Privacy Policy

Version 2026-09-26 · Operator: Consult Sciences Ltd (https://www.consultsciences.com)

1. Summary

Nebula AeAH AI is an account-based literature service: you sign in with a one-time magic link sent to your email address, build publication evidence maps, and may subscribe to paid plans that unlock exports and scheduled paper-alert digests. We store your email address, your plan and service settings, and minimal usage and security records. Payments are processed entirely by Stripe — your card details never reach our servers. We run no advertising, no analytics trackers, and we never sell personal data.

2. Data controller

Consult Sciences Ltd is the data controller for personal data processed through Nebula AeAH AI. Contact us via our contact form or www.consultsciences.com.

3. What we collect

• Account data: your email address (your sign-in identity), your plan (Beta / Pro / Enterprise), and account timestamps.
• Sign-in data: single-use, short-lived magic-link tokens and session tokens — both stored only as cryptographic hashes, never in readable form.
• Service data: query alerts you create (the query text, on/off state, and last-sent metadata); your recent searches cached server-side for roughly 24 hours so we stay within OpenAlex's polite usage; daily quota counters.
• Security data: rate-limit events (IP address, endpoint, timestamp) and minimal operational logs, kept for abuse prevention and troubleshooting.
• Payment data: your Stripe customer ID, subscription ID, plan, status and billing period. We never receive or store card numbers, expiry dates or CVC codes — those are entered on Stripe's hosted checkout page.
• Local storage (strictly necessary): the key nebula-consent-v1 storing {v, analytics, termsVersion, acceptedAt} as proof of your consent-gate choices. It never leaves your device.

4. Cookies & local storage

• nebula_sid — one strictly necessary, first-party session cookie. HttpOnly, SameSite, and marked Secure in production. Keeps you signed in for up to 30 days. It contains a random token; the matching session lives (hashed) on our server.
• nebula-consent-v1 — localStorage record of your consent-gate decisions (see §3).
• No third-party cookies. No analytics cookies. No advertising cookies. All page scripts are served from our own origin (vendored libraries, enforced by our Content-Security-Policy).

5. Why we process your data (lawful bases, GDPR)

• Performance of a contract — Art. 6(1)(b): operating your account, delivering searches and evidence maps, processing plan upgrades and refunds, and sending the digest emails you explicitly subscribed to.
• Legitimate interests — Art. 6(1)(f): rate limiting, abuse prevention, securing the service, and keeping it reliable.
• Legal obligation — Art. 6(1)(c): retaining the consent record, and keeping payment/billing records as required by accounting and tax law.
• Consent — Art. 6(1)(a): any future optional, non-essential scripts would run only behind the consent gate after an explicit "Accept all". None exist today.

6. Who we share data with

• Stripe (payments): handles checkout, subscriptions, invoices and refunds. Stripe is the controller for the payment data you enter on its pages; see Stripe's privacy policy.
• Our email/SMTP provider: delivers transactional email — magic-link sign-ins and the digest emails for alerts you created.
• OpenAlex (literature metadata): searches are performed server-side; your search terms are transmitted to api.openalex.org as part of the query, together with our contact address (not yours). OpenAlex's own privacy practices apply to their service.
• Hosting provider: the application and its PostgreSQL database run on our VPS. No other party receives your data. We do not sell or rent personal data, ever.

When you click "Open Paper", your browser navigates to doi.org or the publisher — an ordinary, user-initiated outbound link, with nothing preloaded or tracked by us.

7. Retention

• Account and plan data: for as long as your account exists; erased when you ask us to delete the account.
• Sessions: expire automatically after 30 days; magic-link tokens expire within minutes.
• Search cache: rolling ~24-hour TTL.
• Rate-limit records: deleted automatically within 24 hours. Minimal audit records (such as export events) are kept only for abuse prevention and troubleshooting.
• Billing records: kept as long as required by tax and accounting law.

8. Your rights (GDPR)

You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with the Data Protection Commission (Ireland) (www.dataprotection.ie) or your local supervisory authority. To exercise any right, use our contact form. Deleting your account erases your email address, sessions and query alerts; the single consent record lives only in your own browser and can be cleared at any time via "Cookie settings" or your browser.

9. Security

All traffic is served over TLS. Session and magic-link tokens are random values stored only as hashes. Database credentials and API keys exist only in the deployment environment — never in source code — and card data never touches our systems at all.

10. International transfers

Our processors may process data outside the EEA. Where they do, transfers rely on adequacy decisions, the EU Standard Contractual Clauses, or equivalent safeguards. We keep transfers to the minimum needed to run the service.

11. Children

Nebula AeAH AI is not directed at children. The consent gate requires confirmation that you are 16 or older.

12. Changes

Material changes to this policy bump the version date above; returning visitors re-acknowledge it through the consent gate. See also our Terms & Conditions and Refund Policy.