Roadstar Privacy Policy

Nebulae Laboratories Inc., operating as Roadstar ("Roadstar," "we," "us," or "our"), provides the website at https://www.roadstar.app/ and related research features (the "Service"). We are responsible for the personal information described in this policy and act as its controller where that term applies.

This policy explains how we collect, use, disclose, and retain personal information when you browse research, create an account, follow pages, submit questions or other content, or contact us. Roadstar organizes sources and AI-assisted research around questions, theses, companies, and topics. Some features described here apply only when available and when you use them.

This policy does not govern independent publishers or other websites that we link to. If we process information solely on behalf of a business customer under a separate data-processing agreement, that customer's instructions and privacy notice govern that processing, subject to applicable law.

Account information. When you register, we collect your name, email address, and authentication information, including the password you submit to create or access your account. We also process account settings and account-related communications.

Research activity and preferences. We collect information about pages you follow, saved items, searches, questions, topic preferences, and interactions with research features. Where chat or similar features are available, this includes prompts, conversation history, and generated responses associated with your use.

Content you provide. We process questions, supporting context, source links, evidence, comments, theses, and other material you submit through available features. This material may contain personal information about you or other people. Please provide only information you are entitled to share and that is necessary for your intended use.

Support and communications. We collect your contact details, the contents of your messages, and relevant records when you contact us, provide feedback, or request help.

Technical and usage information. We collect information such as IP address, browser and device characteristics, pages or features accessed, timestamps, referring pages, session identifiers, and diagnostic or security logs. An IP address may indicate an approximate location. Cookies and similar technologies are addressed in Section 5.

Public-source information. Research materials may contain authors' names, professional affiliations, public statements, and other information about identifiable people. We obtain this information from public websites, publications, filings, source providers, and sources submitted by users. Source links or attribution identify the underlying material where available.

Payment information, if paid features are offered. We may receive billing contact details, plan information, transaction identifiers, payment status, and limited payment-method information. The payment provider identified at checkout processes payment credentials under its own privacy notice.

Inferences. We may infer research interests from your follows and interactions to organize or recommend relevant research. A research interest does not necessarily reflect your beliefs, financial position, health, or investment holdings.

We use the information described above for the following purposes. Where the European Economic Area (EEA) or UK data-protection rules apply, the corresponding legal bases are set out below.

We rely on legitimate interests only where those interests are not overridden by your rights. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. Providing some information, such as an email address and authentication details, is necessary to create an account. Without information needed for a requested feature, we may be unable to provide it.

Roadstar uses AI to help research questions, summarize sources, extract information, and organize evidence. Relevant prompts, supporting context, source material, and associated content may be sent to AI service providers to produce a result. Processing may also involve troubleshooting, security review, and evaluating the quality of responses.

Content submitted through a public publishing feature, including questions, research pages, evidence, and any attribution shown with them, can be viewed, copied, and indexed by others. Review the publication notice before submitting. A context field labeled as not shown on the finished page is used to guide research; its contents may still influence the generated answer. Avoid placing confidential material or unnecessary personal information in a question or its supporting context.

Public pages may remain available after an account is closed, subject to applicable deletion rights and our retention practices. Copies already made by independent users or search engines may remain outside our control.

The research and personalization features described here organize information; they are not intended to make decisions about your eligibility for credit, employment, insurance, or comparable opportunities. If we introduce automated decisions about you with legal or similarly significant effects, we will provide the information and safeguards required by applicable law.

We use cookies or similar storage to support functions such as authentication, session continuity, security, and remembering settings. Analytics or other optional technologies may collect device identifiers and usage information to help us understand how the Service is used.

Where consent is required, optional technologies are used only after that consent is obtained. Where an exception permits use without consent but requires an objection mechanism, we provide that mechanism. You can also block or delete cookies through your browser, although doing so may affect sign-in and other features. A browser setting does not necessarily control every server-side use of information.

Where required by applicable law, we honor recognized opt-out preference signals, such as Global Privacy Control, for the activities they cover. Traditional "Do Not Track" signals are distinct from these legally recognized signals.

