Privacy Policy
October 2026
TarotByMe takes the privacy of your data seriously. This policy clearly explains what data we collect, why we collect it, how we use it, and what your rights are — in line with applicable data protection law (in Brazil, the LGPD — Law 13,709/2018).
1. Data Controller
Data controller: TarotByMe - Contact: contact@tarotbyme.com
2. Data We Collect
Registration Data
Name and email address — required to create an account and communicate with you.
Payment Data
Processed exclusively by Stripe. TarotByMe does not store credit card data — we only check the status of a purchase or subscription.
Question, Cards, and Reading Interpretation
Your question, the cards drawn, and the AI-generated interpretation are stored as the record of the reading you paid to receive — they are not disposable data. You can hide any reading from your history at any time, without affecting the financial record of the purchase. The retention period depends on your plan type: a fixed 30 or 90 days for one-time purchase plans, or for as long as a monthly subscription is active plus a 90-day grace period after cancellation — see the Plans page for details.
Credits and Transactions
We keep a ledger of credit reservations, charges, and releases per reading, as proof of billing and for financial audit purposes. This ledger is not deleted even if the corresponding reading is hidden from your history.
Risk Signal Detection
Questions submitted to the platform go through an automated check for signs of risk to life or self-harm, to show a support notice when needed (see Section 8). This check does not store the content of your question — it only anonymously records that a notice was shown.
Usage Data
Language, timezone, and account preferences set in Settings, plus technical usage records to correctly apply your plan's limits.
Card Photos (Regular Deck Recognition)
If you photograph your physical cards for automatic recognition, the image is sent directly to our AI provider (OpenAI) solely to identify the photographed cards. TarotByMe never stores these photos — they never pass through our storage servers or get saved after recognition.
Shared Readings
If you generate a public link to share a reading, that reading's content (question, cards, and interpretation) becomes accessible to anyone with the link, even without a TarotByMe account, until you hide the reading from your history.
3. Purpose and Legal Basis
| Data | Purpose | Legal Basis |
|---|---|---|
| Name and email | Account, authentication, communication | Contract performance |
| Payment (via Stripe) | Processing purchases and subscriptions | Contract performance |
| Question, cards, and interpretation | Delivering and storing the reading you paid for | Contract performance |
| Credit ledger | Proof of billing and financial audit | Contract performance / legal obligation |
| Risk notice (anonymized) | User safety and improving detection | Legitimate interest |
| Email (communications) | Account and service updates | Legitimate interest |
| Card photo (regular deck) | Automatic recognition of the photographed card | Contract performance |
| Shared reading link | Letting you share a reading with third parties of your choice | Consent (your decision to share) |
| Analytics cookies (Google Analytics) | Understanding site usage to improve it | Consent (cookie banner) |
4. Data Sharing
Your data is shared only with:
- —Supabase (database and authentication infrastructure)
- —OpenAI (generating your reading's interpretation, based on the cards and your question; and recognizing photographed cards, when applicable)
- —Stripe (payment processing) — subject to Stripe's own privacy policy
- —Resend (transactional emails) — only email and name
- —Google LLC (Google Analytics) — only if you choose "Accept all" in the cookie banner; see Section 9
We do not sell, rent, or share your data with third parties for commercial purposes.
5. Data Retention
Account data is kept while your account is active. Reading history follows the retention period of the plan type used for the purchase (Section 2 above, and the Plans page). After a monthly subscription is cancelled, history is kept for 90 more days before being deleted. Payment/ledger data may be retained longer when required by legal obligation (e.g. tax records).
6. Your Rights
You have the right to:
- —Confirmation that we process your data
- —Access to the data we hold about you
- —Correction of incomplete, inaccurate, or outdated data
- —Anonymization, blocking, or deletion of unnecessary data
- —Withdrawal of consent at any time
- —Full deletion of your account and associated data
To exercise any of these rights, email contact@tarotbyme.com with the subject "Data Rights". We respond within 25 business days.
7. Security
We use appropriate technical and organizational measures to protect your data: secure authentication via Supabase, encrypted communication (HTTPS/TLS), database access control via Row Level Security (RLS), and API keys that are never exposed in source code.
8. Risk Signal Detection
When a question submitted to the platform shows signs of risk to life or self-harm, we automatically show a support notice with a helpline appropriate to your region, instead of proceeding normally with the reading.
This process is logged anonymously — with no identification of the user linked to the event (your account identifier is cryptographically hashed before anything is logged) — solely to monitor the safety mechanism itself, never for account moderation or user profiling.
9. Cookies and Local Storage
We use cookies strictly necessary for the site to work: session authentication (Supabase), your chosen language, and the currency detected by geolocation on first visit. Your physical-deck preparation progress is saved temporarily in your browser's local storage and never sent to our servers.
If you choose "Accept all" in the cookie banner, we also load Google Analytics, which uses cookies (_ga, _ga_*, _gid) to understand how the site is used. These cookies are only loaded with your explicit consent, and you can revoke that choice at any time by clicking "Manage Cookies" in the site footer.
For the full list of cookies, their purposes, and durations, see our Cookie Policy, available in the site footer.
10. Changes to This Policy
We may update this policy periodically. Material changes will be communicated through the site via a cookie consent notice. The date of the last update is always shown at the top of this page.
11. Contact
Questions about this Policy: contact@tarotbyme.com
Brazilian data protection authority (ANPD): www.gov.br/anpd