Privacy Policy

The short version

The operator of TarotAI is responsible for TarotAI’s handling of information described here. Stripe and Link separately handle information for Managed Payments as merchant of record and independent controllers for payment, indirect tax, fraud and dispute management, transaction support, security, and compliance. We receive limited transaction information needed to match purchases and manage access, but we do not receive or store your full card number or CVC.

We do not run advertising or sell personal information. Optional TarotAI product analytics remains consent-based and off by default.

Information we handle

• Anonymous reading information: the current question, private context, card, and answer are held in your browser session. A 30-minute local recovery copy is created only when you start sign-in.
• Account and saved reading information: Supabase processes your account identifier, authentication details, locale, and saved reading fields when you sign in and choose to save or share.
• AI consultation information: Supabase stores your original question, cards and positions, answer, language and safety state, credit transaction, and time. Consultation questions and answers are encrypted in the business database. The question, relevant conversation history, card facts, and a necessary internal translation may be sent to a configured AI inference provider to generate and safety-check an answer; the internal translation does not replace the original text in your history.
• Feedback: a rating, selected reason, and optional note may be stored and used to evaluate and improve answer quality.
• Payment and subscription information: we may receive your name, email, phone number, billing address, tax identifier if collected, Stripe customer and checkout identifiers, plan and order details, amount, tax, currency, fulfillment status, payment and subscription status, billing dates, invoice identifiers, refund or dispute status, support interactions, and a limited payment-method description such as brand and last four digits. Which fields are available depends on checkout configuration and the method you use.
• Optional analytics information: after you choose Allow, PostHog EU may receive a route template without query parameters, language, deployment environment, referring domain, cleaned campaign labels, stable button identifiers, and approved reading action names. Microsoft Clarity may receive masked page-interaction data under the same choice. If you later sign in, an internal Supabase UUID may connect permitted events; we do not send your email.
• Technical information: hosting, security, analytics, and payment providers may process IP address, browser and device information, requested URL, referring page, cookies or similar identifiers, and timestamps.
• Messages you send us: when you contact us, we receive your email address, message, and any purchase details you choose to provide.

Please do not put payment details, sensitive personal information, or another person’s private information into a reading question.

Where information comes from

We receive information from you, your browser or device, your TarotAI account activity, and service providers that help us operate the service. Stripe may send us transaction and subscription records after you use its hosted Checkout or Customer Portal. We may also receive fraud, dispute, refund, or payment-status information from Stripe and financial networks.

How and why we use information

TarotAI uses information to reconcile orders, match purchases to the correct account, deliver credits and access, provide product support, prevent abuse, maintain security and reliability, respond to requests, and meet its accounting and legal obligations. Stripe and Link use information to process payments, present or send transaction receipts and invoices, manage Managed Payments indirect tax, provide transaction support, and handle fraud, refunds, and disputes.

Where a legal basis is required, we rely on performance of our agreement with you, our legitimate interests in operating and securing the service, your consent where requested, and compliance with law.

Stripe and payment-data boundaries

Payment details are entered on Stripe-hosted pages. Stripe may collect identifying, contact, billing, device, cookie, transaction, tax, fraud-prevention, and payment-method information. For Managed Payments transactions, Stripe acts as merchant of record and independently handles parts of payment processing, indirect-tax compliance, fraud and dispute management, transaction support, security, and legal compliance.

TarotAI does not receive or store the full payment card number, CVC, or online-banking credentials entered in Stripe Checkout. Stripe and Link handling is described in the Stripe Consumer Terms, Stripe Privacy Policy, Stripe Privacy Center, Link Privacy Policy, and Link Privacy Center.

Cookies, analytics, and hosted pages

TarotAI does not set advertising cookies or track you across unrelated third-party websites. Optional PostHog and Microsoft Clarity product analytics is opted out by default and begins only after you choose “Allow product analytics.” You can refuse without losing access and later withdraw through “Privacy choices.”

Session Replay, broad autocapture, heatmaps, form values, DOM text, full URL query parameters, tarot questions, reading text, email, passwords, cookies, access or share tokens, and AI conversation text are not collected by our PostHog integration. PostHog IP storage is disabled in our project configuration before production activation.

Microsoft Clarity loads only after the same choice, does not run on admin pages, and masks question fields, reading and consultation text, Yes/No answers, conversations, and sign-in forms.

Google Search Console provides aggregate search-performance information. When you leave TarotAI for a Stripe-hosted Checkout or Customer Portal page, Stripe’s cookies, fraud-prevention signals, and privacy practices apply.

When information is shared

We share limited information as needed with Supabase for accounts and storage; configured AI inference providers for generating and safety-checking consultations; Stripe, Link, payment networks, and financial institutions for payments, subscriptions, tax, transaction support, refunds, and disputes; hosting, infrastructure, security, and communications providers, including Resend when enabled; PostHog EU and Microsoft Clarity only after analytics consent; Google Search Console for aggregate search reporting; professional advisers; and authorities when reasonably necessary to comply with law, protect rights and safety, or investigate abuse.

Information may also transfer as part of a merger, financing, acquisition, or sale of assets, subject to appropriate protections. We do not sell personal information or share it for cross-context behavioral advertising.

Retention and account deletion

Anonymous reading data is not added to our database. Saved readings and consultation history remain until you delete an individual record or delete all consultation history. Deletion removes the live content and starts the documented erasure process; encrypted backups may retain a residual copy until normal rotation completes, while de-identified credit, cost, security, and audit records may be retained for service integrity.

We retain limited payment, subscription, invoice, refund, dispute, audit, and support records for as long as reasonably needed for service delivery, tax, accounting, fraud prevention, dispute handling, and legal compliance. Deleting a TarotAI account does not necessarily erase records we must retain. Before TarotAI account deletion proceeds, we ask Stripe to stop future renewal of any active subscription; retained financial records are then detached from the deleted account identity where practicable.

A separate deletion request made to Stripe or Link can affect information and subscriptions held for Managed Payments and may cancel a Managed Payments subscription. It does not by itself delete your TarotAI account or TarotAI-held data; contact us separately if you also want to delete the TarotAI account.

Optional analytics data is retained in PostHog EU for up to one year under the current plan. Microsoft Clarity keeps its data under Microsoft’s retention settings for the project. Withdrawing consent stops future capture but does not automatically delete analytics data already collected. Stripe applies its own legally required retention periods.

International processing

TarotAI and its service providers, including Stripe, may process information in countries other than the one where you live. Where required, we use legally recognized contractual or transfer safeguards. Privacy laws and protections may vary by location.

Security

We use reasonable safeguards appropriate to the information we handle and limit our systems’ access to full payment credentials by using Stripe-hosted checkout. No internet service can guarantee absolute security.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing; receive a portable copy; withdraw consent; appeal a decision; or complain to a data-protection authority.

You can view, export as JSON, and delete saved readings from My Readings. A share hides the original question by default and excludes private context and account details unless you deliberately include the question. For other TarotAI requests, email support@tarotai.ai. We may need to verify your identity, and some payment, tax, fraud, or dispute records may be exempt from immediate deletion.

For information Stripe holds for its own purposes, you may also use Stripe’s privacy channels described in its Privacy Center.

Adults only and crisis limits

TarotAI accounts and AI consultations are for people 18 years old or older. TarotAI is not a real-time crisis service, cannot monitor you, and cannot automatically contact emergency services. If there is immediate danger, contact local emergency services and someone you trust.

Changes and contact

We may update this policy when our service, providers, or legal obligations change. The date at the top identifies the current version. For privacy questions, rights requests, or payment-data concerns, contact support@tarotai.ai.