0. Status
This is a drafted document, not legal advice, and it has not been reviewed by a qualified lawyer.
It describes what the software actually does today, including the places where it does less than a privacy policy usually promises. Those are marked Gap and tracked in the project book, chapter 13. Do not remove a Gap note by editing this document — remove it by building the thing.
1. The two roles, and why the distinction matters
This Service handles personal data in two different capacities, and your rights differ depending on which one applies.
| We are the... | Covering | |
|---|---|---|
| Your account | Controller — we decide why and how it is processed | Your name, email, password hash, plan, credits, mailbox settings, brand assets, usage and audit logs |
| Your prospects | Processor — our customer decides; we act on their instruction | Business names, addresses, owner names, emails, phone numbers, website audit results, outreach history, reply extracts |
If you are a business that was contacted through Nebulora and want your data removed, the controller is the Nebulora customer who contacted you — not us. Section 11 explains how to reach a resolution either way.
2. What we collect
From you, as an account holder
- Identity and account — name, email address, password (stored as a bcrypt hash), role, plan, credit balances, avatar image if you upload one.
- Mailbox configuration — SMTP and IMAP host, port and username, and the mailbox password, encrypted with AES-256-GCM. The same stored password is used for both sending and reading; a second copy would be a second thing to leak.
- Brand assets — the name, logo, colour, website, email and phone you put on your reports.
- Billing — plan state, credit purchases and upgrade requests. No card details. No payment processor is live; upgrades are approved manually.
- Usage — logins, last-seen time, activity and administrative audit records.
- One-time codes — for activation and password reset, stored only as a SHA-256 hash with an expiry and an attempt counter.
About your prospects, on your instruction
- Business details — name, address, city, niche, phone, email, website, Google Maps rating and listing link, Instagram handle, LinkedIn company page, approximate size.
- Owner or contact name, where a connector or your own import supplies one.
- Website audit results — the grade, the findings, and the competitor benchmark.
- Outreach history — what was sent, on which channel, when, and the RFC 5322 Message-ID that lets a reply be threaded back to it.
- Reply extracts — the sender, subject, timestamp, a classification, and a short extract of the reply body with quoted history stripped. We do not store the full message; it stays in your mailbox.
- Opt-out state — when someone asked not to be contacted, and why.
- Demo Site view counts — how many times a generated page was opened, and when.
From visitors to your embedded widget
If you place the checker widget on your website, then for each visitor who uses it we process the URL they asked us to scan, the resulting report, and their IP address. The IP is used for rate limiting and is stored alongside the scan record. If the visitor submits their email address to see the full result, that email becomes a lead in your workspace.
You must tell your website's visitors that this happens. We do not surface a notice on your behalf.
3. Where it comes from
Directly from you; from your mailbox when you enable reply capture; from visitors to your embedded widget; and from third-party data sources — Google Places, OpenStreetMap, Apify (Maps, LinkedIn, Instagram scrapers), Apollo.io — plus the public web pages the audit engine fetches.
Personal data obtained from public sources is still personal data. Public availability is not by itself a lawful basis for contacting someone.
4. Why we process it, and on what basis
| Purpose | Basis (GDPR framing) |
|---|---|
| Creating and running your account | Performance of a contract |
| Taking payment and preventing abuse | Contract; legitimate interests |
| Sending outreach you compose, from your mailbox | Contract (with you). For the recipient, the basis is yours to establish |
| Reading your mailbox to capture replies | Contract; your explicit instruction, revocable by disconnecting |
| Security, rate limiting, audit logging | Legitimate interests; legal obligation |
| Product improvement and support | Legitimate interests |
We do not sell personal data, and we do not use it to train models. Text is sent to our language-model provider only to draft copy or classify a reply, per section 6.
5. Automated decisions and AI
Two processes are automated:
- Reply classification. Headers are read deterministically first; only genuine human prose reaches the language model, which returns a single label. This changes a lead's status in your CRM. It has no legal or similarly significant effect on the sender, and a human can always override it.
- Website grading. Automated measurement of a public page. It produces an opinion about a website, not about a person.
Generated copy is a draft for you to review. It is not a decision about anyone.
6. Who we share it with
We use the following subprocessors. Each receives only what its function requires.
| Subprocessor | Function | Data reaching it |
|---|---|---|
| Vercel | Application hosting (region sin1, Singapore) | All request traffic |
| Neon | PostgreSQL database | All stored data |
| Google Maps Platform | Business discovery, competitor benchmark | Search terms; no customer personal data |
| Apify | Maps, LinkedIn and Instagram scrapers | Search terms |
| Apollo.io | B2B company data | Search terms |
| NVIDIA (NIM) | Drafting copy, classifying replies | Prospect business details; reply extracts |
| Vapi.ai | AI voice calls | Prospect name and phone number |
| Cal.com | Meeting booking | Booking details |
| Razorpay | Payments | Receives your name, email and payment details when you upgrade |
| Your own SMTP/IMAP provider | Sending and reading your mail | Your credentials and messages |
We also disclose data where the law requires it, and to professional advisers under confidentiality.
