Privacy policy
Last updated:
1. Who we are and how to contact us
Operator: AI Baby Name Chooser · Riyadh
AI Baby Name Chooser (aibabychooser.app) is run by the operator of the brand, based in Riyadh, Saudi Arabia, which is the controller of your personal data under the Personal Data Protection Law (PDPL).
To contact us about your privacy or to use your rights, use the privacy request form on this site. You do not need an account: the site works without signing in.
2. Last updated and change history
The last-updated date is shown at the top of this page. Change history:
- — First version of this policy, the cookie banner and the privacy request form.
3. Data we collect
- Your name-search preferences (origin, style, gender, number of letters) and any name you look up: optional, but without them we cannot suggest names. Not linked to you.
- Names you love: only the name and a like count, with nothing that identifies you.
- Your email if you sign up for the weekly name emails, plus the page you signed up on: optional; without it we send you nothing.
- Your feedback message, and your email if you add it: the email is optional; without it we cannot reply.
- Privacy requests: your email (required so we can answer), your name and phone (optional), and the request text.
- Your cookie choice: a random id, the date and time, the banner version and your choices.
- Technical data: your IP address and browser type pass through our hosting providers to serve pages; we keep only a scrambled hash of the IP to limit abuse.
- Analytics (only if you agree): a random browser id that we store only as a hash, the page, the broad source of the visit (e.g. "google") and the language.
We do not collect sensitive data and never ask for ID or official numbers.
4. How we collect your data
- Directly from you when you use the generator, the search or a form.
- Automatically through your browser: local storage for your features and, only after you agree, analytics tools.
- Through the service providers that run the site (section 7). We do not buy data from third parties.
5. Why we use your data and the legal basis for each purpose
- Suggesting names, showing name pages and keeping your shortlist: to provide the service you ask for (contract).
- Weekly name emails: your consent.
- Replying to your feedback: your consent and request.
- Measuring use to improve the site: your consent through the cookie banner.
- Protecting the site and preventing fraud and abuse (rate limits, the host's bot protection): legitimate interest.
- Handling your rights requests and keeping consent records: legal obligation.
Consent is never a condition of using the site: everything works if you reject all optional cookies.
8. Where your data is stored and whether it leaves Saudi Arabia
The database is hosted with Amazon Web Services in Ireland (European Union, region eu-west-1). Pages pass through Cloudflare's global network, and Google processes AI requests on its servers outside the Kingdom.
These transfers are needed to provide the service you ask for (Article 2 of the Regulation on Personal Data Transfer outside the Kingdom), with safeguards: the minimum data, encryption in transit and restricted access.
9. AI and automated processing
We use AI to suggest names and explain their meanings and origins. We send it only your preferences or the name you look up, never your email or anything that identifies you. Real names that visitors look up may be added to the site's public name pages.
No decision with a legal effect on you is made solely by automated processing; the results are suggestions only.
10. How long we keep data and how we destroy it
- Analytics and consent records: 400 days (about 13 months), then deleted automatically.
- IP hashes used for rate limits: deleted after 40 days at most.
- Privacy requests: 3 years after the request is closed, to show we complied, then deleted automatically.
- Newsletter email: until you unsubscribe; deleted at once when you do.
- Feedback: until we have dealt with it or you ask us to delete it.
- Local storage: in your browser until you clear it.
11. How we protect your data
We use encrypted connections (HTTPS); tables with personal data can be read only by the site's server; we never store raw IP addresses; and we rate-limit requests to prevent abuse. If a breach affects your data, we notify the competent authority and you as the law requires.
12. Marketing messages
We send the weekly name emails only to people who entered their email and asked for them. You can unsubscribe anytime through the request form (type "Unsubscribe from marketing emails"), and your email is removed from the list immediately. Every email we send will also carry an unsubscribe link.
13. Children's privacy
The site is meant for parents and people aged 18 or over. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have.
14. Your rights and how to use them
- The right to be informed about how your data is processed (this policy).
- The right to access your data and get a copy.
- The right to correct or update your data.
- The right to ask us to delete or destroy your data.
- The right to withdraw your consent at any time; processing that relies on it stops at once.
- The right to complain, and to claim compensation as the law provides.
Using your rights is free. We answer within 30 days of receiving your request; we may extend this once by up to 30 more days if needed, and we will tell you why beforehand. We may ask you to verify your identity first.
15. Complaints and contacting SDAIA
Please send your complaint to us first through the request form (type "Make a complaint"); we answer within 30 days. If you are not satisfied, you may complain to the Saudi Data and AI Authority (SDAIA) at sdaia.gov.sa.
16. Changes to this policy
When we change this policy we update the last-updated date and the change history above. For a material change, such as a new purpose or a new data provider, we show a clear notice on the site and ask for your consent again where consent is the basis.