Nebula Commerce Privacy & Data Protection FAQ

Your Privacy Matters

At Nebula Commerce, protecting customer data is fundamental to how we design, build, and operate our platform. Our solutions—including Nebula OMS, Nebula Marketplace Integrator, Nebula PIM, and related services—are designed following security and privacy best practices to help our customers comply with applicable privacy regulations around the world.

This page answers the most common questions about how Nebula collects, processes, stores, and protects personal data.

What is Nebula Commerce?

Nebula Commerce is a cloud-based SaaS platform that enables retailers and brands to manage product information, inventory, orders, marketplaces, and omnichannel commerce operations.

Our customers use Nebula Product Suites to synchronize orders received from eCommerce platforms, marketplaces, ERP systems, warehouses, and logistics providers.

Does Nebula Commerce own customer data?

No. Your organization always owns its business data and customer information. Nebula Commerce acts only as a technology platform for processing data on behalf of our customers.

Our customers determine:

• what data is collected
• how long data should be retained
• who may access the data
• when data should be deleted

Nebula Commerce processes data only to provide contracted services.

What personal information does Nebula Commerce process?

Depending on the services configured by our customers, Nebula may process information such as:

• Customer Name
• Shipping Address
• Billing Address
• Email Address
• Mobile Number
• Marketplace Customer Identifier
• Order Information
• Shipping Details
• Return Information
• Delivery Instructions
• Customer Service Notes
• Order Status
• Purchase History

The exact information depends on the marketplace, website, ERP, or commerce platform integrated by the customer.

Does Nebula Commerce collect payment card information?

No. Nebula Commerce does not collect, process, transmit, or store:

• Credit Card Numbers
• Debit Card Numbers
• CVV/CVC Numbers
• Card Expiration Dates
• Payment Authentication Data
• PIN Numbers

Payments are processed directly through payment gateways selected by our customers.

Because Nebula never stores payment card information, our platform significantly reduces payment security risks for our customers.

Where is customer data stored?

Customer data is securely stored in Amazon Web Services (AWS). Our primary production infrastructure is hosted in:

• AWS US East (Northern Virginia), USA

AWS provides highly available, secure, enterprise-grade infrastructure with multiple layers of physical and logical security controls.

Is customer data encrypted?

Yes. Nebula protects customer information using industry-standard encryption technologies. This includes:

• Encryption during transmission using TLS
• Encryption of stored data
• Secure credential storage
• Encrypted backups
• Secure key management

Encryption helps protect information from unauthorized access while data is transmitted and while it is stored.

How does Nebula protect customer information?

Nebula employs multiple layers of technical and organizational security controls including:

• Encryption at rest
• Encryption in transit
• Role-Based Access Control (RBAC)
• Multi-Factor Authentication (where enabled)
• Password policies
• Secure software development practices
• Continuous infrastructure monitoring
• Audit logging
• Backups
• Network security controls
• Least privilege access
• Vulnerability management
• Security patch management

Security is built into every stage of our software development lifecycle.

Who can access customer data?

Only authorized personnel may access customer information. Access is granted strictly on a least-privilege basis.

Employees may access customer information only when necessary to:

• provide technical support
• investigate incidents
• resolve operational issues
• perform maintenance authorized by the customer

All such access is controlled, monitored, and logged.

Does Nebula sell customer data?

No. Nebula does not sell, rent, trade, or monetize personal information. Customer data is never used for advertising purposes or shared with third parties for commercial marketing.

Does Nebula use customer data for AI model training?

No. Customer business data processed through Nebula is not used to train public AI models.

Who is responsible for privacy compliance?

Our customers remain responsible for determining the lawful basis for collecting personal information from their end customers.

Nebula acts as a data processor (or equivalent role under applicable laws), processing data only according to customer instructions and for the purpose of delivering contracted services.

Which privacy regulations does Nebula support?

Nebula is designed to support customers in complying with globally recognized privacy principles, including regulations such as:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA), where applicable
• Brazil LGPD
• Colombia Law 1581
• Peru Personal Data Protection Law
• Chile Personal Data Protection Law
• Ecuador Organic Law on Personal Data Protection (LOPDP)

Compliance obligations may vary depending on how each customer uses the platform.

How long does Nebula retain customer data?

Customer data is retained only for as long as necessary to provide contracted services or as required by applicable law or contractual obligations.

Customers may configure data retention policies based on their business and regulatory requirements.

Upon termination of services, customer data may be returned, deleted, or anonymized in accordance with contractual agreements and applicable legal obligations.

Can customers request deletion of personal data?

Yes. Nebula supports customer requests to:

• delete personal information
• anonymize personal information
• export customer data
• correct customer information

Requests should be initiated by the customer organization that controls the data.

Can customers export their data?

Yes. Customers may request export of their business data in commonly used electronic formats, subject to contractual terms and technical limitations.

Does Nebula Commerce share customer information with third parties?

Nebula Commerce shares customer information only with trusted service providers necessary for operating the platform. These providers may include:

• Cloud infrastructure providers
• Monitoring services
• Email delivery providers
• Customer support systems

Nebula Commerce only share customer information with 3rd party Service provider who are already enlisted with our customer. Our Customers gives us permission to share data with third parties for order fulfilment and the contract to maintain privacy of their end customer data is between our customer and the 3rd Party Service providers.

All service providers are contractually required to protect customer information.

Does Nebula Commerce transfer data internationally?

Yes. As Nebula Commerce operates globally, customer information may be processed outside the country in which it was originally collected.

Appropriate contractual, organizational, and technical safeguards are implemented to protect personal information during international transfers.

What happens if a security incident occurs?

Nebula Commerce maintains a documented incident response process. If a confirmed security incident affects customer information, Nebula Commerce will:

• investigate the incident
• contain the issue
• assess impact
• notify affected customers as required by applicable law and contractual obligations
• implement corrective measures

Does Nebula use cookies?

Our website may use cookies and similar technologies to:

• improve website functionality
• analyze website usage
• remember user preferences
• enhance user experience

Users may configure browser settings to manage cookies.

Children's Privacy

Our services are designed for businesses and are not intended for use by children. We do not knowingly collect personal information directly from children.

Data Accuracy

Customers are responsible for ensuring that the personal information they upload into Nebula is accurate and up to date. Nebula processes information as received from customer systems and integrated platforms.

Contact Us

For privacy-related questions, security concerns, or requests regarding personal information, please contact:

Privacy Officer Clover Bay Labss Pvt. Ltd. Email: contactus@cloverbaytechnologies.com

For security-related inquiries, customers may also contact our Information Security Team.

Updates to this Policy

We may update this Privacy & Data Protection FAQ periodically to reflect changes in technology, applicable laws, or our services. The updated version will always be available on this page, and the "Last Updated" date will indicate when changes became effective.