Privacy Policy

The data controller responsible for your personal data is:

2.1 Information You Provide Directly

• •Identity data: Full name, display name, professional title, and photograph (if uploaded)
• •Contact data: Email address, phone number, and location (city/country)
• •Account credentials: Password (stored in hashed form) and authentication tokens
• •Business data: Company name, stage, sector, revenue information, team size, and any other business context you provide
• •Decision & operational data: GTM decisions, experiments, outcomes, learnings, and action records you log on the Platform
• •Payment data: Billing name, GST number, and invoice details. Full card or bank account numbers are processed directly by Razorpay and not stored by us
• •Communications: Messages, feedback, support requests, or any content you send to us

2.2 Information Collected Automatically

• •Usage data: Pages visited, features used, actions taken, time spent, click paths, and session duration
• •Device & technical data: IP address, browser type and version, operating system, device identifiers, time zone, and screen resolution
• •Log data: Server access logs, error logs, and Platform event logs
• •Cookies and tracking technologies: As described in Section 10 below

2.3 Information from Third Parties

• •If you authenticate via third-party single sign-on (e.g., Google OAuth), we may receive your name, email, and profile picture from that service
• •Payment processors (Razorpay) may share transaction status and anonymised billing information with us
• •Analytics and infrastructure providers may process technical usage data on our behalf

We process your personal data for the following purposes:

• •Account Creation & Authentication: To register, verify, and maintain your account on the Platform
• •Service Delivery: To provide you with the features, tools, and AI-powered functionalities of the Platform, including decision tracking, action planning, and outcome analysis
• •Trial Management: To manage your free trial period, track eligibility, and communicate about trial expiry and upgrade options
• •Billing & Payments: To process your Subscription payments, generate invoices, manage renewals, and comply with GST and financial record-keeping obligations
• •Customer Support: To respond to your queries, troubleshoot issues, and provide assistance
• •Platform Improvement: To analyse usage patterns, identify bugs, improve AI model performance, and develop new features
• •Communications: To send you service-related notices, product updates, security alerts, and — where you have opted in — marketing communications
• •Legal Compliance: To comply with applicable Indian laws, regulations, and court or regulatory orders
• •Safety & Security: To detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms

Legal bases under Indian law (Information Technology Act, 2000; IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and the Digital Personal Data Protection Act, 2023, upon its notification): your consent; performance of a contract with you; compliance with a legal obligation; and legitimate interests pursued by us or a third party.

In addition to the purposes above, we use your data to:

• •Personalise your experience and surface relevant recommendations through our AI models
• •Conduct aggregate, anonymised analysis and research to improve the Platform's decision feedback capabilities
• •Train and improve AI/ML models, using anonymised and de-identified data only, unless you provide explicit consent for identifiable data use
• •Enforce our Terms & Conditions and other policies
• •Protect the rights, property, and safety of the Company, our users, and the public

We will not sell your personal data to third parties. We will not use your personal data for advertising or marketing purposes by third parties without your explicit consent.

We do not sell, rent, or trade your personal data. We may share your data in the following limited circumstances:

5.1 Service Providers

We engage trusted third-party vendors to support our operations, including cloud hosting and infrastructure providers, Razorpay (payment processing), analytics services, email and communication service providers, and AI/ML infrastructure providers. All service providers are bound by data processing agreements.

5.2 Legal & Regulatory Disclosure

We may disclose your data if required by applicable law, regulation, court order, or governmental authority, or to enforce our legal rights.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, your data may be transferred to the successor entity. You will be notified of any such transfer and your rights therein.

5.4 With Your Consent

We may share your data with third parties when you have explicitly consented to such sharing.

5.5 Aggregated & Anonymised Data

We may share aggregated, anonymised, or de-identified data that cannot reasonably identify you, for research, analytics, or commercial purposes.

• •Active account data: Retained for the duration of your Subscription plus 2 years post-termination for legal and audit purposes
• •Trial data: Retained for 90 days post-trial expiry if you do not convert to a paid plan, after which it is deleted or anonymised
• •Financial and billing records: Retained for 7 years as required under Indian tax and accounting laws
• •Usage logs and analytics: Retained for up to 24 months, after which they are anonymised
• •Support communications: Retained for 3 years from the date of last communication

You may request deletion of your data at any time (see Section 9). We will comply subject to our legal retention obligations.

We implement appropriate technical and organisational measures to protect your personal data. These measures include:

• •Encryption of data in transit using TLS/SSL protocols
• •Encryption of sensitive data at rest
• •Access controls limiting data access to authorised personnel only
• •Regular security assessments and vulnerability testing
• •Incident response procedures for security breaches

In the event of a personal data breach that poses a risk to your rights, we will notify you and relevant authorities as required by applicable law. However, no system can guarantee absolute security.

Nebulaa is primarily operated from India. Your data may be processed or stored on servers located in India or in other jurisdictions where our service providers operate. Where data is transferred outside India, we ensure appropriate safeguards are in place, consistent with applicable Indian data protection law and the requirements of the Digital Personal Data Protection Act, 2023.

Subject to applicable law, you have the following rights with respect to your personal data:

• •Right to Access: Request a copy of the personal data we hold about you
• •Right to Correction: Request correction of inaccurate or incomplete personal data
• •Right to Erasure: Request deletion of your personal data, subject to our legal retention obligations
• •Right to Portability: Request your data in a structured, machine-readable format
• •Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• •Right to Object: Object to processing based on legitimate interests, including for direct marketing
• •Right to Restrict Processing: Request that we limit how we use your data in certain circumstances
• •Right to Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 12)

To exercise any of these rights, please contact us at privacy@nebulaa.ai. We will respond within 30 days.

We use cookies, web beacons, local storage, and similar technologies to enhance your experience, analyse usage, and maintain your session.

Types of cookies we use:

• •Essential cookies: Required for the Platform to function correctly (e.g., session management, authentication)
• •Analytical cookies: Used to understand how users interact with the Platform and improve its features
• •Preference cookies: Used to remember your settings and personalisation choices
• •Marketing cookies: Used only with your prior consent to deliver relevant communications

You can control cookies through your browser settings. By using the Platform, you consent to our use of cookies as described herein.

The Nebulaa Platform is intended for business users and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@nebulaa.ai.

In accordance with the Information Technology Act, 2000 and applicable rules, we have appointed a Grievance Officer to address privacy-related concerns:

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a prominent notice within the Platform and/or sending an email to the address associated with your account. Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000, the IT (SPDI) Rules, 2011, and the Digital Personal Data Protection Act, 2023. Disputes arising under this Policy shall be subject to the jurisdiction of the courts in Chennai, Tamil Nadu, India.