Privacy Policy

Last updated: 2026-11-03

The short version

Your self-description is sent to an AI provider to compose the names. That provider is DeepSeek, in China.
We keep anonymous usage statistics about the generator — including which names were produced — but not your name, your email, your description or your IP address.
The names themselves live in your browser.
We collect your email if you join the seal waiting list or place an order.
If you place an order, we store the contact, delivery and order details needed to process it.
We do not sell your data, and we do not run advertising trackers.

Who is responsible for your data

The controller — the party legally responsible for the processing described here — is [YOUR COMPANY], [YOUR ADDRESS], [YOUR COUNTRY].

For any question or request about your data, write to privacy@namedinchinese.com. We answer requests within one month, as the law requires.

What we collect and why

To compose your name

You give us your first name, optionally your family name, a gender preference, and a short description of yourself. This is sent to our AI provider (see below) to compose the three name candidates. Legal basis: performing the service you asked for (GDPR Art. 6(1)(b)).

The result comes back to your browser and is kept there. If you select one of the names, your choice is remembered on your own device so the page is not empty when you return; you can clear it by clearing your browser storage. We do not create a profile of you and we do not link a name to a person.

If you use the share feature, the names are encoded into the link itself. The part after the # is never sent to our servers — it stays in your browser and in whatever app you paste it into. When you download the name card, the name and its text are sent to our server to render the image (see Server logs below).

Usage statistics

We record a small set of product-analytics events on our own servers so we can tell whether the service works and which names people actually like. An event contains:

the type of event (name requested, name composed, name selected, card downloaded, shared, waiting list joined);
a random session identifier created in your browser — it is not derived from your name, email or device, and it expires with your browser session;
your gender preference;
the Chinese names that were composed, and which one you selected;
whether the result carried a reservation from our review step (a quality signal);
a two-letter country code if our server can determine one, and an error code if composition failed.

These events do not contain your first name, family name, email address, self-description or IP address. We use them only to operate and improve this service; we do not use them to advertise to you and we do not sell them. Legal basis: our legitimate interest in running and improving the service (GDPR Art. 6(1)(f)). You can object to this processing — see Your rights.

If you join the seal waiting list

We ask for your email address, the Chinese name you chose, and how interested you are in buying a physical seal. Along with that we store the time you consented, the page you signed up from, and — if our server can determine it — a two-letter country code, which we use to decide which markets to prepare for. We use your email address only to contact you about the seal; we do not sell it or use it for anything else. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.

When you sign up you receive a removal link. Anyone holding that link can delete the record, so keep it if you may want to use it.

If you place an order

We store your name, email address, delivery address (for a physical seal), chosen name, product options, order total, payment method and order status. We use these details to take payment, deliver the product, answer questions and keep required business records. Legal basis: steps needed to perform the order contract and meet legal duties.

Order contact, delivery details, proof images and delivered digital design files are encrypted in our database. PayPal handles PayPal payments; we receive payment confirmation but do not store card numbers. Manual PayPal and bank payments are confirmed by the seller. If you choose bank transfer, we show our bank details and you send the payment from your own bank. We do not collect your bank login or account password.

We keep order details as long as needed to fulfil the order, handle support and disputes, and meet accounting duties. No order retention period has been set yet, and checkout is closed until one is set, so no order contact or address details are being collected.

Abuse prevention

To stop automated abuse we keep a short-lived counter keyed to your IP address, held in the server's memory. It is never written to our databases and it is discarded automatically. Legal basis: our legitimate interest in keeping the service available (GDPR Art. 6(1)(f)).

Server logs

Like any website, our server records standard access logs — IP address, timestamp and the URL requested. Requests that carry your name in the URL (the share card image) therefore appear in those logs. Logs are used for security and fault diagnosis only.

Who else processes your data

DeepSeek (the People's Republic of China) — receives your first name, family name, gender preference and self-description in order to compose the names. This is a necessary part of the service; if you do not want your description sent to this provider, please do not use the generator.
PayPal — processes a payment if you choose PayPal. It receives the order amount and the information needed for the payment and delivery. PayPal's own privacy policy applies to its processing.
Resend — delivers transactional order email. It receives the recipient email address and the message content, including the private order link and order status. Resend's own privacy and data-processing terms apply.
[YOUR HOSTING PROVIDER] — hosts this site and therefore processes standard server logs (IP address, timestamp, requested URL).

We do not use advertising networks, and we do not sell or rent personal data. Where a provider acts on our instructions we have a data-processing agreement with them.

Transfer outside the EEA/UK

DeepSeek is established in China. China has not received an adequacy decision from the European Commission, so when you use the generator your first name, family name, gender preference and self-description are transferred outside the EEA/UK on the basis of [STANDARD CONTRACTUAL CLAUSES] together with an assessment of the risks involved. You can ask us for a copy of those safeguards at privacy@namedinchinese.com. How DeepSeek itself retains and uses API inputs is described in its own privacy policy, which we link to at [PROVIDER POLICY LINK].

Transactional email delivery may also involve a transfer outside the EEA/UK on the basis of [EMAIL PROVIDER TRANSFER SAFEGUARDS].

How long we keep it

These periods are enforced by a scheduled deletion job, not just by policy — the records listed below are removed automatically once they pass their retention period.

Waiting-list details (email, chosen name, interest level, country code, consent record): until you delete them with your removal link, or 24 months after you signed up, whichever comes first.
Usage statistics: 12 months, after which they are deleted.
Server logs: 30 days, after which our server deletes them.
Consent records: kept as long as we may need to demonstrate that consent was given.

Your rights

If you are in the EEA/UK (GDPR) or California (CCPA/CPRA, where it applies to us) you may request access to your personal data, and its correction, deletion, restriction or portability; you may object to processing, and where processing rests on consent you may withdraw that consent at any time. Withdrawing consent does not affect processing already carried out.

In practice the data we hold about an identifiable person is usually just a waiting-list entry, and you can delete it yourself with the removal link you received when you signed up. For anything else, write to privacy@namedinchinese.com.

You also have the right to complain to a data protection authority in the country where you live, work, or where the alleged infringement occurred.

Security

Traffic to this site is encrypted in transit. Access to stored data is restricted, and database credentials are held server-side only. If a breach affects your personal data, we will notify you and the competent authority as the law requires.

Children

This service is not directed at children. We do not knowingly collect data from children under 16, or under the age your country sets for consenting to online services where that age is lower (not below 13).

Changes

If this policy changes materially we will update the date at the top of this page and, where the change affects you, tell waiting-list members by email.