
California residents (CCPA): You have additional rights including the right to know what categories of personal information we collect, the right to delete, and the right to opt out of "sales" (we do not sell your data).
EU/UK residents (GDPR): You have additional rights including access, rectification, erasure, restriction, portability, and objection. Lawful bases for processing include contract performance, legitimate interests, and consent.
To exercise any rights, contact us at privacy@nebulagent.com. We will respond within 30 days.
7. Data Security
We implement industry-standard security measures, including:
- Encryption of data in transit (TLS 1.2+) and at rest.
- OAuth tokens encrypted with AES-256.
- Access controls and authentication.
- Regular security reviews.
- Incident response procedures.
Despite our efforts, no system is completely secure. You are responsible for maintaining the security of your account credentials. If we detect a data breach affecting your personal information, we will notify you and applicable regulators as required by law.
8. International Data Transfers
Your information may be processed and stored in the United States and other countries where our service providers operate. By using the Service, you consent to these transfers, subject to appropriate safeguards (such as Standard Contractual Clauses for EU/UK transfers).
9. Children's Privacy
The Service is not intended for individuals under 18. We do not knowingly collect data from minors. If you believe we have collected such data, contact us at privacy@nebulagent.com.
10. Cookies and Tracking
We use cookies and similar technologies for:
- Essential cookies — required for authentication and core functionality.
- Analytics cookies — to understand product usage.
- No advertising cookies — we do not run ads or use advertising trackers.
You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from working.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Continued use of the Service after changes constitutes acceptance.
12. Contact
For questions or concerns about privacy, contact us at:
- Privacy inquiries: privacy@nebulagent.com
- General inquiries: hello@nebulagent.com
For unresolved concerns, EU residents may contact their local data protection authority. UK residents may contact the Information Commissioner's Office.