Privacy Policy

This policy explains what personal data NebulaForge collects through nebulaforge.dev, why we collect it, who helps us process it, how long we keep it, and the rights you have. We've written it in plain English. If anything is unclear, contact us using the details in section 14.

1. Who we are

NebulaForge is a website design, development and AI automation studio based in Bengaluru, Karnataka, India. NebulaForge is the trade name of a sole proprietorship owned by VamsiKrishna Idamadaka (sole proprietor), trading as NebulaForge.

For the personal data described here, NebulaForge is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). That means we decide why and how your data is processed.

Address: VMP2+7XG, Shiva Temple Rd, Kudlu, AECS Layout - A Block, Hal Layout, Bengaluru, Karnataka 560068, India
Email: nebulaforge-main@nebulaforge.dev
Phone / WhatsApp: +91 90351 43202
People: VamsiKrishna Idamadaka (Founder & Managing Director), Shivanee Naik (COO & Co-Founder), PremKumar K (CTO & Co-Founder)

Scope. This policy covers nebulaforge.dev and the tools on it: the enquiry form, the Lyra chat assistant, the website cost calculator, the website planner and the free website check. It does not cover:

websites we build for clients. Each client is responsible for its own visitors' data.
Nebulora and Nebrepora, which are separate products with their own terms where those terms are published.
third-party sites we link to, such as WhatsApp, Instagram and X.

2. What we collect and why

We collect only what we need for the purposes below. You don't have to give us anything to browse the site.

What you use	Personal data we collect	Why we use it
Enquiry form (home and pricing pages)	Name, company or brand (optional), email, phone/WhatsApp number, the package you're interested in, your budget range, and what you need	To reply to your enquiry, prepare a quote and follow up about that enquiry
Lyra chat assistant	Your messages; the name, email and phone (phone is optional) you share; what you want built; any files you upload (up to 5 files, 5 MB each); the 6-digit email verification step; your ticket reference (e.g. NF-123456) and its status; a transcript of the conversation linked to your ticket	To answer your questions, understand your project, suggest a package, verify your email so only you can see your tickets, raise and track your ticket, and let our team pick up the conversation
Free website check	The website address you submit, the check result, the time of the check, a salted one-way hash of your IP address (we don't store the IP itself), and your email only if you ask us to email the report and tick the consent box	To run the check and show the result, let you reopen it for 30 days, limit abuse through rate limits, and email the report if you ask
Website cost calculator	Nothing. It runs entirely in your browser and sends nothing to our server. If you press "Send this estimate on WhatsApp", you choose to send the estimate text yourself.	—
Website planner	Nothing for the checklist pages. The optional "Personalise my plan" box (switched off at present) would send your one-line business description and chosen industry to generate a suggestion, which we don't store.	To show a suggested plan in your browser
WhatsApp, email or phone contact	Whatever you send us: your number, name, messages and files	To reply and to work on your project
Clients (after you hire us)	Contact and billing details, project content and materials you share, and records of payments	To deliver the project, invoice, provide support and maintenance, and meet tax and accounting obligations
Everyone who visits	Technical data such as IP address, browser and device type, pages requested, date and time, and security/error logs	To run, secure and fix the website, prevent abuse, and measure aggregate traffic

Please don't share sensitive information with us through the site, such as health records, patient details, passwords, or bank or card numbers. Clinics in particular: please don't upload patient data. If a project needs sensitive data, we'll agree a separate, secure way to handle it.

Paying us. You can't pay on nebulaforge.dev itself. When you pay NebulaForge as a client, the payment is processed by Razorpay. Your card or bank details go to Razorpay, and NebulaForge doesn't receive or store your full card number.

Payment gateways on client stores are different. We build online stores for clients that use Stripe or Razorpay for their customers' payments. On those stores, the client (not NebulaForge) is responsible for its customers' data and payments, and this policy doesn't cover them.

3. The basis on which we process your data

Under the DPDP Act, we process your data either:

with your consent (section 6), for example when you tick the consent box on the enquiry form, start a chat with Lyra, or ask us to email your website-check report. Consent must be free, specific, informed and unambiguous, and you can withdraw it at any time (see section 10); or
for a legitimate use (section 7), mainly where you have voluntarily given us your data for a specific purpose and haven't told us you object. An example is contacting us on WhatsApp or by email to ask for a quote. We use that data only for that purpose. We may also process data where the law requires it, for example to respond to a lawful order of a court or a government authority.

If you withdraw consent, we stop processing for that purpose. This doesn't affect anything done before you withdrew, and we may keep data where the law requires us to.

