Privacy Policy

1. Who we are

Nebula Cloud Studio ("NCS", "we", "us") operates the engineering execution platform available at nebulacloud.studio. We are committed to protecting the personal data of everyone who uses our platform, applies to the Founding Cohort, or interacts with our services.

2. What data we collect

• Account data: Name, work email address, company name, role, and domain of interest — collected when you apply for access or create an account.
• Usage data: Workflow submissions, execution logs, artifact metadata, feature usage, and session analytics — collected automatically when you use the platform.
• Engineering inputs: Prompts, parameters, and files you submit to the execution engine. These are processed to run your workflow and are not used to train any model.
• Communications: Any email, support request, or form submission you send to us.
• Technical data: IP address, browser type, operating system, referring URL, and device identifiers — collected via standard server logs and first-party analytics.

3. How we use your data

• To operate, maintain, and improve the Nebula Cloud Studio platform
• To process your application and manage your account
• To send you transactional communications (access confirmations, execution results, billing)
• To send you platform updates and product announcements (opt-out available at any time)
• To monitor for abuse, enforce our Terms of Service, and maintain platform security
• To comply with legal obligations

We do not sell your personal data. We do not use your engineering inputs or execution data to train AI models — not ours, not third parties'.

4. Data storage and security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Execution environments are ephemeral and tenant-isolated at the kernel level. We maintain comprehensive access logs and conduct regular security reviews. Enterprise customers may elect private or VPC deployment with full data residency control.

5. Data retention

Account data is retained for the duration of your account and for 90 days following account closure. Execution logs and artifact metadata are retained for 12 months on standard plans and per contractual agreement on Enterprise plans. You may request deletion at any time (see Section 8).

6. Third-party processors

We use a limited number of sub-processors to operate the platform (cloud infrastructure, payment processing, transactional email). All sub-processors are contractually bound to process data only on our instructions and maintain equivalent data protection standards. A full sub-processor list is available on request.

7. Cookies and tracking

We use strictly necessary cookies for session management and first-party analytics cookies to understand platform usage. We do not use third-party advertising cookies or cross-site tracking. You may disable non-essential cookies in your browser settings without affecting core platform functionality.

8. Your rights

Depending on your jurisdiction, you have the right to access, correct, delete, or port your personal data; to restrict or object to processing; and to withdraw consent. To exercise any of these rights, contact us at the address below. We respond within 30 days.

9. International transfers

Our default infrastructure is hosted in EU / US regions. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses as the legal mechanism. Enterprise customers may restrict processing to a specific region.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered users at least 14 days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.