Privacy Policy

1. General

1. Scope: This policy applies to all features provided by Nebula, including but not limited to AI Bot hosting, API relay, conversation memory management, and the user dashboard.
2. Data Controller: Nebula is operated by the Nebula team. Contact: [email protected].
3. Applicable Law: We comply with applicable data protection laws. For users in the European Economic Area, we respect the principles of the General Data Protection Regulation (GDPR) regarding lawful processing, data minimisation, and your right to erasure.

2. Information We Collect

To provide a stable and intelligent hosting service, we collect the following information:

1. Account Information
   • Username and email address.
   • Password: Stored using bcrypt strong hashing. No plaintext password is ever stored.
2. Service Credentials
   • Bot Tokens and platform credentials you configure in the dashboard.
   • 【Security】All sensitive credentials are stored with AES-256-GCM encryption and decrypted in memory only at runtime.
3. Conversation Memory & Dream Distillation Data
   • When you enable the Dream Distillation feature, the system periodically extracts conversation summaries and builds long-term memory nodes to improve AI response coherence. These are stored in your private data index.
4. Log Information
   • Access timestamps, source IP addresses, and operation records — used solely for security auditing, abuse detection, and troubleshooting.
5. Cookies
   • We use only essential cookies to maintain your login session. No cross-site tracking or behavioral advertising cookies are used.

3. How We Use Your Information

We use collected information for the following lawful purposes:

• Service Delivery: Ensuring your Bot can receive, process, and respond to messages as instructed.
• Memory Features: Running conversation extraction and memory storage tasks required by Dream Distillation.
• Security: Identity verification, security audits, and abuse detection.
• Support: Responding to your technical support requests.

4. Third-Party Services

As a hosting platform, data flows to third parties based on your configuration:

1. AI Providers: Your message content is sent to the AI service integrated in the platform to generate responses.
2. Platform Terms: If you deploy on Telegram, Discord, or any other messaging platform, interactions are also subject to those platforms' privacy policies.
3. Responsibility Boundary: We cannot control how third-party AI providers or social platforms process data. We recommend reviewing their privacy policies before use.

5. Data Security

We take the following measures to protect your data:

• Encryption in Transit: All communications use HTTPS/TLS to prevent interception.
• Access Control: Service credentials are decrypted only in memory at runtime and never logged in plaintext.
• Isolation: User data is logically isolated so credentials and memories of different accounts never overlap.

6. Data Retention & Deletion

1. Manual Deletion: You can delete API credentials, conversation logs, and memory data at any time from the dashboard.
2. Account Deletion: Upon account deactivation, all your data will be permanently deleted within 7 business days (except system logs required by law).
3. Service Shutdown: If we cease operations, we will announce in advance and assist users with data export or migration.

7. Your Rights

You have the following rights regarding your personal information:

• Access: View all configurations and memory data stored on the platform.
• Correction: Update or modify your account information and credentials at any time.
• Deletion (Right to be Forgotten): Request deletion of specific memory nodes or complete account data erasure.
• Withdraw Consent: Stop using the Service and withdraw your consent to this policy at any time.
• How to Exercise: Use the dashboard self-service options, or email [email protected].

8. Children's Privacy

This Service is not directed at children under the age of 14. If we discover that we have inadvertently collected personal information from a minor, we will delete it immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you via in-app notification or email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

10. Contact Us

If you have questions, complaints, or suggestions about this Privacy Policy, please contact us:

• Email: [email protected]
• Response Time: We aim to provide an initial response within 48 hours.