Privacy Notice — Nebula IR35

Last updated 19 August 2026. This notice covers the IR35 assessment service at ir35.nebulafin.co. The wider Nebula Finance website has its own privacy policy.

Who we are

The controller is Nebula Finance Ltd, a company registered in England & Wales (company no. 12362614), 124 City Road, London EC1V 2NX. ICO registration ZB175468. Contact: ir35@nebulafin.co.

What we collect

Account data — email address, name, password (held by AWS Cognito; we never see or store your password ourselves), sign-in timestamps.
Assessment data — your questionnaire answers, contractor and end-client names, engagement title and dates, day rate, agency/umbrella name, and the verdict, scores, confidence and reasoning the engine produces about your engagement.
Documents — any contract you upload (the file itself and extracted text), and any documents a specialist returns to you.
Payment data — amount, currency and any promotion code, via Stripe. Card details are entered on Stripe-hosted pages and never touch our servers.
Free-check email — the address you give before starting the free check, and whether you ticked the optional updates box. We use the address to email you a link back to your result (performance of the service you asked for), and for updates about Nebula products only if you ticked the box — which is never pre-ticked, and which you can withdraw any time via the unsubscribe link. A signed cookie remembers that this browser has already given an email so we don't ask twice.
Technical data — IP address for rate limiting (deleted within ~1 day of the limiting window closing), and analytics events only if you accept optional cookies.

Please do not upload documents containing special-category data (e.g. health information); the assessment does not need it.

What we do with it, and why we may

Producing your assessment — performance of our contract with you (UK GDPR Art 6(1)(b)).
Retaining assessments for the HMRC enquiry window — legitimate interests and your own (Art 6(1)(f)): a status determination is evidence you may need for up to 6 years.
Human specialist review — when you request it or when a case is escalated: contract performance and legitimate interests in accuracy.
Waitlist and marketing email — consent (Art 6(1)(a)); marketing beyond the one launch notification happens only if you tick the optional box, and you can unsubscribe any time.
Security, rate limiting, audit records — legitimate interests in running the service safely and keeping a tamper-evident record of determinations.

Automated decision-making

Your IR35 result is produced by solely automated processing, including AI models — no human reviews it before you see it. The result is decision-support that records your own assessment; it is not a determination Nebula makes on your behalf, and it is not binding. We recommend having any result — especially a borderline one — independently reviewed by a qualified IR35 specialist before you rely on it. If you think a result is wrong, you can make representations about it or dispute it by emailing ir35@nebulafin.co with your review reference; where a qualified specialist reviews your case and corrects the result, the correction supersedes the automated verdict on your report. Nebula does not operate an automatic human-review workflow.

Who receives your data

We use these processors to run the service (each receives only what its role needs):

Anthropic and Google — AI assessment of your answers and contract text (Google also performs OCR on scanned uploads). These are US-headquartered providers; transfers are made under their data-processing terms.
Amazon Web Services (Cognito) — sign-in and account credentials.
Neon — our database (assessments, documents).
Vercel — hosting, and analytics only with your consent.
Stripe — payments.
Resend — transactional email (report-ready, sign-in links).
HubSpot — the Aurora waitlist, if you join it.
Companies House — receives only the company-name search text you type when looking up a company.
IR35 specialist partner firms — if your case is routed for expert review, the reviewing firm receives your assessment and contract. Specialist firms act as independent professionals responsible for their own opinions.

If an end client is assessing you

Some organisations use Nebula to run the status determinations they owe under the off-payroll working rules. Where an engagement record is created inside a client organisation's account, that organisation decides what is collected and why: they are the controller of that record and we act as their processor, handling it on their instructions. We remain the controller of their own account data (names, work email addresses, sign-in times).

If you are the worker being assessed, you may be sent a link asking for your account of how the engagement actually runs. You do not need an account with us to use it, we do not ask you for a password, and the link is single-use and expires after 21 days. Your answers go to the client organisation that sent it — they will see them, and where they differ from their own hiring manager's account, the client has to record which account it relies on and why. We store only a hash of the link, so the link itself cannot be recovered from our systems.

Your answers are one input to that organisation's decision. They are not a determination, and nothing we produce is advice to you. To exercise your rights over an engagement record — access, correction, erasure, objection — contact the client organisation that is assessing you, since they control it; if you contact us instead we will pass the request on to them and tell you we have done so.

How long we keep it

Assessments and uploaded contracts — 6 years from the engagement end date (the HMRC enquiry window), then deleted automatically. You can delete any individual assessment earlier from your dashboard, which also deletes its documents.
Deletion records — when an assessment is deleted, a minimal tombstone (who deleted what, when, and the record's integrity hashes — not the content) is retained as an audit trail.
Account records — kept while your account is active; ask us to remove your account and we will review the request against any retention duty that applies.
End-client engagement records — kept for as long as the client organisation that controls them needs them, and deleted on their instruction. HMRC can open an enquiry for years after an engagement ends, so a client keeping the file that shows it took reasonable care is doing so for a reason.
Worker invite links — stored only as a hash, and in any case usable once and for no more than 21 days.
Rate-limiting IPs — deleted within about a day of the limiting window closing.

Your rights

You can ask for access to your data (your dashboard includes a download of your assessments), correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. For the automated determination itself, the safeguards above apply. Contact ir35@nebulafin.co to exercise any right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

Cookies

Essential cookies run sign-in sessions and your cookie choice itself. Optional cookies (analytics, referral attribution) are set only if you choose “Accept all” on the banner, and you can change your choice any time via “Cookie settings” in the footer.

Questions about this notice: ir35@nebulafin.co. See also the IR35 service disclaimer.