Privacy Policy — Nebul Player

Last updated: 22 October 2026 · version 1.5 Privacy contact: contato@nebulplayer.com

This is the English translation of the Privacy Policy of Nebul Player. The Portuguese version, available at nebulplayer.com/privacy.html, is the governing version in case of any discrepancy.

Nebul Player is a media player software compatible with connected devices.

Nebul Player does not provide, does not sell and does not commercialise channels, playlists or any streaming content. Any and all content played is the sole responsibility of the access provider or operator configured by the user.

1. Data we process, and how it works

• Access credentials for the provider's service (server, username and password): There are two technical paths, depending on the configuration model adopted:
  1. Direct configuration on the device by the user: the credentials are entered in the application and sent over an encrypted connection (HTTPS/TLS) to Nebul's servers, where they are stored encrypted in order to enable authentication and the technical intermediation of the playback requested by the device;
  2. Configuration by the operator/provider in the management Console: the credentials are registered in encrypted form on Nebul's servers and your device receives only an activation key/code. In both cases, the encrypted credentials and the session records are stored in protected form in the database in order to enable access and technical support. The expiry of a session or token invalidates the authorisation to use the device, but does not automatically delete the encrypted record. The data subject may request deletion through the privacy channel, subject to the legal grounds for retention.
• Device identifier (generated by the app): A unique technical identifier generated at the time of installation, used strictly for activation, licence validation and control of the simultaneous screen limit.
• Playback progress ("Continue watching"): When the feature is in use, we record in the database the technical fields required for synchronisation: item identifier, series identifier (where applicable), media type (film or series), season, episode, title, cover image URL, playback position, total duration, completion flag, update dates and the link to the operator and to the user of the external server. Live broadcast channels do not generate records in this table.
• Technical access and security records (Logs): We process two distinct categories of records:
  1. Internal audit events: records of selected operational and security actions, with the IP address transformed into a cryptographic digest (hash). The operational routine deletes ordinary events after 180 days; acceptance records are preserved as evidence of consent or of adherence;
  2. Web server operational logs (Nginx): traffic and network request records that include the remote IP address. The server applies periodic rotation; copies may exist in backups and edge services. The retention period for these records depends on the infrastructure and on the applicable legal obligations.
• Operators of the Management Console: For partners registered in the panel, we process corporate registration data, logs of acceptance of the terms and the billing history of software licences.

2. How we use the data

We use the data strictly in order to:

1. Enable the technical operation, authentication and intermediation of the media playback requested by the application;
2. Validate device licences and simultaneous screen limits;
3. Maintain cybersecurity, prevent fraud and ensure the stability of the infrastructure;
4. Provide operational support and comply with applicable legal obligations.

We do not sell personal data, we do not build consumption profiles and we do not display third-party advertising inside the application.

3. Technical communication and sharing of information

We do not commercialise personal data. Communication with external services takes place exclusively for the following operational purposes:

• The provider's external server: at the moment of authentication and of the media requests made by the device, the necessary data is transmitted to the external server configured by the user or operator;
• Public metadata lookup (TMDb): when the artwork lookup feature is enabled, the title of the work being looked up is sent to the public API of The Movie Database in order to obtain images and synopses, without sending the user's registration data, e-mail addresses or passwords;
• Processing of partner payments: subscriptions to operator plans in the management Console are processed directly by specialised payment intermediaries (e.g. Stripe);
• Technical infrastructure providers: hosting and database services operating under strict security and confidentiality agreements;
• Compliance with legal orders: responding to requests from competent judicial or administrative authorities, under the terms of the Brazilian Internet Civil Framework (Marco Civil da Internet).

4. Storage, security and retention

• Encryption in transit and at rest: all transmissions between the application, the website and Nebul's servers take place over secure protocols (HTTPS/TLS), and credentials are written with strong encryption.
• Connection to the origin provider: the connection between the intermediary infrastructure and the final server of your provider depends on the technology made available by that provider, and is the responsibility of the provider you have contracted.
• Retention and disposal periods:
  • Internal audit events: subject to the 180-day routine, with preservation of acceptance records; web logs and their copies follow the configuration of the infrastructure and the applicable legal obligations;
  • Encrypted credentials and registration data: may remain after the expiry of a session. The data subject may request their deletion through the privacy channel, subject to the legal grounds for retention;
  • Local data: favourites and interface preferences may be deleted at any time by the user, by uninstalling the app or clearing the local data on the device.

5. Your rights (LGPD — Brazilian General Data Protection Law, Law No. 13,709/2018)

At any time, and upon request, you may:

• Confirm the existence of processing and request information about your data;
• Request the correction of incomplete or out-of-date data;
• Request the deletion of data held on our servers through the support channel indicated in Section 7 (subject to the cases of mandatory retention by law or legitimate interest);
• Delete your local data directly in the settings of your device.

To exercise your rights, send a message to our privacy channel: contato@nebulplayer.com.

6. Children and parental control

The application provides a Parental Control tool with PIN lock, allowing parents and guardians to restrict access to sensitive categories. The application is not directed at minors who are not accompanied by their guardians.

7. Privacy contact

For questions, requests or enquiries about privacy and data protection:

📧 contato@nebulplayer.com