Privacy Policy

Who is responsible for your data

Carburo Software is the data controller for the personal data described here. We are registered in the Netherlands under Chamber of Commerce (KvK) number 97123528.

Registered address: Carburo Software, Jan Krosstraat 182, 2571 DD Den Haag, The Netherlands.

For anything to do with privacy, write to support@nebulastories.com and mark it "Privacy".

The short version

To give you an account we need your first name and email address. That is essentially all we hold about you.

We do not run advertising, we do not use analytics or tracking tools in the app, we do not build profiles, and we do not sell or rent your information to anyone.

What we collect

When you create and use an account, we collect:

• Account details: your first name, your email address, and your password, which is stored only as a salted cryptographic hash that we cannot reverse.
• Email verification and password reset codes: stored as hashes, short-lived, and deleted once used.
• Your preferences: the reading languages you choose, and your in-app settings such as whether narration and parent tips are switched on.
• Your marketing choice: whether you asked to receive occasional product emails. This is off unless you turn it on.
• Support correspondence: if you email us, we keep your message and our reply so we can help you.
• Technical records: our servers keep standard logs, which include your IP address, the time of the request, and general device and app-version information. These are security and reliability records, not analytics.
• Billing details, only if you subscribe on our website: our payment provider Stripe handles the payment itself. We receive confirmation that a subscription is active, and we store your billing address, country, and currency because tax law requires us to. We never see or store your full card number. Nothing is ever sold or charged inside the Nebula app.

What we never collect

We want to be specific about this, because it is unusual. Nebula does not collect:

• any information about your child — no name, no age, no birthday, no photo, no voice, no recordings
• advertising identifiers, and there is no advertising in Nebula at all
• third-party analytics, attribution, or behavioural tracking of any kind
• your location, contacts, calendar, photo library, microphone, or camera
• anything used to track you across other apps or websites

Children and Nebula

Nebula accounts are created and controlled by adults. We do not knowingly collect personal information from children, and the app does not ask a child for any information.

Nebula is offered in the Kids category of the app stores. In line with the US Children’s Online Privacy Protection Act (COPPA), the GDPR, and the app stores’ own rules for children’s apps, we do not collect personal data from children, do not show them advertising, do not use third-party analytics, and do not include external links or purchase options that a child could reach without an adult. Where the app can take you outside it — for example to open your email app — an adult check stands in the way first.

If you believe a child has given us personal information, contact support@nebulastories.com and we will delete it promptly.

What stays on your device

Some things never reach our servers. Your favourites, your reading progress, the ratings and notes you leave at the end of a book, and your chosen interface language are stored only in the app on your device.

Your sign-in tokens are stored in your device’s secure keychain, not in ordinary app storage. Deleting the app removes all of this.

Why we use your information

Under the GDPR we must tell you our legal basis for each use. They are:

• To create your account, sign you in, and show you the right stories in the right languages — because it is necessary to perform our contract with you.
• To verify your email address, reset your password, and send service messages about your account — necessary to perform our contract with you.
• To keep Nebula secure, prevent abuse, diagnose faults, and keep records for accounting and tax — our legitimate interests in running a safe and lawful service, and our legal obligations.
• To send you occasional emails about new books and features — only with your consent, which you can withdraw at any time.
• To handle a purchase and meet tax and accounting rules, if you subscribe — performance of our contract and our legal obligations.

Who we share information with

We do not sell your personal information and we do not share it for advertising. We rely on a small number of partners. Most of them act as our processors, handling data only on our instructions under a written data processing agreement. Stripe is the exception: for the payment itself it acts as an independent controller under its own privacy policy.

• Google Cloud — hosting, database, file storage, and logging for the Nebula service. Holds all account data.
• Resend — sends our transactional emails. Receives your email address, your first name, and the verification or reset code.
• Stripe — processes subscription payments made on our website. Stripe receives your email address, billing address, and card details, and handles them as an independent controller under its own privacy policy. Your card number goes to Stripe, never to us.
• Apple and Google — distribute the Nebula app through their app stores under their own privacy policies. We do not send them your account data.
• Sentry — server-side error monitoring, configured not to send personal data, used to spot crashes in our backend.

Where your information is stored

Nebula’s servers, database, and file storage are currently hosted by Google Cloud in the United States (region us-central1). Our email provider is also based in the United States. This means your personal data is transferred outside the European Economic Area. Payments made by customers in Europe are processed by Stripe’s Irish entity within the EEA.

These transfers are protected by the European Commission’s Standard Contractual Clauses and, where our providers are certified, by the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.

We intend to move Nebula’s hosting to the European Union. We will update this policy when we do.

How long we keep it

We keep personal information only as long as we need it for the purposes described in this policy. When you delete your account, we erase it.

Some records we have to keep for longer — invoices, for example, because Dutch tax law requires it.

How we protect it

All traffic between the app and our servers is encrypted with HTTPS. Passwords are stored only as salted hashes. Sign-in tokens live in your device’s secure keychain, expire quickly, and are invalidated when you sign out or change your password. Access to production systems is limited to people who need it.

No system is perfectly secure, but if a breach ever affects your personal data we will notify the Dutch Data Protection Authority and, where the law requires, you directly.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to:

• ask for a copy of the personal data we hold about you
• correct anything that is wrong or incomplete
• have your data erased
• restrict or object to how we use it
• receive your data in a portable, machine-readable format
• withdraw consent to marketing emails at any time, without affecting your access to the app

Rights in other countries

If you are in California, you may request access to or deletion of your personal information and may not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under Californian law.

Wherever you live, you are welcome to make any of the requests above and we will honour them to the extent the law allows.

Deleting your account

You can delete your account yourself at any time: open Settings, choose Delete account, and confirm with your password. This permanently erases your account, your preferences, and your settings from our systems.

You can also ask us to do it by writing to support@nebulastories.com from your account email address. The instructions at https://nebulastories.com/legal/delete-account/ explain both routes. We will complete the deletion within 30 days.

Records we are legally required to keep, such as invoices, are retained for the periods described above and then deleted.

Cookies

The Nebula app does not use cookies or any similar tracking technology.

Our website uses only the strictly necessary cookies needed to serve the pages securely and, on the checkout page, the cookies Stripe sets to process your payment and prevent fraud. Our website carries no advertising or analytics cookies, so we do not ask you for cookie consent.

Changes to this policy

We may update this policy as Nebula develops. The date at the top shows when it last changed. If a change is material we will tell you in the app or by email before it takes effect.

Contact us, or complain

To exercise a right, ask a question, or raise a concern, write to support@nebulastories.com. We answer privacy requests within 30 days.

If you are not satisfied with our response, you have the right to complain to your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority in the EU country where you live.