Privacy Policy
Effective October 22, 2026 · Last updated October 22, 2026
On this pageWho this policy covers
The short version
- We collect what we need to open and run a business account, prevent fraud and meet financial regulations — and nothing for advertising.
- Your transaction and ledger data is never sold and is never used to train machine-learning models, ours or anyone else’s.
- We share data with partner banks, card networks and vetted subprocessors only to deliver the service or when the law requires it.
- Financial records are kept for the periods regulators require (usually five to seven years); everything else is deleted when it is no longer needed.
- You can access, correct, export or delete your personal data by writing to privacy@nebulabank.xyz.
This policy explains what Nebula Technologies, Inc. (“Nebula”, “we”, “us”) collects when you visit nebulabank.xyz, apply for an account or use the Nebula platform and API, why we collect it, who we share it with, and the choices you have. We wrote it to be read, not skimmed past.
1.Who this policy covers#
Nebula provides financial software to businesses. The people whose data we handle are mostly representatives of those businesses: founders, beneficial owners, finance staff, engineers who hold API keys, and visitors to our website.
When a business uses Nebula to pay its own vendors, contractors or customers, we process data about those recipients on the business’s instructions. For that data the business is the controller and we act as its processor under our Data Processing Addendum.
Banking and card services are provided by our partner institutions, which have their own privacy notices. Where a partner bank is the controller of your data, its notice applies alongside this one.
2.Information we collect#
Information you give us
- Business details — legal name, registration and tax numbers, address, incorporation documents, ownership structure, industry and expected activity.
- Identity of people behind the business — names, dates of birth, home addresses, government ID numbers and images, and ownership percentages of directors and beneficial owners, as required by Know-Your-Business (KYB) and anti-money-laundering law.
- Account users — name, work email, phone number, role and authentication factors for everyone you invite.
- Communications — messages to support, call notes and feedback.
Information created when you use Nebula
- Transaction data — payments, card authorisations, declines, transfers, counterparties, amounts, currencies and memos.
- Ledger and attribution data — vendor usage rows, and the agent, model, environment and customer tags you or your systems attach to them.
- Agent and policy configuration — card limits, merchant allowlists, approval chains and the audit trail of who changed what.
- Technical data — IP address, device and browser identifiers, API request metadata, and security logs.
Information from third parties
- Identity-verification, sanctions-screening and credit-reference providers.
- Partner banks and card networks, about the transactions they process for you.
- Vendors you connect (cloud, inference, billing), limited to the read-only scopes you grant.
3.How we use information#
We use personal data only for the purposes below, and for each we rely on a legal basis recognised by applicable law.
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide the service | Open accounts, issue cards, move money, attribute spend, produce statements | Contract |
| Meet legal obligations | KYB, sanctions screening, transaction monitoring, tax and regulatory reporting | Legal obligation |
| Protect accounts | Fraud detection, anomaly alerts, securing API keys, investigating abuse | Legitimate interests |
| Support and improve | Answer questions, fix bugs, measure feature usage in aggregate | Legitimate interests |
| Communicate | Service notices, security alerts, and — only if you opt in — product news | Contract / consent |
We do not use your transaction, ledger or attribution data to train machine-learning models, and we do not sell or rent personal data. Fraud models are trained only on de-identified, aggregated signals, and you can ask us to exclude your account entirely.
5.Subprocessors#
We use a small number of subprocessors. We give customers 30 days’ notice before adding a new one, and you may object under the Data Processing Addendum.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Primary hosting and storage | United States, Ireland |
| Cloudflare | Edge network, DDoS protection | Global |
| Persona | Identity verification | United States |
| ComplyAdvantage | Sanctions and PEP screening | United Kingdom, United States |
| Postmark | Transactional email | United States |
| Intercom | Customer support messaging | United States |
7.How long we keep information#
- Transaction and KYB records — at least five years after the account closes, or longer where the law requires.
- Audit logs — for the period your plan specifies, then deleted.
- Application data for declined applicants — up to two years, for fraud prevention and regulatory review.
- Marketing-site analytics — aggregated, retained for 24 months.
When retention ends we delete or irreversibly anonymise the data. Backups roll off within 35 days.
8.Security#
Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Vendor credentials sit in an isolated vault with per-tenant keys. Production access requires hardware-key MFA, is just-in-time, and is logged to an append-only audit trail you can query.
We are audited annually against SOC 2 Type II and PCI DSS. To report a vulnerability, write to security@nebulabank.xyz; we do not pursue good-faith researchers.
9.International transfers#
Nebula is based in the United States. When we transfer personal data out of the EEA, United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with supplementary measures. Enterprise customers can choose EU data residency.
10.Your rights#
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a portable copy;
- correct inaccurate data;
- delete data we no longer need or have no legal basis to keep;
- object to or restrict certain processing;
- withdraw consent where we rely on it;
- complain to your local data-protection authority.
California residents have the rights described in the CCPA/CPRA, including to know, delete and correct, and not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioural advertising.
Some rights are limited by financial regulation — for example, we cannot delete KYB records we are required to keep. We will tell you when that applies. We answer requests within 30 days.
11.Children#
Nebula is a service for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
12.Changes to this policy#
If we make a material change we will email account administrators and post a notice in the dashboard at least 30 days before it takes effect. The date at the top of this page shows when it last changed.
13.Contact#
Questions or requests: privacy@nebulabank.xyz. Our data-protection officer can be reached at the same address.
Post: Nebula Technologies, Inc., 548 Market St, PMB 90412, San Francisco, CA 94104, USA.
Stop paying for machine time
on a human bank.
Open an account in an afternoon. Connect your vendors, issue your first agent card, and see where the money actually goes.
Open an accountNo platform fee · Sandbox on approval · Cancel anytime