1. Controller and contact
Ivan Kononenko, Empresário em nome individual is responsible for personal data processed by NamedProof. Address: Rua Dom João I 280, 1, 4450-162 Matosinhos, Portugal. Send privacy requests to [email protected], with “Privacy” in the subject. This notice covers visitors, account holders, company representatives, experts and people whose professional information appears in research.
The service is for adults. Do not submit children's data, health records, identity-document scans, criminal records or other sensitive personal information in general research fields. If a specific identity or payment check is needed, use the designated provider's secure process.
2. Information and sources
Account information includes your name, verified email, account identifier, role and account activity. Google sign-in supplies identity information; NamedProof's application mirror does not store your Google password or Google access token. Authentication services still process the credentials and session information needed to sign you in.
You may provide profile links, aliases, professional history, location, specialties, qualifications, publications, conflicts, corrections and project preferences. Companies provide business and product information, briefs, authorized access, order details and responses. We also keep support correspondence, recorded choices and transaction references.
Research can collect professional information from public websites, biographies, social profiles, publications, repositories, citation services and other accessible sources. It stores source references and passages, research checkpoints, derived topics, scores, rate estimates and limitations. Public availability does not make information accurate or remove your data rights.
Web-server logs can include IP address, request time and path, response status and browser user agent. Separate operational counters record visits, registration events and referral attribution. A referral may connect a new account with the referring public profile.
3. Purposes and legal bases
We use account and assignment data to provide the service you request and perform our agreement with you. Where you represent a company, our legitimate interests in managing that business relationship support processing your work contact information.
Our legitimate interests include researching relevant professional evidence, checking attribution, preventing fraud, securing the service, managing support and understanding basic service use. We must consider your rights when relying on these interests; you may object. Information is not used to infer protected characteristics as measures of professional worth.
We rely on your affirmative choice for optional public-profile publication. You can withdraw that choice without making earlier lawful processing unlawful. An assessment has separate author and company publication permissions. Legal obligations support necessary financial records and lawful disclosures. We do not treat using the website as consent to unrelated marketing.
4. Automated research and profiling
Research uses AI-assisted search and analysis, including OpenAI/Codex, to associate sources with a person and professional topics. Relevant information and source passages are sent to the processing service. The system considers attribution, demonstrated work, topic relevance, independent corroboration, evidence quality and uncertainty; missing or ambiguous evidence can limit the result.
The resulting profile and price guidance may affect which opportunities are considered relevant, but do not guarantee work or establish a person's competence in every context. Scores do not measure a provider's internal trust weights. Identity and assignment checks are separate. You can challenge a mistaken identity, source or inference and request human review; commercial source code need not be disclosed to exercise those rights.
Do not assume that every upstream AI service has zero retention or identical training settings. These depend on the service and account arrangement. Ask us before submitting information that requires a specific processing restriction; do not include confidential client material in public-profile research.
5. Who receives information
Access is limited by purpose. Recipients include:
- NamedProof's operator and authorized people handling support, research, assignments and security. An assigned expert receives the brief and authorized materials needed for that assignment; the company receives agreed expert and assessment information, not the expert's private research dossier.
- Google Cloud for hosting and Google for sign-in; shared Agntbase authentication infrastructure for account access.
- OpenAI/Codex and relevant public search/source services for research. Depending on the research route, these include GitHub, Stack Exchange and OpenAlex.
- Resend processes your verified email address and transactional messages. Research reports can include assessed topics, authority scores or evidence-coverage figures, rate guidance, limitations and a private card with links to NamedProof. Depending on the report version, the email body can also include claim text, source details and verification or review outcomes. These outcomes do not certify source truth, authenticity or independence. The full private raw dossier is not included in the email body or attached. Cloudflare routes incoming support mail to the operator's Gmail mailbox.
