Your data. Our two-tier retention promise.
NAMED runs on two kinds of data — the records that identify you, and the anonymized aggregates that power what we sell. They have different lifetimes, and we spell those out below.
Our two-tier retention model
Individual records live briefly. Anonymized aggregates live longer. Both are necessary — one for your privacy, one for the marketplace.
Verification documents, identity fields, contribution history, and any other row attached to you as an individual are purged 90 days after the record settles or your account closes. Gone — not 'soft deleted,' not 'archived.'
Once individual records are purged, the demographic aggregates derived from them — age range, location band, gender, income band — continue to live in our aggregate store. They're the product buyers pay for, and they're what makes the marketplace work over a multi-year horizon.
Exact aggregate horizon: to be confirmed by buyer demand research before final publication.
What we collect
Identity fields.
Name, email, and the verified demographics you choose to share with us.
Demographic fields.
Age range, location band, gender, income band — bucketed before they reach our aggregate store; never stored at the individual level beyond the 90-day window.
Verification documents.
Only when you opt into a higher tier. Purged 90 days after settlement or account closure; never reused for any other purpose.
Contribution history.
What you shared and when. Used to compute payouts, then purged 90 days after settlement unless the underlying payout is still in flight.
How we store it
Encrypted at rest.
AES-256 across the database. Keys rotate on a fixed schedule and live in a separate key store from the data itself.
Encrypted in transit.
TLS 1.2 minimum. Older protocols are not allowed.
Tier integrity.
Verification documents and the tier they unlock live in a separate, audited table. Downgrading a tier does not delete the verification history — we keep the receipt of when you were verified.
Your rights
Pause at any time.
One-click pause from your dashboard. Your records stop contributing to aggregates on the next settlement cycle.
Delete at any time.
Full account deletion from your dashboard. Individual records are purged on the 90-day window from that moment.
Portability.
Export your contribution history and your demographic fields in a portable, machine-readable format.
Opt out of aggregates.
Request exclusion from the anonymized aggregate outputs entirely — your records won't appear in any tranche, current or future.
Regulatory posture
GDPR & CCPA compliant.
Access, deletion, portability, and opt-out honored in every region we operate in.
State privacy laws (US).
Compliant with Virginia, Colorado, Connecticut, Utah, and the rest as they come online.
No KYC reuse.
Verification documents collected for licensing tiers are siloed and never reused for any other purpose.