NamePass Privacy Policy

Version 1.3 · effective from the date of publication

This document describes what data the NamePass Service (the bot @NamePassBot and the associated mini-app) collects and processes, to whom it is transferred and for how long it is retained.

1. What we store

2. What we DO NOT store

• passwords for Telegram, Instagram or other accounts — we never request them;
• payment-card or bank-account data — payments go through Telegram Stars, we only see the opaque charge_id;
• full Telegram conversations — only messages explicitly sent to the bot;
• geolocation — except for the country you yourself specified during onboarding.

3. To whom we transfer data

To perform its checks, the Service engages third-party processors of the categories listed below. A named list of processors is provided on request via the /support command.

• An aggregator of artificial-intelligence (LLM) models — an international B2B provider through which the Service accesses several language models. Transferred: brief texts, candidate names and request parameters for AI generation and multilingual-risk analysis. Not transferred: Telegram ID, User name, payment data.
• A third-party SaaS provider for checking public profiles on social networks — performs automated availability checks of public identifiers. Transferred: candidate username variants. Not transferred: Telegram ID, User name, any other data.
• A third-party search aggregator — engaged only as part of paid extended checks (e.g. analysis of overlap with public search results). Transferred: candidate names, without Telegram ID. This processor is not involved in the base report.
• RDAP/WHOIS domain registries — public protocols for checking domain registration; only the domain itself is transferred. This is an internet-infrastructure standard, not a commercial vendor.
• Telegram — the sole channel for message and payment delivery. Telegram has its own privacy policy.

Vendors are located in various jurisdictions, including the United States, the European Union and other states that host international cloud platforms. The Service transfers to them only the data fragments necessary for a specific check (brief texts and candidate names), without any link to Telegram ID and without transfer of payment details.

When transferring personal data across borders, the Service engages processors that provide an adequate level of protection in accordance with applicable law (in particular, Standard Contractual Clauses and other mechanisms recognized by applicable law). The Service does not sell Your data and does not transfer it to third parties for marketing purposes.

4. How long we retain data

• user profile, history of generations and payments — until a deletion request;
• application service logs with pseudonymized telegram_id — up to 90 days.

5. Account deletion

To delete all your data, send the /support command in the bot with the words "delete account". Deletion is performed manually (closed beta) and takes up to 7 business days. Once deleted, the operation cannot be reversed — the history of generations and purchased reports will be lost.

Payment records may be retained in pseudonymized form (without a link to Telegram ID) to comply with bookkeeping obligations.

6. Lawful bases for processing and Your rights

The Service processes data on the following legal bases (applicable law may refine the list):

• performance of a contract (the public offer) — generation and delivery of the reports requested by the User;
• legitimate interest — diagnostics, abuse protection, Service security;
• consent — where explicitly required (e.g. usage analytics); consent can be withdrawn via /support;
• compliance with applicable law — payment accounting, responses to regulatory requests.

With regard to Your personal data You have the right to:

• request access to the data and a copy of stored records;
• request correction of inaccurate data;
• request deletion of data (see section 5);
• object to processing or restrict it;
• withdraw consent to processing where it is based on consent;
• lodge a complaint with the competent data-protection supervisory authority of Your country of residence.

All such requests are submitted via the /support command in the bot.

6a. Automated brief moderation

Before generation starts, every brief is automatically reviewed by a classifier for membership in the prohibited categories listed in section 7 of the public offer (gambling, drugs, weapons, adult content, fraud, discrimination, regulated financial/pharmaceutical services, other illegal activity). Briefs that fall under any of these categories are rejected automatically — the User receives a localized message with the category and reason code, and no Stars are charged.

Moderation is not deterministic — it is a decision made by an automated language model. If You consider the rejection to be in error, write to /support with the brief text: the request is handled by a human and the decision can be revised. This is the right to human involvement in automated decision- making provided by applicable law.

The texts of rejected briefs themselves are stored in a de-identified form (with no link to Telegram ID in marketing analytics) for the sole purpose of tuning the classifier, and are not transferred to any third party for advertising purposes.

7. Security

• connection between the mini-app and the server — HTTPS (TLS);
• authentication via signed Telegram initData (HMAC-SHA256 using the Bot Token);
• access to the database and secrets — only by the developer, encrypted via environment variables;
• database backups — encrypted at the host-infrastructure layer.

8. Children

The Service is not intended for persons under 16. Telegram independently sets age restrictions for the use of its platform.

9. Changes to this policy

The Service may update this policy. The current version is always available at app.namepass.pro/legal/privacy.en.html. Material changes are separately announced in the bot.

10. Contacts

Questions about data processing — via the /support command in the bot @NamePassBot.

Public Offer