Privacy Policy

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and describes how Super Sapiens AI processes the personal data of people who use the NameSapiens platform at namesapiens.com and the services connected to it. It applies both to registered users and to anyone using the free tools without creating an account.

1. Data controller

The data controller is Super Sapiens AI, registered office at , VAT number . For any request concerning personal data you can write to .

2. Categories of data we process

Depending on the features you use, we may process the following categories of data.

Category	Data	When it is collected
Account data	Email address, name (if provided), Google profile identifier and picture (Google sign-in only), preferred language, registration date, login logs	Registration via magic link or Google sign-in
Order and billing data	Company name or full name, address, VAT number or tax code, e-invoicing recipient code or certified email, details of the bank transfer received (sending bank, amount, date, reference), order and proforma history	Placing an order and paying by bank transfer
Content you upload	Naming briefs, project descriptions, candidate names, trademarks, domains, permutation lists, documents and information entered in conversations with the Sapi assistant, data about counterparties in domain recovery matters	Use of the naming, domain, recovery and brand protection services
Technical data	IP address, user agent, request timestamps, session identifiers, application logs, error signals	Any browsing on the platform
Public form data	Name to be checked, domain, optional email address (for example in the UDRP Pre-Check, to receive the result), result of the check	Use of the free tools (Name Check, quick domain check, UDRP Pre-Check)
Communication data	Content of emails, support requests and correspondence	Contacting our support

Free tools and IP hashing. To protect the free tools from abuse and to enforce usage limits, we store a hash of the IP address generated with a salt that changes every day. Once the salt has rotated, the hash can no longer be traced back to the original address. It is kept only for as long as the rate limit requires.

Publication of Name Check results. The results of a public name check are published or made shareable only if you expressly ask for it, through a voluntary and specific action. Without that consent, the result remains visible only to the person who generated it.

We do not intentionally process special categories of data (Article 9 GDPR). Please do not include such information in briefs or in conversations with Sapi.

3. Purposes and legal bases

Purpose	Legal basis
Creating and managing your account, authentication, delivering the services you order (naming, domains, recovery, brand protection), support	Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR)
Issuing proformas and invoices, recording payments, tax and accounting obligations	Legal obligation (Article 6(1)(c) GDPR)
Platform security, abuse and fraud prevention, rate limiting of automated traffic, log retention	Legitimate interest of the controller (Article 6(1)(f) GDPR) in protecting its systems
Processing your content through artificial intelligence models to deliver the services	Performance of a contract (Article 6(1)(b) GDPR)
Sending the UDRP Pre-Check result to the optional email address entered in the form	Consent (Article 6(1)(a) GDPR), given by voluntarily entering the address
Publishing Name Check results	Consent (Article 6(1)(a) GDPR)
Service communications (order confirmations, proforma deadlines, monitoring alerts, renewals)	Performance of a contract (Article 6(1)(b) GDPR)
Marketing communications about new services, if you opt in	Consent (Article 6(1)(a) GDPR), withdrawable at any time
Defending the controller's rights in or out of court	Legitimate interest (Article 6(1)(f) GDPR)
Aggregate statistics on platform usage, if enabled, through privacy-friendly analytics without cross-site tracking	Legitimate interest (Article 6(1)(f) GDPR)

Providing the data needed to deliver the services is necessary: without it we cannot create your account, issue a proforma or perform the service. Data collected on the basis of consent is always optional.

