Integritetspolicy

1. Controller and scope

The controller responsible for the personal data described in this policy is:

NamingStudio.ai Georg-Löwenstein-Str. 34 10317 Berlin Germany Email: hello@namingstudio.ai

This policy covers two things together, because they are run by the same controller and often by the same sub-processors: this website, and the naming service offered through it at app.namingstudio.ai ("the app"). Where a section applies to only one of the two, it says so.

We have not appointed a Data Protection Officer. At our size, none is required under Article 37 GDPR.

2. What we collect, and why

Visiting this website

Visiting namingstudio.ai does not require you to submit any personal data. What is unavoidable:

• Server and CDN logs. Our hosting provider, Vercel, processes standard connection data (IP address, requested URL, timestamp, user agent) to deliver pages and to keep the service secure. This is a legitimate interest under Article 6(1)(f) GDPR — operating a website requires it — and the data is not used for anything beyond operating and securing the site.
• Two essential cookies. NEXT_LOCALE remembers which language you were shown, and cookie_consent remembers the choice you make in the banner described below. Neither carries identifying information beyond that one preference, and both are strictly necessary for the site to behave consistently, so they are set without asking for consent, consistent with Art. 5(3) of the ePrivacy Directive and the equivalent German rule in § 25(2) No. 2 TTDSG. The full list, with exact durations, is in the cookie policy.
• Website performance and usage metrics. We use Vercel Speed Insights to see how fast pages load, and Vercel Web Analytics to see which pages are visited. Both are cookie-free and report aggregated, non-identifying data; they are not used to track you individually across visits and rely on the same legitimate interest as the server logs.

We do not currently run a newsletter or any other mailing list. If that changes, we will describe it here and ask for your opt-in consent first.

Writing to us

The "Contact" page links a mailto: address rather than a form on this site, so whatever you send — your email address, your name if you give one, and the content of your message — reaches our mailbox directly and is not processed through any system of ours in between. We use it only to answer you, under Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries) or Article 6(1)(b) GDPR where your message concerns a contract.

Using the naming service

If you use the app, we process more, because the service cannot be delivered otherwise:

• Account and billing data: your name, business email, company name, and the billing details needed to invoice you. Legal basis: Article 6(1)(b) GDPR, performance of the contract described in our Terms of Service.
• The content of your naming briefing and any feedback you give: the category, markets, languages, audience and constraints you describe, and anything you tell us during a feedback round. This is the input the service runs on. Please do not include personal data about third parties in a briefing beyond what the project genuinely requires — a target audience description does not need named individuals.
• The results we generate for you and the record of which runs and feedback rounds you purchased, for as long as your account exists.
• Payment data: card and payment-method details are collected and processed directly by our payment processor, Stripe; we do not store full card numbers ourselves. We hold the invoice and transaction records Stripe provides us.

Legal basis for all of the above is Article 6(1)(b) GDPR, with billing records additionally resting on Article 6(1)(c) GDPR (our legal obligation to keep accounting records under German tax and commercial law).

3. How AI processing works

Generating names, research summaries and recommendations requires sending the content of your briefing to an AI model. We use Google's Gemini API for this. Google processes that content as our processor, under a data processing agreement, to return a result to us — not to build its own product. Under Google's standard API terms for this product, content submitted through the API is excluded from being used to train Google's general-purpose models; we have not agreed to anything that would change that.

This is also the limit of what the AI processing does: it produces drafts, research summaries and recommendations. What we claim on this website, which numbers we use and what we publish is decided and checked by a person — see how this site is made for the equivalent disclosure that applies to the content of this website itself.

4. Who else receives your data

We do not sell personal data, and we do not share it with anyone for their own marketing purposes. The parties below process data on our behalf, under a data processing agreement, strictly to help us run the website or the service:

Processor	Purpose	Where
Vercel	Hosting, content delivery, Speed Insights and Web Analytics for this website	Global CDN; this project's compute is pinned to the EU (Frankfurt)
Lovable	The platform the app is built and run on	—
Supabase	Database for the app — accounts, briefings, results	Ireland, EU
Google	AI processing of briefing content via the Gemini API	United States and other Google data-centre locations
Stripe	Payment processing and billing	United States, with an EU entity for European customers
Resend	Delivery of transactional email that is not sent by Stripe	United States
Google (again, a separate purpose)	Website analytics via Google Analytics — only once you have accepted it in the cookie banner	United States and other Google data-centre locations

Where a processor is located outside the EU/EEA — Google, Stripe and Resend, in particular — the transfer is covered by the EU Standard Contractual Clauses, an adequacy mechanism such as the EU–US Data Privacy Framework, or both, as the safeguard required by Chapter V GDPR. We review this list when we change a provider, and this policy is the place that change gets recorded.

We disclose data outside this list only where the law compels it — to a court, regulator or authority with a valid legal basis to request it.

5. How long we keep it

• Briefings, feedback and results: for as long as your account exists, and automatically for up to 24 months after the account becomes inactive, in case you return to a project. You can ask us to delete it sooner at any time, subject to section 6.
• Account and billing data: kept while your account is active, and the invoice and transaction records within it for ten years after they are created, because German tax and commercial law requires it (§ 147 Abgabenordnung, § 257 Handelsgesetzbuch). We cannot shorten this period on request.
• Correspondence sent to our contact address: up to 24 months, unless a message is part of an ongoing matter that needs it kept longer.
• Server and CDN logs: Vercel's standard operational retention, typically a small number of days, for security and abuse prevention.

6. Your rights

Under Articles 15 to 21 GDPR, you can ask us, at any time and free of charge, to:

• tell you what personal data we hold about you and why (access);
• correct it if it is wrong (rectification);
• delete it, where we are not required to keep it for a reason in section 5 (erasure);
• limit what we do with it while a request is being resolved (restriction);
• give it to you in a portable format (portability); or
• stop a particular use of it that rests on our legitimate interest (objection).

Write to hello@namingstudio.ai to exercise any of these. Where processing rests on consent (today: Google Analytics, via the cookie banner), you can withdraw it at any time with the same effect going forward.

If you believe we have handled your data unlawfully, you can complain directly to us, or to the supervisory authority with jurisdiction over us:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Friedrichstr. 219, 10969 Berlin, Germany

You can also complain to the supervisory authority in your own EU member state; it will coordinate with the Berlin authority if that one has lead jurisdiction.

7. Children

The service is offered to businesses and to entrepreneurs acting in that capacity, consistent with the scope described in section 1 of our Terms of Service. It is not directed at, and we do not knowingly collect data from, anyone under the age of 16.

8. Security

We rely on our processors' infrastructure-level security (encryption in transit, access controls on hosting and database accounts) and restrict access to personal data to what each part of the service needs to function. No transmission or storage system is perfectly secure, and we will tell you without undue delay if a breach is likely to put your rights at risk, as Articles 33 and 34 GDPR require.

9. Changes to this policy

We may update this policy as the service, our processors or the law change. The date at the top of this page is the date of the version in force. Where a change is significant — a new category of data, a new processor outside the EU/EEA, or a new legal basis — we will say so here rather than editing it silently.