NameLore Global Privacy Policy

1. Who We Are

We are the Data Controller responsible for the processing of your Personal Data described in this Policy.

2. The Data We Collect About You

We collect Personal Data, which is any information that relates to an identified or identifiable individual. We collect the following categories of data:

3. How We Collect Your Data

We use different methods to collect data from and about you, including:

• Direct Interactions: You provide data when you create an account, purchase credits, submit name analysis queries, or contact support.
• Automated Technologies: As you interact with our Services, we automatically collect Technical and Usage Data via server logs and similar tracking technologies (like cookies or pixels).
• Third Parties or Publicly Available Sources: We receive basic Identity and Authentication Data from third-party authentication services (like Google OAuth) when you choose to use them to sign in.

4. How and Why We Use Your Data (Legal Basis)

We rely on specific legal grounds to process your Personal Data.

5. AI, Profiling, and Automated Insights

NameLore utilizes Artificial Intelligence (AI) to generate deep name analyses and insights based on your queries. This process involves profiling—the automated processing of data to evaluate or analyze certain personal aspects (the submitted queries).

Profiling Limitations: Our AI profiling is used solely to deliver the specific, requested service (e.g., name compatibility analysis) for which you contracted. This automated processing does not produce decisions that have legal or similarly significant effects on you (e.g., determining eligibility for credit, insurance, or employment).

Data Used for AI Training: We commit that the NameLore Query Data you submit (your prompts and outputs) are not used to train or improve our AI models. This data is only processed for the security monitoring of the Services and the immediate delivery of your requested analysis.

6. Disclosures and Sharing of Your Personal Data

We share your Personal Data with the following categories of recipients for the purposes described below:

6.1. Third-Party Service Providers (Processors)

We engage third parties to perform services on our behalf. These service providers, acting as Data Processors, are contractually required to maintain confidentiality and security measures and are only authorized to use your Personal Data to perform the services we have instructed them to provide. These include:

• Hosting Providers (e.g., cloud services for data storage).
• Security and Abuse Monitoring Services.

6.2. Payment Processors (Joint Controllers)

We use PayPal to process payments and manage your credit ledger. PayPal collects and processes your Transactional Data and Technical Data.

PayPal's Role: PayPal acts both as a Service Provider (to handle our billing) and independently as a Data Controller for its own purposes, such as fraud detection, loss prevention, and authentication of transactions.

Transparency: For detailed information on how PayPal processes your data for its own Controller activities, please review PayPal's Privacy Policy directly. We maintain a mandatory Data Processing Agreement (DPA) with PayPal to ensure compliance.

6.3. International Data Transfers

As a global service, your Personal Data may be transferred and stored outside of your country of residence, including outside the European Economic Area (EEA), such as to the United States. When transferring data internationally, we rely on established legal frameworks, primarily the use of Standard Contractual Clauses (SCCs), to ensure your data receives adequate protection regardless of location.

7. Data Retention: How Long We Keep Your Data

We only retain Personal Data for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

General Data Retention

Upon deletion of your account, Identity, Query, and most Technical Data will be deleted or effectively anonymized within 90 days, except for the necessary Transactional Data which will be isolated and retained for the seven-year legal period. Technical logs used for security monitoring are typically retained for 12 to 24 months.

8. Your Data Protection Rights

Depending on your location, you have significant rights regarding your Personal Data. To exercise any of these rights, please submit your request through our dedicated web form or email us at privacy@namelore.com.

We are obligated to verify your identity before fulfilling certain requests. We will respond to your requests within the legally required timeframe (e.g., 30 or 45 days).

8.1. Rights Under GDPR (EEA Residents)

You have the following rights:

• Right to be Informed: The right to be clearly informed about our data practices (as detailed in this Policy).
• Right of Access: The right to request copies of your Personal Data.
• Right to Rectification: The right to request that we correct any information you believe is inaccurate or incomplete.
• Right to Erasure (Deletion): The right to request the deletion of your Personal Data, subject to our overriding legal obligations (see Section 7).
• Right to Restrict Processing: The right to request that we limit the way we use your data.
• Right to Data Portability: The right to request that we transfer the data we collected to another organization or directly to you, in a structured, machine-readable format.
• Right to Object: The right to object to processing based on Legitimate Interest or for direct marketing purposes.
• Rights in Relation to Automated Decision-Making and Profiling: The right to object to profiling that has a significant effect on you.

8.2. Rights Under CCPA/CPRA (California Residents)

You have the following rights:

• Right to Know: The right to request specific pieces of Personal Data we have collected, used, disclosed, or sold/shared about you in the preceding 12 months.
• Right to Delete: The right to request the deletion of your Personal Data, subject to certain exceptions.
• Right to Correct: The right to request the correction of inaccurate Personal Data.
• Right to Opt-Out of Sale or Sharing: The right to direct us not to sell or share your Personal Data.

9. Children's Privacy

The NameLore Services are not directed at, or intended for, children under the age of 13. We do not knowingly collect Personal Data from children under 13. If you believe we have unknowingly collected data from a child under this age, please contact us immediately at privacy@namelore.com, and we will take necessary steps to investigate and delete that information.

10. Data Security and Breach Notification

We implement reasonable technical and organizational security measures designed to protect your Personal Data from accidental loss, unauthorized access, alteration, or disclosure. These measures include encryption (in transit and at rest) and strict access controls.

In the event of a Personal Data breach, we will notify affected users and necessary supervisory authorities promptly, in accordance with applicable legal requirements.

11. Changes to This Privacy Policy

We may update this policy periodically to reflect changes in our practices or applicable laws. We will notify you of any material changes by posting the updated policy on this page and updating the "Last Updated" date at the top of the policy. We are legally required to review and update this policy at least once every 12 months.