4. How we use AI

Lyra is an AI assistant. Lyra's replies are generated by Meta Llama 3.1 8B, an open model from Meta's Llama family, running on Cloudflare Workers AI (Cloudflare's AI service). When you chat with Lyra, our server first removes email addresses, phone numbers, verification codes and the name you gave us from your messages. It then sends the edited messages, the conversation so far and the page context to Cloudflare Workers AI so it can generate a reply. Your name, email and phone stay in our own records for your ticket and aren't sent to the AI model. If Cloudflare Workers AI is unavailable or busy, the same edited request goes to our backup AI provider, Groq (Groq, Inc., United States), which runs an open model (gpt-oss-20b). Both providers may process this data outside India.

Lyra's answers about our packages and terms come from our published facts and FAQs. Tickets raised through Lyra are visible to our team, who may follow up with you. Any final quote or commitment comes from our team, not from Lyra.
We don't use Lyra or any other AI tool to make decisions about you that have legal or similarly significant effects.
Cloudflare and Groq process this content as our AI service providers under their own terms. Cloudflare states that it doesn't use content sent to Workers AI to train AI models and doesn't keep it after the reply is delivered. Groq states that it doesn't use inputs or outputs to train models and may keep them for up to 30 days only to keep its service reliable and to investigate misuse. Even so, please don't share sensitive personal information with Lyra (for example health details, ID numbers or bank details). We'll update this section if our providers or their terms change.
We don't use your chats to train our own AI models, and we don't permit or intend that use.
Built with Llama. Lyra uses Llama 3.1, which is licensed under the Llama 3.1 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.

Free website check. If the optional AI summary is switched on (it is off at present), only the measured check results are sent to our AI service provider (Cloudflare Workers AI, or Groq as a backup), not your email or IP address, to write a plain-English summary.

Website planner. If "Personalise my plan" is switched on (it is off at present), your one-line business description and chosen industry are sent to our AI service provider (Cloudflare Workers AI, or Groq as a backup) to generate a suggestion. Please don't include personal details in it.

5. Cookies and similar technologies

No advertising or tracking cookies. We don't use advertising cookies, the Meta pixel, Google Analytics or Google Ads on this site.
Traffic measurement. We use Cloudflare Web Analytics, which counts page views without setting cookies or building a profile of you.
Sign-in cookie. After you verify your email in Lyra, we set a first-party session cookie that keeps you signed in to the chat for a limited period, so you can see "My tickets". It's strictly necessary for that feature and isn't used for tracking or advertising. When it expires, you can sign in again with a new email code.
Browser storage. Lyra uses your browser's session storage to keep your conversation as you move between pages. It uses local storage to remember your ticket references on that device. You can clear both in your browser settings.
Third-party content. The site loads fonts from Google Fonts and some code libraries from cdnjs (Cloudflare), so those services receive your IP address when the page loads. Videos only load from YouTube's privacy-enhanced mode (youtube-nocookie.com) if you press play.

If we ever add analytics or advertising cookies, we'll update this policy first and ask for your consent where the law requires it.

We don't sell your personal data. We share it only with service providers (Data Processors) who process it on our behalf to run the site and our business, and only as needed:

Provider	What they do for us	Data involved
Render (Singapore region)	Hosts our website, server and data storage	Everything submitted through the site
Cloudflare	Network delivery, security (DDoS and bot protection), Web Analytics, and code libraries (cdnjs)	IP address and technical request data
Zoho (Zoho Mail, India data centre)	Our business email	Emails you send us and our replies to you
Email delivery	Sending verification codes and requested reports by email, through our email service providers	Your email address and the code or report
Cloudflare Workers AI (Cloudflare, Inc.)	Runs the AI model (Meta Llama 3.1 8B) that generates Lyra's replies, and AI summaries or plan suggestions when those are enabled	Chat messages and context, with email addresses, phone numbers, verification codes and your name removed; measured website-check results; planner descriptions
Groq (Groq, Inc., United States)	Backup AI provider, used only when Cloudflare Workers AI is unavailable or busy	The same data as Cloudflare Workers AI, for those requests only
Google	PageSpeed Insights tests the speed of the URL you submit to the website check (when enabled). Google Fonts serves our fonts. Google Search Console gives us aggregate search statistics, not data about individual visitors.	The submitted URL; your IP address for fonts
Meta (WhatsApp)	Only if you choose to message us on WhatsApp	Your number and messages, under WhatsApp's own terms
Razorpay	Payment processing when clients pay NebulaForge	Payment details you give Razorpay
UptimeRobot	Checks that our site is online	No visitor personal data

We may also disclose data:

to comply with a law, court order or a lawful request from a government authority, including CERT-In
to protect our rights, our users or the public from fraud or security threats
to a successor if the business is transferred, in which case this policy will continue to apply to your data

7. Transfers outside India

We serve clients in Bangalore and around the world, and some of our providers process data outside India. These are Cloudflare's global network (including Cloudflare Workers AI, which may run AI requests in data centres outside India), our hosting on Render in Singapore, and our backup AI provider Groq in the United States. Google, Meta (WhatsApp) and UptimeRobot may also process data outside India. The DPDP Act allows such transfers unless the Government of India restricts transfers to a particular country, and we'll follow any such restriction. We choose providers that offer reasonable security commitments.

