Privacy policy

The entity responsible for data processing on namely.studio under the GDPR is:

We use no advertising networks or external analytics services. We count public page views on our server as totals. Only with your prior consent do we also analyse referral sources and campaigns, for example to measure the results of YouTube Shorts. User statistics come from account, sign-in and generation data. We process:

• Session cookie namely_uid — A randomly generated pseudonymous browser identifier (UUID). It links your browser to your archive, favourites, notes and logos and enforces the quota when you are not signed in. The identifier can therefore be linked to stored usage data; it does not mean that use is anonymous. HttpOnly, Secure, SameSite=Lax, lifetime 1 year. Legal basis: providing the requested functions under Article 6(1)(b) GDPR; necessary storage and access under section 165(3) Austrian TKG 2021.
• Technical server logs — Our web server (Nginx) logs the IP address, time, requested URL including transmitted URL parameters, any referrer supplied by the browser, user agent and technical response data. These logs serve attack prevention and troubleshooting independently of consent to optional referral statistics; they are not used for that marketing analysis. Daily rotation retains 14 archived logs in addition to the current log, corresponding to approximately up to 15 days. Legal basis: legitimate interest in protecting and reliably operating the infrastructure (Article 6(1)(f) GDPR).
• Brief input — The text you enter in the brief field is sent to third parties (see section 3) for name generation and stored in our database with the generated names. This data remains until deleted at your request; expiry of a browser cookie does not delete it from the server. Content may contain personal data – enter only what you need for naming.
• Generated names, ratings, favorites, notes, logos — Your generated suggestions and interactions (ratings, favourites, notes and logo images) are stored on our server under your browser identifier or signed-in account. They remain until deleted at your request. Deleting or expiry of browser cookies may end access to data that has not been linked to an account; it does not delete that data from the server. Automatic deletion after 365 days of inactivity is not currently implemented.
• Account data when signing in with Google — If you sign in via 'Sign in with Google', Google sends us: your email address, your display name, your Google profile-image URL and your unique Google sub-id. We store your email, name and profile picture along with the times the account was recorded, actual Google sign-ins and the latest account activity. New accounts are recorded when Google sign-in succeeds. For older accounts, the original registration time may be unknown; the first recorded time is shown instead. Individual successful sign-ins are stored for 365 days for internal analysis. Ordinary account activity does not count as another sign-in. Legal basis: contract performance (Art. 6(1)(b) GDPR). Retention: until deleted at your request; automatic deletion solely because of inactivity is not currently implemented. On first login, any existing cookie session before sign-in you had on the same browser is migrated to your account, provided the account had no prior data.
• Basic page-view counts and user statistics — Generation counters enforce the relevant allowance: a lifetime total per browser without sign-in, daily for free accounts and monthly for paid plans. Existing account, generation and rating data support internal user and quality statistics. Public page loads are counted on the server even without JavaScript; the browser records subsequent navigation within the application. Requests with DNT/GPC signals, known bots and preloads are excluded. Only totals by day and hour, page and language are stored. No IP addresses, user identifiers, referrers, device information or additional analytics cookies are stored for these counts. These page-view totals are deleted after 365 days. Statistics are available only to the operator in the protected admin area and are not shared with external analytics providers. Legal basis: contract performance (for limits) and legitimate interest in service quality (Art. 6(1)(f) GDPR).

• Optional referral and campaign statistics — With your consent, when you enter the website we collect the referring address supplied by your browser (referrer) and public campaign labels from utm_source, utm_medium, utm_campaign and utm_content. This helps us understand which websites and campaigns lead to entries and new registrations. Referring addresses are reduced to their protocol and domain. Only recognised public YouTube video URLs also retain a validated video ID. URL credentials, other paths, query parameters and fragments are discarded; local, private and IP addresses are excluded. Campaign labels are restricted to permitted public labels of up to 64 characters. The requested URL and any referring address sent by the browser technically reach the servers even without analytics consent; their additional use for these referral and campaign statistics begins only after consent. Technical server logs for security and troubleshooting are separate and described above.

  We store your choice in the necessary namely_analytics_consent cookie as granted or denied for 180 days, without a unique visitor identifier. Only after consent do we also set namely_attribution: a signed HttpOnly cookie, inaccessible to JavaScript, containing the cleaned referral and campaign labels for up to 30 minutes. It contains no visitor UUID or account ID. A new recorded entry, whether direct, from an external site or with an explicit campaign label, replaces this attribution; normal internal navigation does not extend it. If a new account is registered for the first time within that period and consent remains in place, the corresponding registration counter increases. Referral data is not stored in the user account.

  The legal basis for this optional analysis is your consent under Article 6(1)(a) GDPR and section 165(3) Austrian TKG 2021. You may refuse and continue using the website. You can grant consent or withdraw it at any time using “Privacy settings” in the footer and “Withdraw analytics consent”. Withdrawal stops further optional collection and deletes the attribution cookie; processing carried out before withdrawal remains lawful. DNT/GPC signals prevent referral analysis even where consent was previously given. Storing the choice itself serves only to respect your privacy preference.

  On the server we retain only totals by UTC calendar day, source, campaign and cleaned referrer URL. These referral statistics contain no stored IP addresses, names, email addresses or personal user identifiers and are not joined to the account list. Totals cover 365 UTC calendar days including the current day; older totals are removed when further data is collected. Only the operator has access in the protected admin area; hosting is provided by Hetzner in Germany. Data is not sent to external analytics providers. We count website entries and attributed first registrations, not unique people, YouTube views or viewing time. Missing consent, browser restrictions and shared links make the analysis incomplete. Already aggregated counters cannot be attributed to an individual user and therefore cannot later be reduced for a specific person.

