Privacy Policy

Who is responsible for your data

Carburo Software is the data controller for the personal data described here. We are registered in the Netherlands under Chamber of Commerce (KvK) number 97123528.

Registered address: Carburo Software, Jan Krosstraat 182, 2571 DD Den Haag, The Netherlands.

For anything to do with privacy, write to support@nebulastories.com and mark it "Privacy".

The short version

To give you an account we need your first name and email address. We also store your preferences and technical records, and any book ratings and notes you choose to send us, as described below.

We do not run advertising, we do not use analytics or tracking tools in the app, we do not build profiles, and we do not sell or rent your information to anyone.

What we collect

When you use Nebula, with or without an account, we collect the following information where applicable:

• Account details: your first name, your email address, and your password, which is stored only as a salted cryptographic hash that we cannot reverse.
• Email verification and password reset codes: stored as hashes, short-lived, and deleted once used.
• Your preferences: the reading languages you choose, and your in-app settings such as whether narration and parent tips are switched on.
• Your marketing choice: whether you asked to receive occasional product emails. This is off unless you turn it on.
• Support correspondence: if you email us, we keep your message and our reply so we can help you.
• Technical records: our servers keep standard logs, which include your IP address, the time of the request, and general device and app-version information. These are security and reliability records, not analytics.
• Billing details, only if you subscribe on our website: our payment provider Stripe handles the payment itself. We receive confirmation that a subscription is active, and we store your billing address, country, and currency because tax law requires us to. We never see or store your full card number. Nothing is ever sold or charged inside the Nebula app.
• Book feedback: when you save a rating or note at the end of a book, the app keeps a local copy and sends the rating, note, book identifier, and reading language to our servers. We store the submission and its creation and update times. Feedback is optional; you can skip it and continue reading.
• Feedback and your account: if you are signed in, your feedback is linked to your account. Guest feedback is stored without an account link. A note can still identify you if you include personal information. Feedback is available to our staff in the administration system; it is not displayed to other readers in the app.

Limits on data collection

We limit collection in the following ways:

• We do not ask for your child’s name, age, birthday, photo, voice, or recordings. Please do not include information about children in feedback notes.
• We do not collect advertising identifiers or display advertisements.
• We do not use third-party analytics, attribution, or behavioural tracking tools in the app.
• We do not access your location, contacts, calendar, photo library, microphone, or camera.
• We do not collect data to track you across other apps or websites.

Children and Nebula

Nebula accounts and book feedback are intended for adults. We do not ask you to provide information about your child. Please do not put names, ages, contact details, or other personal information about children in feedback notes.

Nebula is offered in the Kids category of the app stores. In line with the US Children’s Online Privacy Protection Act (COPPA), the GDPR, and the app stores’ own rules for children’s apps, we do not ask for personal data about children, do not show them advertising, do not use third-party analytics, and do not include external links or purchase options that a child could reach without an adult. Where the app can take you outside it — for example to open your email app — an adult check stands in the way first.

If you believe a child has given us personal information, contact support@nebulastories.com and we will delete it promptly.

What stays on your device

Your favourites, reading progress, and chosen interface language are stored only in the app on your device. Ratings and notes are also saved on your device, but are sent to our servers when you submit them.

Your sign-in tokens are stored in your device’s secure keychain, not in ordinary app storage. Signing out removes the tokens stored by the app. Uninstalling the app does not delete your account or feedback from our servers.

Why we use your information

Under the GDPR we must tell you our legal basis for each use. They are:

• To create your account, sign you in, and show you the right stories in the right languages — because it is necessary to perform our contract with you.
• To verify your email address, reset your password, and send service messages about your account — necessary to perform our contract with you.
• To keep Nebula secure, prevent abuse, diagnose faults, and keep records for accounting and tax — our legitimate interests in running a safe and lawful service, and our legal obligations.
• To send you occasional emails about new books and features — only with your consent, which you can withdraw at any time.
• To handle a purchase and meet tax and accounting rules, if you subscribe — performance of our contract and our legal obligations.
• To receive and review the feedback you choose to send, and improve our stories, translations, narration, and app — our legitimate interests in maintaining and improving Nebula. You may object to this use by contacting us.

