Privacy Policy

Unclaimed by AI (“we”, “us”) operates the name-checking service at unclaimedbyai.com (the “Service”). We help founders and creators check domains, social handles, and AI associations before building around a name.

For data-protection purposes we are the data controller for the personal data described in this policy. You can reach us at hello@unclaimedbyai.com.

We collect the minimum needed to run the Service:

• Account data. Your email address when you sign in with a magic link or Google, plus basic profile details Google shares (like your name) if you choose that option.
• Names you check. Every name, brief, search, and report you create, including the results we generate for you.
• Purchase data. Which credit packs you buy and your credit balance. Payments are processed by Stripe — we never see or store your card number.
• Technical data. Standard server logs (IP address, browser type, pages visited, timestamps) for security and debugging.
• Waitlist data. Your email if you join the waitlist, used only to notify you about launch.

We use your data to:

• Run domain, social-handle, and AI-association checks you request.
• Create and maintain your account and sign-in sessions.
• Process payments and manage your credits through Stripe.
• Send transactional emails (magic links, receipts) and, rarely, product updates.
• Keep the Service secure, fix bugs, and understand aggregate usage.

Our legal bases are performance of our contract with you, our legitimate interests in operating and securing the Service, and your consent where you give it (for example, marketing emails, which you can opt out of at any time).

This one deserves its own section because it surprises people. To tell you what AI models already associate with a name, we send that name to third-party AI providers (via OpenRouter) and ask what they know about it. Their responses become part of your report.

That means every name you check is shared with AI model providers, and their own privacy policies apply to that data. Please don't check names containing passwords, secrets, or other sensitive information — the checker is for brand names you're considering, and you should treat anything you type as non-confidential.

Domain availability is checked against public registration data (RDAP/WHOIS), and social handles against the platforms' public APIs. Those queries are inherently public — a registry or platform can see that someone looked up that name.

We use a limited set of cookies and similar storage, all strictly necessary to operate the Service:

• Sign-in session cookies that keep you logged in.
• A theme preference so the site remembers light or dark mode.

We do not use advertising cookies, cross-site trackers, or third-party analytics beacons. If that ever changes, we'll update this policy and ask for consent where the law requires it.

We share data only with the service providers that operate the Service, each limited to what they need:

• Cloud hosting and database providers that store and serve the app and your data.
• Resend (transactional email) for magic links and receipts.
• Stripe (payments) for checkout and billing.
• OpenRouter and AI model providers for AI-association checks, as described above.
• Google, only if you choose Google sign-in.

We do not sell personal data, share it with advertisers, or use it for any purpose outside operating the Service. We may disclose data if required by law or to protect our rights, and we'll push back on overbroad requests where we can.

We keep account data, searches, and reports for as long as your account is active, so your history is there when you return. Server logs are kept for a limited period for security and debugging, then deleted or anonymized.

You can request deletion of your account and associated data at any time by emailing hello@unclaimedbyai.com. We'll delete your personal data within 30 days, except where we must retain records for legal, tax, or fraud-prevention reasons (for example, payment records).

We protect your data with encryption in transit (TLS) and at rest, least-privilege access to production systems, and scoped credentials for third-party services. Sessions expire, magic links are single-use and short-lived.

No system is perfectly secure. If you discover a vulnerability, please report it to hello@unclaimedbyai.com and we'll respond promptly.

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise any of these rights, email hello@unclaimedbyai.com.

If you're in the EU, UK, or Switzerland, this includes your GDPR rights (access, rectification, erasure, restriction, portability, objection) and the right to lodge a complaint with your supervisory authority. If you're in California, this includes your CCPA rights to know, delete, and opt out of sale — and to be clear, we do not sell personal information.

The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we'll delete it.

We may update this policy as the Service evolves. Material changes will be announced by email or in-app notice before they take effect, and the “last updated” date above will always reflect the current version. Continued use of the Service after changes take effect means you accept the updated policy.

For any privacy question, request, or complaint, email hello@unclaimedbyai.com. We aim to reply within a few business days.