Nebula Finance

Privacy Notice — Nebula IR35

Last updated 3 August 2026. This notice covers the IR35 assessment service at ir35.nebulafin.co. The wider Nebula Finance website has its own privacy policy.

Who we are

The controller is Nebula Finance Ltd, a company registered in England & Wales (company no. 12362614), 124 City Road, London EC1V 2NX. ICO registration ZB175468. Contact: ir35@nebulafin.co.

What we collect

  • Account data — email address, name, password (held by AWS Cognito; we never see or store your password ourselves), sign-in timestamps.
  • Assessment data — your questionnaire answers, contractor and end-client names, engagement title and dates, day rate, agency/umbrella name, and the verdict, scores, confidence and reasoning the engine produces about your engagement.
  • Documents — any contract you upload (the file itself and extracted text), and any documents a specialist returns to you.
  • Payment data — amount, currency and any promotion code, via Stripe. Card details are entered on Stripe-hosted pages and never touch our servers.
  • Technical data — IP address for rate limiting (deleted within ~1 day of the limiting window closing), and analytics events only if you accept optional cookies.

Please do not upload documents containing special-category data (e.g. health information); the assessment does not need it.

What we do with it, and why we may

  • Producing your assessment — performance of our contract with you (UK GDPR Art 6(1)(b)).
  • Retaining assessments for the HMRC enquiry window — legitimate interests and your own (Art 6(1)(f)): a status determination is evidence you may need for up to 6 years.
  • Human specialist review — when you request it or when a case is escalated: contract performance and legitimate interests in accuracy.
  • Waitlist and marketing email — consent (Art 6(1)(a)); marketing beyond the one launch notification happens only if you tick the optional box, and you can unsubscribe any time.
  • Security, rate limiting, audit records — legitimate interests in running the service safely and keeping a tamper-evident record of determinations.

Automated decision-making

Your IR35 result is produced by solely automated processing, including AI models — no human reviews it before you see it. The result is decision-support that records your own assessment; it is not a determination Nebula makes on your behalf, and it is not binding. We recommend having any result — especially a borderline one — independently reviewed by a qualified IR35 specialist before you rely on it. If you think a result is wrong, you can make representations about it or dispute it by emailing ir35@nebulafin.co with your review reference; where a qualified specialist reviews your case and corrects the result, the correction supersedes the automated verdict on your report. Nebula does not operate an automatic human-review workflow.

Who receives your data

We use these processors to run the service (each receives only what its role needs):

  • Anthropic and Google — AI assessment of your answers and contract text (Google also performs OCR on scanned uploads). These are US-headquartered providers; transfers are made under their data-processing terms.
  • Amazon Web Services (Cognito) — sign-in and account credentials.
  • Neon — our database (assessments, documents).
  • Vercel — hosting, and analytics only with your consent.
  • Stripe — payments.
  • Resend — transactional email (report-ready, sign-in links).
  • HubSpot — the Aurora waitlist, if you join it.
  • Companies House — receives only the company-name search text you type when looking up a company.
  • IR35 specialist partner firms — if your case is routed for expert review, the reviewing firm receives your assessment and contract. Specialist firms act as independent professionals responsible for their own opinions.

How long we keep it

  • Assessments and uploaded contracts — 6 years from the engagement end date (the HMRC enquiry window), then deleted automatically. You can delete any individual assessment earlier from your dashboard, which also deletes its documents.
  • Deletion records — when an assessment is deleted, a minimal tombstone (who deleted what, when, and the record's integrity hashes — not the content) is retained as an audit trail.
  • Account records — kept while your account is active; ask us to remove your account and we will review the request against any retention duty that applies.
  • Rate-limiting IPs — deleted within about a day of the limiting window closing.

Your rights

You can ask for access to your data (your dashboard includes a download of your assessments), correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. For the automated determination itself, the safeguards above apply. Contact ir35@nebulafin.co to exercise any right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

Cookies

Essential cookies run sign-in sessions and your cookie choice itself. Optional cookies (analytics, referral attribution) are set only if you choose “Accept all” on the banner, and you can change your choice any time via “Cookie settings” in the footer.

Questions about this notice: ir35@nebulafin.co. See also the IR35 service disclaimer.