Overview
Nebula Deck is a managed hosting platform for AI workspaces. This policy explains what data we collect, why, and how we protect it.
The short version: we collect the minimum data needed to run the Service. We don't read your conversations, sell your data, or use your content to train AI models. Your workspace is yours.
Data controller
We act as the data controller for account data, billing data, and platform metadata. For content stored inside your workspace (conversations, memory, files), we act as a data processor on your behalf — you control what goes in, and we provide the infrastructure to store and process it.
What we collect
Account data
When you create an account through our identity provider (Zitadel), we receive and store:
From your OAuth provider (Google, GitHub, or email signup). Used for account identification and service communications.
A unique identifier from our identity provider. Used internally to link your account to your workspace.
If provided by your OAuth provider. Used for display purposes only.
Billing data
Subscription management is handled by Polar.sh. We store:
Whether your subscription is active, your tier, and billing period dates.
A reference linking your account to your Polar.sh billing record.
We do not store credit card numbers, bank account details, or other payment instruments. All payment data is held by Polar.sh and their payment infrastructure (Stripe). See Polar.sh's privacy policy for details.
Platform metadata
To operate the Service, we collect and store:
The subdomain you selected for your workspace.
Container IDs, image versions, resource usage metrics, start/stop timestamps. Used for provisioning, billing, and debugging.
Duration and type of worker container sessions. Used for per-second billing calculation.
Workspace content (processed, not collected)
Your workspace stores data that you create or that your AI assistant generates on your behalf: conversations, memory files, skills, workspace files, channel configurations, and calendar data. This data lives inside your dedicated container. We do not extract, aggregate, or analyze this content. It is stored on our infrastructure as part of providing the Service.
What we don't collect
We explicitly do not collect or access:
Your workspace calls LLM providers directly with your API keys. Request and response content does not pass through our servers. Worker containers also call providers directly using your key, which is passed as an ephemeral environment variable at launch and destroyed with the container.
We do not read, monitor, or analyze your conversations with your AI workspace.
We do not use third-party analytics services, tracking pixels, or behavioral profiling. We do not fingerprint your browser or device.
API keys are stored encrypted in your workspace vault. The plaintext values are never logged, transmitted to our backend in readable form, or accessible to our staff. When passed to worker containers at launch, keys are injected as environment variables and redacted from all log output.
Legal basis for processing (GDPR)
Under the General Data Protection Regulation (GDPR), we process your data on the following bases:
Account data, billing data, and workspace provisioning — necessary to provide the Service you subscribed to.
Platform metadata (container health, resource usage, error logs) — necessary to maintain, secure, and improve the infrastructure. Our interest is balanced against your rights by collecting only operational data, not content.
Retaining billing records as required by tax and financial regulations.
We do not rely on consent as a legal basis for any core processing activities. If we ever introduce optional features that require consent (such as anonymous usage analytics), we will request it separately and you can withdraw it at any time.
Third-party services
The Service relies on the following third-party providers. Each processes data as necessary to perform their function:
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Hetzner | Server hosting | All data stored on their infrastructure | Germany (EU) |
| Cloudflare | DNS, CDN, DDoS protection | IP addresses, HTTP headers in transit | Global (edge network) |
| Zitadel | Authentication (OAuth) | Email, OAuth tokens | Self-hosted (same Hetzner VPS) |
| Polar.sh | Subscription billing | Email, subscription events | EU |
| Stripe (via Polar.sh) | Payment processing | Payment card data (we never see this) | EU / US |
Your LLM providers (Anthropic, OpenAI, etc.) are not our sub-processors — you have a direct relationship with them through your API keys. We do not control or intermediate that relationship.
If you connect chat channels (Telegram, Discord, WhatsApp, etc.), your messages pass through those platforms according to their own privacy policies. We receive message content within your workspace container to enable the AI assistant functionality you configured. We do not forward that content anywhere else.
Data location
All workspace data and platform infrastructure is hosted on Hetzner servers in Germany (European Union). Your data does not leave the EU except:
HTTP requests transit through Cloudflare's global network before reaching our servers. Cloudflare does not store request bodies. Cloudflare participates in the EU-US Data Privacy Framework.
When your workspace calls an LLM provider, data is sent to wherever that provider operates. This is your direct relationship — we do not control the destination.
Messages sent through connected channels (Telegram, Discord, etc.) pass through those platforms' infrastructure.
Retention
Retained while your account is active. Deleted within 30 days of account closure.
Retained while your workspace is active. After subscription cancellation, your workspace is stopped at the end of the billing period. Data is retained for 30 days to allow reactivation, then permanently deleted.
Ephemeral. Worker containers are destroyed when the task completes or times out. No data from worker sessions is retained on our infrastructure after destruction.
Retained for the period required by applicable tax and financial regulations (typically 7 years).
Application and infrastructure logs are retained for up to 30 days for debugging purposes, then deleted. Logs never contain conversation content, API key values, or workspace file contents.
Security
We implement the following technical measures to protect your data:
Each workspace runs in a dedicated container with gVisor runtime sandboxing, restricted syscalls, and isolated networking. Tenants cannot access each other's containers or data.
All connections to the Service use TLS. Internal container-to-backend communication is over isolated Docker networks.
API keys and credentials are encrypted using AES-256-GCM with per-tenant keys. Plaintext values are zeroed from memory when no longer needed.
The platform uses OAuth-based authentication with optional WebAuthn passkeys. Session cookies are HttpOnly and Secure. Per-tenant backend tokens authenticate container-to-backend communication.
SSH access is via Cloudflare tunnel only (no direct SSH). Automatic security updates are applied. All HTTP/HTTPS traffic is restricted to Cloudflare IP ranges.
No system is perfectly secure. If we discover a data breach that affects your personal data, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.
Cookies
We use only strictly necessary cookies:
Maintains your authenticated session after logging in. HttpOnly, Secure, expires when you close your browser or after a set period.
We do not use analytics cookies, advertising cookies, or third-party tracking cookies. Because we only use strictly necessary cookies, no cookie consent banner is required under GDPR.
Your rights
Under GDPR, you have the following rights regarding your personal data:
Request a copy of the personal data we hold about you.
Request correction of inaccurate personal data.
Request deletion of your personal data. This includes account data, workspace content, and all associated records.
Request that we limit processing of your data in certain circumstances.
Receive your personal data in a structured, machine-readable format. Your workspace supports data export while active.
Object to processing based on legitimate interest. We will stop unless we demonstrate compelling legitimate grounds.
Lodge a complaint with your local data protection authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).
To exercise any of these rights, email [email protected]. We will respond within 30 days.
Children
The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or through the Service at least 30 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision.
Contact
For privacy-related questions, data access requests, or complaints:
Email: [email protected]