1. Overview
Nebuela ("Nebuela," "we," "us," or "our") provides managed cold email infrastructure: mailbox provisioning on Google Workspace, Microsoft 365, Exchange Server, Azure Communication Services or Nebuela-operated sending servers, together with automated DNS authentication (MX, SPF, DKIM, DMARC) and ongoing monitoring. This Privacy Policy explains what information we collect through nebuela.io and the Nebuela platform at app.nebuela.io (together, the "Service"), how we use and share it, and the choices available to you.
It does not cover the content of email your organization sends using mailboxes we provision — that is your data, sent through your own sending tool, and governed by your agreement with that tool rather than by Nebuela.
2. Scope
This policy covers visitors to nebuela.io and customers and authorized users of app.nebuela.io. Nebuela is a business-to-business service: we provision infrastructure for organizations, not consumer accounts, and we do not knowingly direct the Service at individual consumers.
3. Information We Collect
Information you provide directly
- Account details — name, work email, company, and password or SSO identity when you or your organization sign up at app.nebuela.io.
- Billing details — billing name, address and email. Card and payment details are collected and stored by Stripe, our payment processor; Nebuela does not store full card numbers.
- Support and sales communications — anything you send to info@nebuela.com or through the site's contact form.
Information you connect from third-party services
Provisioning your infrastructure requires scoped access to services you already use: a Cloudflare API token, scoped to the zones you add, so we can write MX, SPF, DKIM, DMARC and related DNS records; admin consent for a Nebuela-operated Google Workspace, Microsoft 365 or Azure tenant, on the paths where mailboxes are provisioned in a tenant Nebuela operates; and, only if you use those specific features, your Instantly login for direct account push, or your Smartlead API key for account upload. Every one of these can be revoked at its source — for example, in your own Cloudflare account — at any time, which immediately ends our access.
Information generated by the Service
- Mailbox credentials we provision — SMTP/IMAP host, port, username and password for each mailbox, shown in the portal and exportable to CSV.
- DNS records written to your domains, and results from the validation and monitoring sweep that runs roughly every 15 minutes, including SMTP/IMAP checks and sending-IP blacklist status against Spamhaus, Barracuda and SpamCop.
- An audit log of actions taken on your account, by you and by our systems, used for security and support.
Information from nebuela.io itself
The marketing site does not use cookies, analytics or advertising trackers, and has no server-side form: the "Send message" button on the contact section opens your own email client with a pre-filled message addressed to info@nebuela.com — nothing reaches Nebuela unless you actually send that email. Loading the site requests the Space Grotesk font from Google Fonts, which means your browser makes a request to Google's servers for that file; standard web-server logs (such as IP address and request time) may be generated by that request and by our own hosting infrastructure.
4. How We Use Information
- Provision, operate, monitor and repair the mailbox and DNS infrastructure you order.
- Create and administer your account, and process billing through Stripe.
- Provide support, respond to inquiries, and send service-related notices — for example, if a domain's DNS records fail validation.
- Maintain the audit log and investigate suspected misuse, security incidents, or violations of our Terms & Conditions.
- Improve the Service's reliability, informed by aggregated monitoring data.
We do not use the credentials or infrastructure data you provide for advertising, and we do not read the content of email sent through mailboxes we provision.
6. Data Security
Stored credentials and API tokens are encrypted at rest, each customer's workspace is isolated as its own tenant in our systems, and account actions are written to an audit log. That is the honest ceiling of our security claim: Nebuela does not currently hold SOC 2, ISO 27001 or similar third-party compliance certifications, and we won't represent otherwise. No method of transmission or storage is perfectly secure; if you believe your account or credentials have been compromised, revoke the relevant tokens (for example, in Cloudflare) and contact info@nebuela.com immediately.
7. Data Retention
We retain account, billing and infrastructure data for as long as your account is active, plus a reasonable period afterward for legal, tax, security and dispute-resolution purposes. Mailbox credentials and DNS access tied to a domain are retained for as long as that domain remains provisioned, and you can export mailbox credentials at any time while your subscription is active. Specific retention and deletion timelines for a closed account are confirmed in writing on request — contact info@nebuela.com — rather than asserted generically here.
8. Your Choices & Rights
- Access and export — mailbox credentials are visible in the portal and exportable to CSV at any time your subscription is active.
- Revoke access — you can revoke the Cloudflare API token, Google Workspace/Microsoft 365/Azure admin consent, or any Instantly/Smartlead connection at its source at any time; our access ends immediately.
- Correct or delete account information — contact info@nebuela.com to update your account details or request deletion of information we hold about you, subject to what we must retain for legal or legitimate business reasons.
- Marketing communications — any opt-in marketing email we send includes an unsubscribe option.
Depending on where you're located, applicable data protection law (such as the GDPR or a U.S. state privacy law) may give you additional rights over personal information. We'll honor requests made under those laws to the extent they apply to our processing — contact info@nebuela.com to make one.
9. Children's Privacy
The Service is a business tool and is not directed at, or knowingly offered to, children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact info@nebuela.com and we will delete it.
10. International Data Transfers
Nebuela is based in the United States, and the infrastructure providers we work with (Google, Microsoft, Cloudflare, Stripe and others) operate globally. Information may be processed in the United States or other countries where our providers operate, which may have different data protection laws than your own.
11. Third-Party Links & Services
nebuela.io and app.nebuela.io may link to or integrate with third-party services — for example, Instantly, Smartlead, or your own Cloudflare account. Those services have their own privacy policies, which we encourage you to read; this policy covers only Nebuela's own collection and use of information.
12. Changes to This Policy
We may update this policy as the Service changes. We'll update the "Last updated" date above when we do, and for material changes we'll take reasonable steps to notify active customers — such as an account or email notice — before the change takes effect.
13. Contact Us
Questions about this policy or your information:
Nebuela
39 North Gould Street
Sheridan, Wyoming 82801, USA
info@nebuela.com
See also our Terms & Conditions.