Service providers. We disclose relevant information to providers that support hosting and storage, authentication, AI processing, communications, analytics, security, customer support, and payment processing, as applicable. Providers processing information on our behalf are subject to appropriate contractual restrictions. Any AI provider's independent uses must be described in Section 4.

At your direction. We disclose information when you publish content, request an integration or transfer, or otherwise direct us to share it. An independent service you choose may have its own privacy terms.

Legal and safety purposes. We may disclose information when reasonably necessary to comply with law or valid legal process, investigate abuse, protect rights or safety, or establish, exercise, or defend legal claims.

Business transactions. Information may be disclosed to advisers and counterparties in connection with a financing, merger, acquisition, reorganization, or sale of business assets, subject to appropriate confidentiality and legal protections. We will give any legally required notice of changes affecting your information.

With permission. We may disclose information for another purpose with your consent where required.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including applicable legal, accounting, and security requirements. We determine retention by the type and sensitivity of the information, the feature it supports, whether the account or publication is active, and any applicable legal obligation or unresolved dispute.

• Account information and research preferences are kept while needed to maintain your account and requested features. After closure or a valid deletion request, we delete or de-identify them unless a permitted reason requires continued retention.
• Public contributions and associated attribution are retained while the publication remains available and there is a lawful reason to retain them, subject to applicable rights and removal requests.
• Support records, diagnostic logs, and security records are kept for the period needed to resolve issues, investigate incidents, and protect the Service. Records relevant to a dispute may be kept until that matter is resolved.
• Billing and transaction records, if any, are retained for the applicable tax, accounting, and legal periods.

Deletion from backup systems may occur through their normal replacement cycle; retained backup information is protected and is not used for ordinary product purposes. Contact us if you want more detail about retention for a particular category. The AI-provider practices specified in Section 4 also apply to information sent to those providers.

We use reasonable administrative, technical, and organizational measures appropriate to the nature of the information to protect it. No system is completely secure. Please use a strong, unique password and contact us promptly if you suspect unauthorized account access.

You can contact john@nebulae-labs.com to request information about applicable transfer safeguards and, where available, a copy, subject to appropriate redactions.

You can request account corrections, account closure, deletion, or assistance with privacy choices by emailing john@nebulae-labs.com. Where settings provide the relevant controls, you may also change preferences or unfollow pages directly. You can unsubscribe from optional marketing messages using their unsubscribe instructions. Essential security, account, and transaction messages may still be sent.

Depending on your location and the law that applies, you may have rights to access your personal information; receive a portable copy; correct inaccuracies; delete information; restrict processing; withdraw consent; and complain to a data-protection authority.

Right to object. Where applicable, you may object to processing based on legitimate interests, including related profiling, because of your particular situation. You may object to direct marketing at any time. Email john@nebulae-labs.com to exercise these rights.

EEA residents may complain to their local data-protection authority, UK residents to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/, and Swiss residents to the Federal Data Protection and Information Commissioner at https://www.edoeb.admin.ch/. You do not have to contact us first to exercise a right to complain to a regulator.

Where US state privacy laws apply to our processing, residents may also have rights to know the categories and specific pieces of information collected, used, or disclosed; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; and appeal a denied request. Applicable categories, sources, purposes, and recipients are described in Sections 2–6; the completed Section 5 states our sale and sharing practices.

To submit a request or appeal, email john@nebulae-labs.com, describe the request, and identify the account or information concerned. We may request information reasonably necessary to verify your identity and an authorized agent's authority where appropriate. Opt-out requests will not require identity verification where prohibited by law. We respond within the applicable legal time limits and explain any lawful refusal or extension. We do not unlawfully discriminate against you for exercising privacy rights.

Roadstar is intended for people who are at least 18 and have reached the age of legal majority where they live. We do not knowingly collect personal information from children under 18. If you believe a child has provided information to us, contact john@nebulae-labs.com so we can investigate and take appropriate action, including deletion where required.

We may update this policy as the Service or our practices change. We will update the effective date and provide additional notice of material changes where required. If a change requires consent, we will obtain it before the relevant new processing. Using the Service does not by itself constitute consent to processing that legally requires separate consent.