4. Recipients and processors

Your data is processed by authorised staff of the controller and by third parties acting as processors under Article 28 GDPR, bound by a data processing agreement. The main categories are:

• Hosting and infrastructure: Hetzner Online GmbH, with servers located in the European Union, for the storage of databases, files and application logs.
• AI processing: Anthropic, PBC, provider of the Claude model used by the Sapi assistant and by the evaluation pipeline. Content sent to the model (briefs, names, conversations) may be processed on servers outside the European Union; the transfer is covered by the safeguards provided for by the GDPR for transfers to third countries (Chapter V). Where possible we use open-source models running on our European infrastructure instead.
• Bot protection and form security: Cloudflare, Inc., for the Turnstile service on public forms, which processes technical browsing data to distinguish human users from automated traffic.
• Transactional email delivery: email service providers for the delivery of magic links, order confirmations and alerts.
• Partner law firm: for domain recovery services that require filing a procedure (UDRP, .it Registry, EURid ADR) or a negotiation, the necessary data is shared with our partner law firm, which processes it within the scope of its professional engagement.
• Procedure providers and registries: dispute resolution providers, registries and registrars, to the extent needed to carry out the requested procedure or transaction.
• Escrow services: in domain acquisitions, the data needed to complete the transaction is shared with the chosen third-party escrow service.
• The controller's tax and accounting advisers, for legal compliance.
• Public authorities, where required by law.

We do not sell personal data or share it with third parties for marketing purposes.

5. Transfers outside the European Union

Account data, order data and uploaded content are stored in the European Union. Processing through the Claude model may involve transferring the processed content to the United States. That transfer takes place on the basis of the safeguards provided for by the GDPR for transfers to third countries, including the standard contractual clauses adopted by the European Commission and the supplementary measures agreed with the provider. You can request information about the safeguards applied by writing to .

6. Retention periods

Data	Duration
Account data	For the duration of the relationship and up to 12 months after account deletion, unless the law requires otherwise
Billing and payment data	10 years from the end of the financial year, as required by tax and accounting law
Uploaded content (briefs, reports, shortlists, monitoring data)	For the duration of the service and up to 24 months after the last activity, or until you ask for deletion
Technical and security logs	Up to 12 months
Daily IP hash for the free tools	Up to 48 hours after salt rotation
Public form data without an account (including the optional Pre-Check email)	Up to 90 days, unless you create an account and link the result
Data relating to disputes or procedures	Until the procedure is concluded and for the limitation period of the related rights
Marketing consent	Until withdrawn

Once these periods expire, the data is deleted or anonymised.

7. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• access your data and obtain a copy of it (Article 15);
• have inaccurate data rectified and incomplete data completed (Article 16);
• have your data erased, in the cases provided for (Article 17);
• obtain restriction of processing (Article 18);
• receive your data in a structured, commonly used, machine-readable format and transmit it to another controller (Article 20);
• object to processing based on legitimate interest (Article 21);
• not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you (Article 22). The scores and assessments produced by the platform are informational tools and do not produce such effects;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests can be sent to . We respond within one month of receipt; this may be extended by two further months in particularly complex cases, in which case we will let you know.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where you habitually reside, work or where the alleged infringement occurred.

8. Security measures

We adopt technical and organisational measures appropriate to the risk, including: TLS encryption of communications; encryption of data at rest on our servers; passwordless authentication through single-use, expiring magic links or Google sign-in; environment separation; role-based access control; periodic backups stored in the European Union; logging of administrative access; protection of public forms against automated traffic; regular updates of software components. In the event of a personal data breach likely to result in a risk to your rights, we carry out the notifications required by Articles 33 and 34 GDPR.

9. Children

NameSapiens services are intended for adults and businesses. We do not knowingly collect data from anyone under 18. If we become aware that we have collected data from a minor without the consent of the person holding parental responsibility, we delete it promptly.

10. Automated decision-making

The platform uses automated systems, including artificial intelligence models, to generate names, calculate the Name Readiness Score, estimate the likely outcome of a UDRP procedure and identify potential conflicts. These processes produce supporting information that you are free to evaluate; they do not result in decisions with legal effects on you. Reports under plans that include human review are checked by an expert before delivery.

11. Cookies

Information about the cookies and similar technologies used by the platform is set out in the Cookie Policy.

12. Changes to this notice

This notice may be updated to reflect legal, technical or organisational changes. The updated version is published on this page with the date of the last update. Where substantial changes affect the rights of registered users, we will inform them by email or through a notice on the platform.