Last updated: August 2026
Your data is a big deal to us — mostly because it's a big deal to you. This page explains what we collect, why we collect it, and what we absolutely never do with it. Spoiler: we're the ones automating your business, not selling your secrets.
My Nebulas ("we," "us," or "our") provides managed business automation and workflow services. Because we build, host, and operate automations on behalf of our clients, we handle certain information belonging to our clients and, in some cases, information that passes through their business systems.
This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. It applies to our website, our services, and any interactions you have with us. By using our services, you agree to the practices described in this policy.
To build and operate your automations, you may provide us with API keys, login credentials, access tokens, and similar technical information for your business systems and third-party platforms. We treat this category of information with the highest level of care — see Section 5 (How We Protect Your Information) for details.
When your workflows run, business data may flow through the systems we host and operate on your behalf — for example, customer records, form submissions, order details, or marketing data. We process this information solely to deliver the services you've engaged us for, and only as directed by you. We do not use it for any other purpose.
Some clients connect their own CRM, such as Pipedrive. Others choose the MyNebulas-hosted CRM — Frappe CRM, open-source software that we host and maintain for them rather than software we wrote. If you choose the hosted option, the customer records, contacts, deals, notes, and activity your team enters into that CRM are stored on infrastructure we operate, in a database dedicated to your business and kept separate from other clients'.
This is a more significant custody arrangement than an automation that passes data through and forgets it, so we describe it specifically in Section 5.1 (administrative access) and Section 8 (retention, including what happens to backups when you delete something). If you would rather we not hold your customer database at all, connecting your own CRM is a fully supported path and the right choice for some businesses.
When you visit our website, we may automatically collect standard technical information such as your IP address, browser type, device information, pages visited, and referring URLs, typically through cookies and similar technologies. See Section 10 (Cookies) for more.
We use the information we collect to:
We do not sell your personal information. We do not rent it, trade it, or share it with third parties for their own marketing purposes. Full stop.
We work with a number of third-party platforms and tools to deliver our services — for example, cloud hosting providers, automation platforms, payment processors, and communication tools. These providers process information only as needed to perform services on our behalf and are bound by their own contractual and legal obligations to protect it. A current list of our key service providers is available upon request.
Your automations may connect to third-party systems you've chosen — such as your CRM, email platform, or e-commerce tools. When your workflows send data to those systems, that transfer happens at your direction and under your instructions.
We may disclose information if required to do so by law, regulation, legal process, or enforceable governmental request, or where necessary to protect our rights, safety, or property, or that of our clients or others.
If My Nebulas is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.
Security isn't an afterthought for us — it's the foundation of a hosted service model. We implement administrative, technical, and physical safeguards designed to protect your information, including:
That said, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your information, we will notify you promptly and in accordance with applicable law.
If you use the MyNebulas-hosted CRM, we want to be direct about the access we hold, because it is the kind of thing you should hear from us rather than discover on your own.
Every MyNebulas-hosted CRM carries a MyNebulas administrative account, and that account cannot be removed. It is a built-in account of the underlying CRM software, which does not permit it to be deleted or disabled by anyone, including us. We use it only for support and recovery — restoring a site, diagnosing a fault, or applying an update.
We would rather state the wider truth than let the paragraph above imply something narrower than reality. MyNebulas operates the server, the database, and the backups behind your hosted CRM. That — not the existence of any one account — is what gives us the technical ability to reach your data, and it is inherent to any hosted service from any provider. Removing the account would not change it. What we commit to is that this access is used only to run and support the service you have engaged us for, is limited to those who need it, and is never used to read your business data for any other purpose.
Some of our automations connect to Google services (such as Gmail, Google Calendar, and Google Analytics) with your explicit authorization via Google OAuth. My Nebulas' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Specifically: we only use Google user data to provide and improve the automation features you have requested (such as sending invoices and payment confirmations from your own connected Gmail account, adding calendar events for bookings, and retrieving your own Google Analytics data for reporting); we do not transfer Google user data to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice; we do not use Google user data for advertising; and no humans read your Google data except with your explicit permission for support purposes, where required for security or legal compliance, or where the data has been aggregated and anonymized. You can revoke our access to your Google account at any time via your Google Account permissions page, and upon service termination we delete stored Google credentials as described in Section 8.
If you provide a mobile phone number, we may send you account-related text messages — such as approval confirmations, setup reminders, invoice status updates, and, during active onboarding, brief messages from our team coordinating your setup. Message frequency varies based on your account activity and is never a fixed recurring schedule. Message and data rates may apply depending on your mobile carrier and plan.
We do not sell, rent, or share your mobile phone number with third parties for their own marketing purposes. Your number is used solely to communicate with you about your own MyNebulas account. You may opt out of text messages at any time by replying STOP to any message; you may reply HELP for assistance. Opting out of text messages does not affect your ability to use MyNebulas' services, which remain available via email.
We retain your information for as long as your account is active or as needed to provide services. When your engagement with us ends, we deactivate your workflows and delete or securely destroy your credentials, API keys, and access tokens within a reasonable period, unless we are required to retain certain information for legal, tax, or accounting purposes.
Business data that flowed through your automations is not retained beyond what is operationally necessary to run your workflows, unless otherwise agreed with you.
Data in a hosted CRM works differently, and the sentence above should not be read as covering it. A CRM is a system of record rather than a pipeline — what you put into it is stored deliberately, for as long as your service is active. We also back your CRM up nightly to encrypted off-site storage, on a rolling schedule of roughly seven daily, four weekly, and six monthly copies. This means a record you delete in your CRM can still exist inside a backup for up to seven months afterwards, until every backup containing it ages out. Those backups exist only to restore your service and are not used for any other purpose.
Getting your data out. There are two routes, and they give you different things, so it is worth knowing which you want:
Both routes need a working login, so please ask before your final billing date rather than after. We will also confirm in writing when your hosted CRM and its remaining backups will be deleted — just ask.
Depending on where you live, you may have certain rights regarding your personal information, which may include the right to:
Residents of certain U.S. states (such as California) may have additional rights under applicable state privacy laws, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. As noted above, we do not sell personal information. To exercise any of these rights, contact us using the details in Section 13 — we'll respond as required by applicable law, and we will never discriminate against you for exercising your privacy rights.
Our website may use cookies and similar technologies to keep the site functioning properly, remember your preferences, and understand how visitors use our site. You can control or disable cookies through your browser settings, though some features of the site may not function properly without them.
Our services are designed for businesses and are not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we do, we'll post the updated version on this page with a revised effective date. For significant changes, we'll make reasonable efforts to notify active clients directly. Continued use of our services after changes are posted means you've accepted the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your information, please contact My Nebulas via our contact page. We're always happy to chat.
