Privacy policy

This policy follows the EU General Data Protection Regulation (GDPR), the UK GDPR and, for California residents, the CCPA, written here in plain language.

Who is responsible

The service is operated by Zodimuse. For anything about your data, write to [email protected].

What data we collect

• Name and email.
• Date, time and place of birth (city, country and coordinates, used only to work out the time zone and the chart).
• Your interest in men, women or both (only in the Soulmate Portrait).
• Name, date, time and place of birth of the other person, which you enter after confirming you may share them (only in Couple Compatibility).
• The theme you choose for the tarot reading.
• The photo of your palm that you upload, kept in a private area, without location data (EXIF).
• Order data: items, amount, payment method (Pix or card) and payment status. We do not store your card number, expiry date or security code: they go straight to the payment provider, which sends us back only a charge identifier.
• Technical data: language, country, IP address, browser and ad parameters (UTMs, fbclid), plus Meta Pixel identifiers (_fbp and _fbc).

What we use it for

We use your data to deliver what you bought, send the access link, handle support and refunds, measure our ads and protect the service from fraud. We do not sell your data. Birth data is used only to calculate your report. The palm photo is used only to produce your reading; we do not publish it or use it for anything else.

If you ask to be notified when a product opens, we keep your email and the date of your consent only to send that single notice.

Legal basis

We process your data to deliver what you bought (contract), to meet legal obligations such as financial records, to protect the service against fraud (legitimate interest) and, where the law requires it, with your consent (for example, the opening notice).

Who we share it with

With the payment provider (card), to charge you; with the email delivery service, to send you the link; with the image generation service, which receives only descriptive traits of the portrait, without your name or email; with the AI service that classifies the palm photo, which receives only the image, without name or email; and with Meta, which receives purchase events through the Conversions API: email, first name and country in hashed form, purchase amount, IP address, browser and Pixel identifiers, when you arrive from an ad.

Cookies and pixel

We use essential cookies to remember your language and session. We also use the Meta Pixel, with ad parameters (UTMs, fbclid), to measure whether our ads work. You can block cookies in your browser or adjust your ad preferences on Meta.

Site measurement (no personal data)

To learn where people drop off and whether the site is fast, we record anonymous events from your visit: pages viewed, how far the page was scrolled, clicks on the buy button, steps of the form and of the test, payment opened, payment method chosen (Pix or card), purchase completed, delivery opened and download. Each visit gets a random code that stays only in the browser tab (sessionStorage) and disappears when you close it. It travels with the ad source (src and utm), the language, the device type (phone, tablet or computer) and the country. These events do not record your name, email or IP address, or what you type. We also measure the real speed of the pages (LCP, INP, CLS, TTFB and FCP) and check our own pages every day with Google PageSpeed Insights. These records are kept for 90 days. In the European Union, the European Economic Area, the United Kingdom and Switzerland, measurement only starts after you accept in the cookie notice. This brand also uses Google Analytics 4 to measure visits and purchases in aggregate; it only loads after your acceptance where the law requires it.

International transfers

Our providers (payment, hosting, email and Meta) may process data in other countries. When that happens, we require protection consistent with this policy and with the applicable law, such as standard contractual clauses.

How long we keep it

Retention periods. Date, time and place of birth, interest you entered and reading theme, access data (IP and browser) and ad identifiers are kept for 12 months, the same time your access link works, and are then anonymized. The other person's data, entered by the buyer, follows the same 12-month period and is then anonymized too. The order, name and email of the purchase are kept for 5 years, as tax law requires, and are then anonymized too. If you sign up and do not buy, your data is anonymized after 12 months. The email for the opening notice is deleted 30 days after the notice (or after 12 months, if the product does not open). An automatic routine of the service applies these periods.

Palm photo: the original photo is deleted as soon as the reading is ready and, if processing fails, within 24 hours. The result stays available for 30 days and is then deleted. If you ask for deletion sooner, we delete sooner.

Your rights

You can ask for access, correction, deletion, portability and to object to processing, and withdraw consent at any time, by writing to [email protected]. California residents can also ask what we collect, ask us to correct or delete it, opt out of sharing for advertising, and will not be treated worse for doing so. We do not sell your personal data for money. When you ask for deletion, we erase the data you sent us and end your access to the content, keeping only the financial record required by law.

To ask for deletion, write to [email protected] or open your access link and add /delete at the end of the address. We delete the palm photo, date, time and place of birth, the interest you entered, the other person's data, the reading theme and your access data and end your access; only the order and the email of the purchase remain, which tax law requires us to keep for 5 years.

You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office).

Controller and data protection contact

The contact for data subjects and data protection matters is [email protected].

Changes

If this policy changes, the version in force is always on this page.