7. Where your data lives, and transfers
The application runs in Vercel's Singapore region (sin1). The database is hosted by Neon. Subprocessors above operate in other countries, including the United States.
If you are in the EU, the UK or another jurisdiction restricting international transfers, your data will be transferred outside it.
Gap. We do not currently have Standard Contractual Clauses or an equivalent transfer mechanism in place with every subprocessor, and we do not currently offer customers a Data Processing Agreement. If you process EU or UK personal data through the Service, ask us before you do.
8. How we protect it
- Passwords hashed with bcrypt; mailbox passwords encrypted with AES-256-GCM; one-time codes stored only as SHA-256 hashes.
- Sessions in a signed JWT (
webai_session) in an httpOnly,SameSite=Laxcookie, markedSecurein production, expiring after 7 days. - Every lead carries an owner. Every read is scoped to it. There is no shared-workspace mode, so one customer cannot see another's leads.
- Every server-side fetch of a user-supplied address goes through an SSRF guard: protocol allowlist, DNS checked against private ranges, every redirect hop re-validated, and a 2 MB read cap.
- Rate limits are stored in the database rather than in memory, so they hold across serverless instances.
- Administrative actions are logged to a reversible audit trail.
Gap. One encryption key protects every stored mailbox password. Compromise of that key compromises every connected mailbox at once. Per-tenant keys or a managed KMS would contain the blast radius.
No system is perfectly secure. We do not currently operate a formal breach-notification procedure with defined timelines; India's DPDP Act and the GDPR both require prompt notification, and this must be established before commercial launch.
9. How long we keep it
- Account data — for the life of the account.
- Prospect data, outreach history, reply extracts, audit results — until you delete them, or the account is deleted.
- Opt-out records — kept after a lead is otherwise removed, because forgetting that someone opted out is how you contact them again by accident.
- Backups — a gzip snapshot is written every three days and stored in the database.
- One-time codes — expire quickly and are stored hashed.
Gap. There is no automated retention limit and no purge job. Data is kept until someone deletes it, and backups accumulate rather than ageing out. A defined retention schedule is required for a real privacy programme and is tracked in the gap register.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, to portability, and to withdraw consent. Under India's DPDP Act you also have rights to nomination and to grievance redressal; under the UAE PDPL and the GDPR/UK GDPR, the equivalents.
You can already, in the app: view and edit your profile and brand, disconnect your mailbox, change your password, and delete individual leads. An administrator can reset a workspace, and that reset is logged and restorable.
Gap. There is no self-service account deletion and no data export. Erasure and portability requests are handled manually by us, by email. Both should be in-product, and both are in the gap register.
To exercise a right, contact us at the address in section 12. We will respond within the period the applicable law requires.
11. If you were contacted through Nebulora
If you received outreach and want it to stop:
- Use the unsubscribe link at the bottom of the email. Every outreach email sent through the Service carries one, and it takes one confirmation.
- Or use your mail client's unsubscribe button. The messages carry
List-UnsubscribeandList-Unsubscribe-Postheaders, so the button Gmail, Outlook and Apple Mail show at the top of a message works and needs no visit to our site. - Or reply and say so. A reply asking to stop is detected and recorded.
- Or contact us, and we will identify the customer responsible and require them to act.
All four routes set the same flag, and every outreach route in the Service refuses a lead carrying it. That refusal is enforced in the API, not merely in the interface, so it stops automated sequences and bulk actions too.
Why the link asks you to confirm. Corporate mail filters and link scanners follow every URL in an incoming message. An unsubscribe that acted on being fetched would remove people who never clicked anything, so the link opens a page with a single button. Your mail client's own unsubscribe button does not need the extra step.
The customer who contacted you is the controller of their data about you. We will always help you reach them, and we will act ourselves where the law places the duty on us.
12. Cookies
We set one cookie: webai_session, the httpOnly session cookie described in section 8. It is strictly necessary to keep you signed in.
We use no analytics, advertising, or third-party tracking cookies. There is no tracking pixel in the application, and no consent banner is required for what we set.
Demo Sites count views. That count is stored server-side against the page, not in a cookie on the viewer's device, and it is not tied to an identified individual.
13. Children
The Service is for business use by adults. It is not directed at children and we do not knowingly collect their data. If you believe a child's data has reached us, contact us and we will delete it.
14. Changes
We will update this policy as the product changes — in particular, as the gaps above are closed. Material changes will be notified in the app or by email.
15. Contact
NebulaForge Team — nebulaforge.dev Written and maintained by VamsiKrishna & the NebulaForge Team.
Data-protection requests and grievances: use the contact address published on the website. A named grievance officer is required under India's DPDP Act 2023 and must be appointed before commercial launch.