- Telegram for private operational notifications to the operator. New-account alerts include name, verified email, role and creation time. The observer uses a daily pseudonymous identifier locally to deduplicate visits. Telegram visit alerts contain aggregated counts, the role indicated by the link, the last page path and an event reference. Telegram retains messages separately from our local notification log.
- Stripe when you use a payment service. Stripe receives payment and transaction information and operates its own payment, fraud and regulatory processes. NamedProof keeps transaction references and status rather than full card details.
- Advisers, authorities or service successors when necessary for legal obligations, disputes, or a properly safeguarded business transfer. Approved public material is available to anyone, including search engines and AI services.
6. International processing
Our providers operate internationally. Their published notices describe processing in the European Economic Area, the United States and other countries. A server's location alone does not establish where all provider processing occurs.
Google, Google Cloud, Cloudflare, Resend and Stripe describe Data Privacy Framework and/or standard contractual clause arrangements for transfers covered by their respective terms. OpenAI's European privacy policy describes adequacy decisions and standard contractual clauses. Telegram describes sharing with group companies in the British Virgin Islands and the United Arab Emirates under intra-group contractual safeguards. The linked provider documents explain their published positions.
We have not completed verification of the contracting entities, accepted terms, transfer mechanisms and location settings applicable to every NamedProof data flow. Research uses Codex through ChatGPT account sign-in; we have not verified that a business-service or API data processing agreement covers that use. Telegram's stated intra-group safeguards do not establish a transfer agreement between NamedProof and Telegram.
This notice does not confirm that every transfer is covered by a particular safeguard. Your data-protection rights and our obligations remain unchanged. Contact [email protected] for information about processing your data, relevant safeguards and how to obtain a copy where applicable.
7. What becomes public
An expert profile requires the expert's publication choice and the relevant identity/evidence checks. Public fields can include name, professional description, topics, evidence coverage or scores, rate guidance, languages, availability, publication links and completed public work. Email, private research notes and account credentials are not part of that public profile.
For new commissioned assessments, the company must approve the complete public record. Public records include named authorship, sponsorship, method, findings, limitations and relevant evidence. A private assignment is not made public just because research or work is finished.
Withdrawing a profile from our public directory does not recall copies already shared, downloaded, indexed or cached by others. Contact us about associated assessment records; public-interest, contractual and legal retention questions are assessed separately. The 24-month publication rule does not override mandatory data rights.
8. Retention and deletion
Retention depends on purpose: account and research records support the requested profile and its correction history; assignment records support delivery, licensing and disputes; financial records follow applicable accounting and legal obligations. Necessity is assessed against account closure, project completion, unresolved claims and statutory periods rather than a single lifetime for all data.
Some limited operational records have explicit expiry: the visit observer removes daily visitor identifiers after 48 hours and sent notification receipts after 30 days. This does not delete raw server logs, account records, queued notifications or Telegram message history.
Account-wide erasure requests are handled through a manual process; there is no self-service account-wide deletion feature. Backups are not automatically pruned. Research and transaction audit records, email history and backups require separate retention and erasure checks. A request requires checking the live records, service providers, backups and any lawful retention exceptions. We explain any restriction and the applicable criteria; closing a browser or hiding a profile is not account erasure.
9. Your rights
Depending on applicable law, you may request access, correction, erasure, restriction or a portable copy of your data; object to legitimate-interest processing; withdraw consent; and challenge relevant automated decisions. You may complain to Portugal's CNPD or the authority where you live or work.
Email [email protected]. Identify the account or public record and the requested action; do not send a passport by ordinary email. We may ask for proportionate identity evidence. We respond without undue delay and within one month of receiving a GDPR rights request. Where legally permitted because of the complexity or number of requests, we may extend this by up to two further months; we explain the extension and its reasons within the first month. If a request is refused or limited, we explain why and the available complaint route.
You do not have to buy a service, maintain a public profile or prove commercial harm to make a privacy request. Corrections to personal facts are distinct from a request for a higher commercial score.