Nebulia Agents Gmail — Privacy Policy

Information we access

Depending on the permissions granted, the application accesses sender and recipient details, email subjects and bodies, timestamps, labels, and message and conversation identifiers.

A separate sending connection permits creating and managing drafts and sending approved emails. Our current workflows do not download attachments.

We use Google OAuth authorization to connect accounts. We do not request or store Google account passwords.

How we use this information

We use this information to:

• Organize and match business conversations.
• Identify replies, unsubscribe requests, delivery failures and automatic responses.
• Pause or stop follow-ups when appropriate.
• Prepare drafts and suggested responses for human review.
• Record approvals, prevent duplicate sending and recover from technical failures.

We do not sell Google user data or use it for advertising targeting. We do not use Google-derived data to train, develop or improve general-purpose AI or machine-learning models.

Our use and transfer of Google API data follow the Google API Services User Data Policy, including its Limited Use restrictions.

AI-assisted processing

When enabled, relevant email content and necessary business context may be sent to Anthropic’s Claude API to classify replies or prepare draft responses and summaries.

AI-generated results may be inaccurate. Our workflows apply approval and review controls before messages are sent. Email content is treated as information to process, not as instructions that can override these controls.

Storage and service providers

The application runs through self-hosted n8n and PostgreSQL on Hostinger infrastructure. Encrypted backups are stored with Backblaze B2. Google provides Gmail connectivity and email delivery. Anthropic provides AI processing when those features are enabled.

These providers process information necessary to deliver their services. Information may be processed outside the country where an account holder or correspondent lives.

Security and access

We use HTTPS, restricted application and database access, protected credentials and encrypted off-server backups.

Access to Google-derived information is limited to authorized purposes and circumstances permitted by Google’s policies. No system can guarantee absolute security.

Retention and deletion

Different parts of Nebulia Agents Gmail retain information for different periods and purposes.

• Workflow execution history: n8n execution history is automatically pruned using a 14-day age threshold and a maximum limit of 10,000 executions. Cleanup processing may affect the exact time at which individual execution records are physically removed.
• Business records: correspondence, drafts, AI-generated outputs, approval records and other operational records are stored separately from workflow execution history. We do not currently apply one automatic deletion deadline to all of these records. Retention is assessed based on the ongoing business relationship, outstanding requests, operational and security requirements, and applicable legal or regulatory obligations.
• Backups: encrypted backups stored with Backblaze B2 retain selected snapshots across 7 daily, 4 weekly and 6 monthly periods. A separate suppression and erasure ledger retains selected snapshots across 48 hourly and 30 daily periods. These schedules describe the retention of backup snapshots and do not necessarily represent a guaranteed maximum age for every individual record contained within a backup.
• Suppression records: when necessary to honor an unsubscribe or prevent unwanted recontact, we may retain a minimal suppression record, including a hashed email identifier. These identifiers should not be treated as necessarily anonymous.

Copies of messages and related information that remain in a connected Gmail account are governed separately by that account holder’s settings and Google’s policies.

To request access, correction or deletion of personal information, contact support@nebulia.co. We may need to verify your identity before processing a request.

Deletion requests are reviewed across the relevant systems. Removing a contact or correspondence record does not necessarily remove every associated copy immediately because related AI outputs, approval records, operational records and backup copies may be stored separately.

We assess those associated copies as part of the request and will explain if information must be retained for legal, security, operational or unsubscribe-suppression purposes. A minimal suppression record may remain where necessary to ensure that deletion does not result in the person being contacted again.

Revoking access to Gmail stops future authorized access to that Gmail account. It does not automatically delete information that Nebulia or its service providers already stored before access was revoked.

Disconnecting Gmail and unsubscribing

Account owners can revoke access through their Google Account’s third-party connections settings.

Email recipients can use the unsubscribe link in our messages and confirm their choice on the unsubscribe page, or contact support@nebulia.co.

Changes and contact

We will update this page when our practices change and revise the effective date.

For privacy questions or requests, contact support@nebulia.co.