Last updated: July 2026
Your data is a big deal to us — mostly because it's a big deal to you. This page explains what we collect, why we collect it, and what we absolutely never do with it. Spoiler: we're the ones automating your business, not selling your secrets.
My Nebulas ("we," "us," or "our") provides managed business automation and workflow services. Because we build, host, and operate automations on behalf of our clients, we handle certain information belonging to our clients and, in some cases, information that passes through their business systems.
This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. It applies to our website, our services, and any interactions you have with us. By using our services, you agree to the practices described in this policy.
To build and operate your automations, you may provide us with API keys, login credentials, access tokens, and similar technical information for your business systems and third-party platforms. We treat this category of information with the highest level of care — see Section 5 (How We Protect Your Information) for details.
When your workflows run, business data may flow through the systems we host and operate on your behalf — for example, customer records, form submissions, order details, or marketing data. We process this information solely to deliver the services you've engaged us for, and only as directed by you. We do not use it for any other purpose.
When you visit our website, we may automatically collect standard technical information such as your IP address, browser type, device information, pages visited, and referring URLs, typically through cookies and similar technologies. See Section 8 (Cookies) for more.
We use the information we collect to:
We do not sell your personal information. We do not rent it, trade it, or share it with third parties for their own marketing purposes. Full stop.
We work with a number of third-party platforms and tools to deliver our services — for example, cloud hosting providers, automation platforms, payment processors, and communication tools. These providers process information only as needed to perform services on our behalf and are bound by their own contractual and legal obligations to protect it. A current list of our key service providers is available upon request.
Your automations may connect to third-party systems you've chosen — such as your CRM, email platform, or e-commerce tools. When your workflows send data to those systems, that transfer happens at your direction and under your instructions.
We may disclose information if required to do so by law, regulation, legal process, or enforceable governmental request, or where necessary to protect our rights, safety, or property, or that of our clients or others.
If My Nebulas is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.
Security isn't an afterthought for us — it's the foundation of a hosted service model. We implement administrative, technical, and physical safeguards designed to protect your information, including:
That said, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your information, we will notify you promptly and in accordance with applicable law.
Some of our automations connect to Google services (such as Gmail, Google Calendar, and Google Analytics) with your explicit authorization via Google OAuth. My Nebulas' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Specifically: we only use Google user data to provide and improve the automation features you have requested (such as creating email drafts or adding calendar events); we do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice; we do not use Google user data for advertising; and no humans read your Google data except with your explicit permission for support purposes, where required for security or legal compliance, or where the data has been aggregated and anonymized. You can revoke our access to your Google account at any time via your Google Account permissions page, and upon service termination we delete stored Google credentials as described in Section 7.
We retain your information for as long as your account is active or as needed to provide services. When your engagement with us ends, we deactivate your workflows and delete or securely destroy your credentials, API keys, and access tokens within a reasonable period, unless we are required to retain certain information for legal, tax, or accounting purposes.
Business data that flowed through your automations is not retained beyond what is operationally necessary to run your workflows, unless otherwise agreed with you.
Depending on where you live, you may have certain rights regarding your personal information, which may include the right to:
Residents of certain U.S. states (such as California) may have additional rights under applicable state privacy laws, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. As noted above, we do not sell personal information. To exercise any of these rights, contact us using the details in Section 12 — we'll respond as required by applicable law, and we will never discriminate against you for exercising your privacy rights.
Our website may use cookies and similar technologies to keep the site functioning properly, remember your preferences, and understand how visitors use our site. You can control or disable cookies through your browser settings, though some features of the site may not function properly without them.
Our services are designed for businesses and are not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we'll post the updated version on this page with a revised effective date. For significant changes, we'll make reasonable efforts to notify active clients directly. Continued use of our services after changes are posted means you've accepted the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your information, please contact My Nebulas via our contact page. We're always happy to chat.
