NameSnack

GDPR overview

The site never mentions the GDPR. Searching the full text and the archived HTML of every page collected returns no occurrence of the regulation, of a data protection officer, or of an Article 27 representative. The absence is silence, not a stated refusal. The privacy policy does grant people in the European Economic Area rights of access, correction, update, erasure, objection, restriction and withdrawal of consent, exercised by writing to hello@namesnack.com with proof of identity, and it recalls the right to complain to a supervisory authority. For transfers to the United States it relies on the EU-U.S. Privacy Shield or on standard contractual clauses. The Privacy Shield was struck down by the Court of Justice in July 2020, so that part of the document is out of date. No DPA and no subprocessor list are published.

Who owns the data?

NameSnack presents itself as the data controller for whatever you submit through the service, and warns that other controllers, advertisers in particular, may process the same data under their own policies. Ownership of the names the tool produces is never addressed. The terms of use instead assert broad intellectual property rights over the content of the service and forbid reproducing, distributing or offering for sale any content obtained through it without written consent. Meanwhile the FAQ tells you to register a trademark yourself. Nothing in the documents explicitly transfers a generated name to the user, so treat the output as inspiration rather than as a legally secured asset.

Reuse rights

The privacy policy allows broad reuse by the publisher rather than by the end user. It covers identity, email, age, postal address, phone number and date of birth when volunteered, plus passively collected IP addresses, geolocation, device identifiers, browser and operating system data, and detailed page-by-page browsing behaviour. NameSnack states that it builds a browser or device fingerprint to personalise content and advertising and to detect fraud. Data is shared with service providers covering marketing, market research, support, storage, analysis and legal services, and with commercial partners. Advertising cookies are used for targeting, and opt-out is delegated to external tools such as Google Ads Settings, the Digital Advertising Alliance, its European counterpart and TrustArc. Browser-initiated Do Not Track signals are explicitly ignored. Nothing in the document addresses the reuse of data to train AI models, in either direction.

Data retention & training

Hosting summary

The privacy policy states that the services are operated from the United States and governed by United States law. Data submitted through the site is transferred to the United States, or to other locations outside the European Economic Area, for processing, hosting and storage by the publisher or its service providers. The publisher acknowledges that those locations may not offer a standard of protection comparable to the user's own jurisdiction. For transfers made by its EU affiliates it invokes the EU-U.S. Privacy Shield or standard contractual clauses, a copy of which can be requested; the Privacy Shield has been invalid since July 2020. No hosting provider, region or data centre is ever named, and no DPA or subprocessor list is published. Security is described only in general terms: administrative, technical and physical safeguards, with SSL applied to payment transactions. At network level the domain is served behind Cloudflare, which indicates a CDN edge node rather than the location of the origin server.