Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, make a purchase, or contact us through our contact form. This may include your name, email address, and messages you send us.

2. How We Use Your Information

We use the information we collect to provide our services, process payments, communicate with you, and improve our offerings. We may also use your information to send you updates about our services.

3. AI-Generated Readings & Personalization

CelestialFate's tarot reading service is conducted entirely by artificial intelligence. Card selection and all interpretations are generated by AI algorithms. We store the questions you submit and the complete results of all your previous readings. This stored data is used to build a personalized profile about your inquiry patterns and spiritual interests. This profile is used solely to generate deeper, more contextually accurate, and increasingly individualized readings over time. Each reading you receive is unique to your account and is never shared with, reused for, or viewed by other users.

4. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy or as required by law.

5. Payment Processing

Payments are processed by Stripe, a third-party payment processor. We do not store your payment information on our servers. Stripe's use of your information is governed by their privacy policy.

6. Data Security

We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

7. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations. You may request deletion of your account and associated data at any time. This includes deletion of your reading history and personalized profile.

8. Cookies and Analytics

We use cookies and similar technologies to enhance your experience. For detailed information about our cookie usage, please see our Cookie Policy. You can manage your cookie preferences at any time using the cookie settings tool in the footer.

9. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract: To provide our services and fulfill orders
• Legitimate Interest: To improve our services and communicate with you
• Consent: For marketing communications and non-essential cookies
• Legal Obligation: To comply with applicable laws and regulations

10. Data Processors

We use the following third-party service providers who process data on our behalf:

• Vercel: Website hosting and deployment (EU-based)
• Neon: Database hosting (EU-based)
• Stripe: Payment processing (PCI DSS compliant)
• Brevo (formerly Sendinblue): Email marketing and transactional emails

11. International Data Transfers

Your data may be transferred to and processed in countries other than your own. When we transfer data outside the UK/EU, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

12. Your Rights (UK GDPR)

Under UK GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for marketing at any time

13. Data Subject Requests

To exercise your rights or make a data subject request, please contact us through our contact form. We will respond to your request within 30 days. If you are logged in, you can also access data management tools in your account settings.