Privacy Policy

Last updated: 29 September 2026

This policy explains how Tarot from London handles information about visitors to tarotfromlondon.com. We collect only the information needed to provide the Card of the Day, AI readings, purchased-reading balances, site security and contact requested by you.

Who is responsible for your data

The site operator is the Tarot from London project, United Kingdom. For privacy questions or to exercise your rights, contact us through WhatsApp:

Information we process

• your email address when you request a sign-in link;
• account and session identifiers and your free or purchased reading balance;
• your question or chosen focus for an annual forecast, card names and positions, and the generated interpretation;
• purchase details, including the selected product, payment status, Stripe identifiers and credited readings. We do not receive your full card details;
• technical information needed for operation, security and aggregate analytics, such as IP address, request data, browser, device, page visited, referral source and approximate location;
• contact details and message content when you choose to contact us through WhatsApp.

Please do not include full names, addresses, medical information, financial details or other sensitive information in your question.

How we use information

We use it to provide your requested reading, authenticate you by email, maintain and credit your balance, process and verify payments, protect and improve the service, understand overall traffic and respond to enquiries.

Legal bases

Information required to provide a selected feature, sign-in or payment is processed to perform a contract or take steps at your request. Limited technical and analytics data is processed for our legitimate interests in operating a secure and reliable service. Where consent is legally required, we will request it separately.

Service providers and international transfers

We use Vercel for hosting, server functions and analytics; Supabase for email sign-in, sessions and reading balances; Resend for service emails; Stripe for secure payments; OpenAI to generate readings using our original interpretative knowledge base; and WhatsApp/Meta for conversations you initiate. Social links lead to external platforms governed by their own policies. Some providers may process data outside the United Kingdom using their applicable contractual and legal safeguards.

Retention

Account, balance and transaction records are kept for as long as needed to operate the service, meet accounting and legal duties, resolve disputes and prevent abuse. Questions are used to generate a response and are not used by us for advertising profiles. Providers may retain requests and service logs according to their own policies and settings. We delete or anonymise data after a valid request unless continued retention is legally required.

Cookies and browser storage

We do not use advertising cookies or build advertising profiles about visitors. We use only essential browser-storage technologies, including local storage, to remember your Card of the Day and its reading, guest-reading status, sign-in session, purchased balance and technical preferences. These functions are necessary for the site to remember your choices and provide the services you request.

We use Vercel Analytics to understand aggregate site traffic without advertising cookies. When you continue to Stripe, Supabase, WhatsApp or a social platform, that external service may use its own essential or other technologies under its privacy policy.

On your first visit, we display a short information notice and store a browser preference recording that you dismissed it. You can remove local data and cookies in your browser settings, but doing so may remove your sign-in, saved Card of the Day and other site state. If we add optional advertising or tracking technologies in the future, they will not run until any legally required consent has been obtained.

Your rights

Depending on the circumstances, you may request access, correction, deletion, portability or restriction, object to processing, or withdraw consent. Contact us through WhatsApp; we may need to verify your identity. You may also complain to the UK Information Commissioner’s Office through the ICO website.

Security and changes

We use reasonable technical and organisational safeguards, although no internet service can guarantee absolute security. We may update this policy when the site’s features or providers change; the current date appears above.