Who we share information with

We do not sell your personal information and we do not share it for advertising. We rely on a small number of partners. Most of them act as our processors, handling data only on our instructions under a written data processing agreement. Stripe is the exception: for the payment itself it acts as an independent controller under its own privacy policy.

• Google Cloud — hosting, database, file storage, and logging for the Nebula service. Holds account data, submitted book feedback, and technical records.
• Resend — sends our transactional emails. Receives your email address, your first name, and the verification or reset code.
• Stripe — processes subscription payments made on our website. Stripe receives your email address, billing address, and card details, and handles them as an independent controller under its own privacy policy. Your card number goes to Stripe, never to us.
• Apple and Google — distribute the Nebula app through their app stores under their own privacy policies. We do not send them your account data.
• Sentry — server-side error monitoring, configured not to send personal data, used to spot crashes in our backend.

Where your information is stored

Nebula’s servers, database, and file storage are currently hosted by Google Cloud in the United States (region us-central1). Our email provider is also based in the United States. This means your personal data is transferred outside the European Economic Area. Payments made by customers in Europe are processed by Stripe’s Irish entity within the EEA.

These transfers are protected by the European Commission’s Standard Contractual Clauses and, where our providers are certified, by the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.

We intend to move Nebula’s hosting to the European Union. We will update this policy when we do.

How long we keep it

We keep personal information only as long as needed for the purposes described in this policy. When you delete your account, we delete your account record, preferences, settings, and feedback linked to your account.

Guest feedback is stored without an account link. To request its deletion, contact us and identify the book, language, and approximate submission date so we can locate it.

Some records we have to keep for longer — invoices, for example, because Dutch tax law requires it.

How we protect it

All traffic between the app and our servers is encrypted with HTTPS. Passwords are stored only as salted hashes. Sign-in tokens live in your device’s secure keychain, expire quickly, and are invalidated when you sign out or change your password. Access to production systems is limited to people who need it.

No system is perfectly secure, but if a breach ever affects your personal data we will notify the Dutch Data Protection Authority and, where the law requires, you directly.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to:

• ask for a copy of the personal data we hold about you
• correct anything that is wrong or incomplete
• have your data erased
• restrict or object to how we use it
• receive your data in a portable, machine-readable format
• withdraw consent to marketing emails at any time, without affecting your access to the app

Rights in other countries

If you are in California, you may request access to or deletion of your personal information and may not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under Californian law.

Wherever you live, you are welcome to make any of the requests above and we will honour them to the extent the law allows.

Deleting your account

You can delete your account yourself at any time: open Settings, choose Delete account, and confirm with your password. This permanently erases your account, your preferences, your settings, and the ratings and notes linked to your account from our systems.

You can also ask us to do it by writing to support@nebulastories.com from your account email address. The instructions at https://nebulastories.com/legal/delete-account/ explain both routes. We will complete the deletion within 30 days.

Records we are legally required to keep, such as invoices, are retained for the periods described above and then deleted.

Cookies

The Nebula app does not use cookies or any similar tracking technology.

Our website uses only the strictly necessary cookies needed to serve the pages securely and, on the checkout page, the cookies Stripe sets to process your payment and prevent fraud. Our website carries no advertising or analytics cookies, so we do not ask you for cookie consent.

Changes to this policy

We may update this policy as Nebula develops. The date at the top shows when it last changed. If a change is material we will tell you in the app or by email before it takes effect.

Contact us, or complain

To exercise a right, ask a question, or raise a concern, write to support@nebulastories.com. We answer privacy requests within 30 days.

If you are not satisfied with our response, you have the right to complain to your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also complain to the authority in the EU country where you live.