Privacy Policy

1. Scope and data controller

This policy applies to the NameGender website, account dashboard, API, uploaded files and official integrations. The service operator shown at the end of this page is responsible for this processing unless a separate agreement says otherwise.

When a customer submits data about other people, that customer decides why the data is processed and NameGender acts as a service provider or processor for the requested operation.

2. Information we collect

• Account data: name, email address, password hash, optional company and country details, account preferences and verification status.
• Authentication and security data: API key hashes and prefixes, permitted IP addresses or origins, session information, IP address, user agent and security events.
• Service inputs and outputs: submitted names, email addresses, usernames, country codes, classification results and confidence evidence.
• Batch data: uploaded CSV or spreadsheet files, selected column settings, generated result files and processing summaries.
• Billing data: package, amount, asset, network, payment address, transaction reference, confirmation state and invoice details. Private wallet keys are not stored by the service.
• Support and communication data: messages, attachments and information you choose to provide.

3. Why we use information

Depending on the context, processing is based on performance of a contract, legitimate interests in operating and securing the service, legal obligations, or consent where the law requires it.

• Provide name classification, API access, batch processing, account features and support.
• Authenticate requests, enforce quotas, prevent fraud and investigate misuse.
• Calculate credits, confirm payments, create records and maintain transaction history.
• Measure reliability and performance using operational summaries.
• Measure public website visits with Google Analytics only after you grant analytics consent.
• Comply with legal obligations and establish, exercise or defend legal claims.

4. API queries and uploaded files

Small API requests can be recorded with their input, resolved name, result, country, API key reference and IP address so users can inspect recent activity and we can investigate abuse. These raw request records are deleted after 7 days. Larger batch operations are recorded as aggregate job statistics rather than one log row per name.

Uploaded source files and generated result files are scheduled for physical deletion after 30 days. The job record, including row count, status, credit use and quality summary, can remain as an account and accounting record after the files are deleted.

5. Google Workspace data

An official Google Workspace integration accesses only the spreadsheet content and account information required for the action the user starts. Selected cell values can be sent to the NameGender API to produce results. We do not use Google user data for advertising, sell it, or use it to train a general-purpose model.

Use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is disclosed only to infrastructure providers when necessary to provide or secure the feature, when the user directs us, or when law requires it.

The API key entered in the add-on is stored in the spreadsheet it was entered in, so that the add-on and its formula can both read it. Anyone the file is shared with can therefore use that key. Keys can be revoked at any time from the dashboard.

6. Service providers and disclosure

We do not sell personal information. We may disclose limited data to hosting, storage, email, analytics, error monitoring, payment or blockchain infrastructure providers that help operate the service, under appropriate contractual and security controls.

• When you allow analytics, Google Analytics may receive the visited page, referrer, browser and device information, approximate region and analytics identifiers. Names, uploaded files, API inputs and account-area activity are not sent to Google Analytics.
• A configured AI fallback provider receives only the input needed for that request when the customer enables that option.
• Payment providers and public blockchain networks process transaction information needed to settle an order.
• Authorities or professional advisers may receive information when required by law or necessary to protect legal rights and service security.

7. Retention

• Raw small-request logs: 7 days.
• Uploaded and generated batch files: 30 days after processing.
• Account, credit, invoice and transaction records: while the account is active and longer where accounting, fraud prevention or legal obligations require it.
• Aggregated usage statistics: retained without raw submitted values for service operation and account reporting.
• Support correspondence: as long as reasonably needed to resolve the request and document the outcome.
• Google Analytics cookies can remain for up to 2 years unless you withdraw consent or delete them sooner.

8. Security

We use access controls, encrypted transport, hashed passwords, hashed API keys, rate limits, restricted operational access and retention limits intended to reduce risk. Plain API keys are shown only when created and are not stored in recoverable form.

No online service can guarantee absolute security. Notify support promptly if you suspect unauthorised access.

9. International processing

Infrastructure and service providers may process data outside your country. Where required, we use recognised transfer safeguards and limit transfers to what is needed for the service.

10. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent and complain to a supervisory authority. These rights can be limited by applicable law and legitimate record-keeping duties.

• You can revoke API keys and remove uploaded jobs from the dashboard.
• You can request account or personal-data deletion through support.
• You can block non-essential browser storage, although essential login and security cookies are required for the account area.

11. Children

The service is intended for organisations and people able to enter into a contract. It is not directed to children, and we do not knowingly request children to create accounts.

12. Changes and contact

We may revise this policy when the service or legal requirements change. The effective date identifies the current version. Privacy and deletion requests can be sent to the address below.