• Waiting list for Pro mode — If you sign up to be notified about Pro mode, we process your email address, the selected language, where you signed up (pop-up, card below the results or Pro page), the times of sign-up, confirmation email and confirmation, the version of the consent text, the number of confirmation emails sent within 24 hours (to prevent abuse), and random identifiers for the confirmation and unsubscribe links. The purpose is to send you one-off, launch-related information about Pro mode on namely.studio by email. The legal basis is your consent under Article 6(1)(a) GDPR and section 174 Austrian TKG 2021. We use a double opt-in procedure: after you sign up, we send you an email with a confirmation link, and your address only goes on the list once you confirm. Unconfirmed sign-ups are deleted after 7 days. Confirmed entries are kept until we have informed you about the launch of Pro mode or until you withdraw consent, at the latest 12 months after your confirmation. You can withdraw your consent at any time via the unsubscribe link in every email or by writing to kontakt@kyven.at; your entry is then deleted. Withdrawal does not affect the lawfulness of processing carried out before it. Emails are sent via the SMTP mailbox of easyname GmbH in Austria (see section 3). Only the operator can view the list, in the protected admin area. In your browser we only store locally whether and when a sign-up was sent from it, whether it has been confirmed and when you last closed the pop-up. This information does not leave your browser; a sign-up that was sent but not confirmed expires there after 7 days, and a closed pop-up can reappear after 14 days.

To provide AI features, brief text and naming context are transmitted to the following processors:

• Anthropic PBC — Anthropic — Claude models (Opus, Sonnet, Haiku — the model in use is selectable in operation) (name generation, discovery questions, taste calibration, style profile). Seat: USA. Legal basis: contract fulfilment (Art. 6(1)(b) GDPR) and legitimate interest. Third-country transfer on the basis of EU Standard Contractual Clauses. Privacy: anthropic.com/legal/privacy
• Google LLC (AI) — Google — Gemini 2.5 Pro (multi-model ensemble when activated) and Gemini 2.5 Flash Image (logo generation). Seat: USA. Legal basis: contract fulfilment and legitimate interest. Third-country transfer on the basis of EU SCCs. Privacy: policies.google.com/privacy
• Google LLC (OAuth) — Google — Identity Platform / OAuth login. Seat: USA. When you sign in via 'Sign in with Google', Google receives the login request and sends us your basic profile data (email, name, profile picture, sub-id). No brief or naming data is transmitted to Google for this purpose. Legal basis: contract fulfilment (Art. 6(1)(b) GDPR). Third-country transfer on the basis of EU SCCs. Privacy: policies.google.com/privacy
• Hetzner Online GmbH — Hetzner Online GmbH (server hosting). Seat: Germany/EU. Data processing under Art. 28 GDPR. The server is located in the Helsinki data centre, Finland. Privacy: hetzner.com/rechtliches/datenschutz
• Stripe Payments Europe, Ltd. — Stripe Payments Europe, Ltd. (payment processing for paid plans). Seat: Ireland/EU. When you buy, Stripe processes your name, email address, payment and billing details; card data never reaches our servers. We only store the Stripe customer and subscription IDs, plan, status and end of term. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR). Transfers to the USA based on EU Standard Contractual Clauses. Privacy: stripe.com/privacy

For sending the Pro waiting list emails, we also use:

• easyname GmbH — easyname GmbH (email hosting). Seat: Austria/EU. Operates the SMTP mailbox we use to send the confirmation and launch emails for the Pro waiting list. easyname processes your email address and the content of these messages; it does not receive brief texts or names. Data processing under Art. 28 GDPR.

Important notice: Content you enter in the brief is transmitted to the named US services. Do not enter highly sensitive personal data (health, religion, political views) or trade secrets that shouldn't leave your environment.

namely_uid: 1 year from when the cookie is set. Briefs, names, ratings, favourites, notes, logos, account data and account-related quota/usage data remain stored until deleted at your request. Automatic deletion after inactivity or after 24 months is not currently implemented for this data. Deleting or expiry of a cookie does not remove server data and may end access to data not linked to an account. Aggregated page views and referral/campaign totals: 365 UTC calendar days including the current day; older totals are removed when further data is collected. Individual sign-in events: 365 days, with cleanup on subsequent sign-ins. Technical server logs: approximately up to 15 days through daily rotation. namely_analytics_consent: 180 days from your choice; namely_attribution: up to 30 minutes from recording the entry. Pro waiting list: unconfirmed sign-ups 7 days; confirmed entries until we have informed you about the launch of Pro mode or until you withdraw consent, at the latest 12 months after your confirmation; after unsubscribing, the entry is deleted immediately. Local waiting-list information in your browser (sign-up sent or confirmed, pop-up closed): until you clear the site data in your browser. To request deletion of your server data, contact the address above; no special form is required.

As a data subject, you have extensive rights under the GDPR:

• Access (Art. 15): which data we hold about you.
• Rectification (Art. 16): correction of incorrect data.
• Erasure (Art. 17): "right to be forgotten".
• Restriction of processing (Art. 18).
• Data portability (Art. 20): export of your data in a structured format.
• Objection (Art. 21): against processing based on legitimate interest.
• Complaint to a supervisory authority — in Austria: Datenschutzbehörde (dsb.gv.at). In Germany: the respective state data protection authority.

A short message to the contact address above is sufficient to exercise these rights. We will respond within statutory deadlines.

AI-assisted name generation is a creative aid, not an automated decision with legal consequences in the sense of Art. 22 GDPR. All decisions on use, registration, or trademark application are made solely by the users.

We adapt this declaration when features or legal conditions change. The current version is always available at this URL. The date of last change is shown at the bottom of the document.