If you are outside India: NebulaForge is based in India, and this policy is written for Indian law. We'll honour requests to access, correct or delete your data wherever you live. Laws where you live, such as the GDPR in the EU or UK, may give you further rights. Contact us and we'll help. We don't claim certification or formal compliance under any foreign data protection law.

8. How long we keep data

We keep personal data only as long as needed for the purpose, or as the law requires, and then delete it.

Data	How long
Enquiries and Lyra chats that don't lead to a project, including tickets, transcripts and uploaded files	Up to 12 months after your last contact, then deleted
Client records (contact, project, invoices, payment records)	For the project and support period, then as long as tax and accounting laws require (generally up to 8 years)
Website check results, the IP hash and the optional email	30 days, then deleted automatically
Email verification codes	Short-lived: they expire within about 10 minutes
Server, security and access logs	180 days on a rolling basis, as required by CERT-In directions, or longer where another law requires it
Lyra session data in your browser	Until you close the tab (session storage) or clear it (local storage)

These are reasonable default periods we have set for our business. We'll review them as new rules under the DPDP Act take effect (including any minimum log-retention requirement) and update this table if they change.

If you ask us to delete your data, we'll do so unless the law requires us to keep part of it. In that case we'll keep only what's required and tell you.

9. How we protect your data

We use reasonable security practices, including:

HTTPS everywhere, with HSTS
a strict Content Security Policy
email verification before anyone can see a ticket
rate limits and protection against misuse of the website check (it won't fetch private or internal addresses)
storing IP addresses only as salted hashes in the website check
keeping access to personal data limited to the founders and those who need it
keeping secrets and API keys out of the website code

No system is perfectly secure, and we don't claim any security certification. If a personal data breach affects you, we'll inform you and the relevant authorities (the Data Protection Board of India and CERT-In) as the law requires.

10. Your rights

Under the DPDP Act, you have the right to:

Access: get a summary of the personal data we hold about you, what we do with it, and the processors we've shared it with.
Correction and updating: ask us to correct inaccurate or misleading data, complete incomplete data, or update it.
Erasure: ask us to delete your data when it's no longer needed for the purpose, unless the law requires us to keep it.
Withdraw consent: at any time, as easily as you gave it. We'll stop processing for that purpose, and the consequences, such as being unable to continue a chat or quote, will be explained.
Grievance redressal: raise a complaint with our Grievance Officer (section 14).
Nominate: name another person to exercise your rights if you die or become unable to do so.

How to exercise them. Email nebulaforge-main@nebulaforge.dev with the subject "Privacy request", or message +91 90351 43202. Tell us what you want and give us enough detail to find your data, such as the email you used or your ticket reference. To protect you, we may ask you to verify that the email or number is yours before acting.

How quickly we respond. We'll acknowledge your request within 2 working days and respond fully within 30 days. If we need more time, we'll tell you why.

Please also take care to give us accurate information and not to file false or frivolous complaints. The DPDP Act sets out these duties for individuals too.

11. Children

Our services are for businesses and adults. We don't knowingly collect personal data from anyone under 18 without the verifiable consent of a parent or lawful guardian, and we don't track, behaviourally monitor or target advertising at children. If you are under 18, please don't use the enquiry form, Lyra or the website check. Ask a parent or guardian to contact us instead. If we learn we've collected a child's data without that consent, we'll delete it.

12. Complaints to the Data Protection Board of India

If you're not satisfied with how we've handled your grievance, you can complain to the Data Protection Board of India under the DPDP Act. The law asks you to raise it with us first, and we'll try to resolve it quickly.

13. Changes to this policy

We may update this policy when our services, providers or the law change. We'll post the new version here with a new "Last updated" date. If a change materially affects how we use your data, we'll say so clearly on the site, and ask for fresh consent where the law requires it.

14. Contact and Grievance Officer

Grievance Officer and contact for privacy questions:
Shivanee Naik, COO & Co-Founder
Email: nebulaforge-main@nebulaforge.dev (subject: "Privacy request")
Phone / WhatsApp: +91 90351 43202
Address: VMP2+7XG, Shiva Temple Rd, Kudlu, AECS Layout - A Block, Hal Layout, Bengaluru, Karnataka 560068, India

We aim to resolve every grievance within 30 days of receiving it.