Privacy Policy

Last updated: June 29, 2026

TarotNL respects your privacy. This Privacy Policy explains what information we collect, how we use it, how long we keep it, and the choices available to you when using our website and tarot reading services.

Information We Collect

When you use the reading page, we may store the question you submit, the cards drawn by the system, the AI-generated response, suggested follow-up questions, the conversation history for that reading session, the AI provider used, whether a free token was charged, and technical information such as a hashed IP address and browser user agent.

When you use the contact form, we collect the name, email address, and message you submit, together with technical information such as a hashed IP address and browser user agent.

If we introduce account registration, paid readings, subscriptions, or other paid services in the future, we may collect additional information needed to create and manage your account, process purchases, provide customer support, prevent fraud, and comply with legal obligations. This may include login details, billing-related information, purchase history, subscription status, invoices, and payment confirmation data. Payment card or bank details, if used, will generally be processed by third-party payment providers and not stored directly by TarotNL unless explicitly stated.

How We Use Information

We use this information to provide tarot readings, operate and secure the website, prevent abuse and automated misuse, enforce free usage limits, respond to contact requests, troubleshoot errors, and improve the quality, safety, and reliability of the service.

Legal Basis for Processing

Where the General Data Protection Regulation (GDPR), UK GDPR, or similar data protection law applies, TarotNL processes personal data on the following legal bases.

Legitimate interests. We process reading logs, hashed IP addresses, browser user-agent data, reCAPTCHA signals, questions submitted, card draws, and AI-generated responses to operate and secure the website, prevent automated abuse, enforce free-usage limits, troubleshoot errors, and improve service quality. We assess that these interests are not overridden by your fundamental rights and freedoms, given the limited nature of the data collected, the use of hashed rather than plain-text IP addresses in logs, and the short retention period for reading logs.

Contract performance. If account features, paid readings, subscriptions, token packages, or premium services are introduced, we may process information necessary to provide those services, including account credentials, billing-related data, purchase history, subscription status, and support records.

Legal obligation. We may process and retain information where required by applicable law, including tax, accounting, fraud-prevention, regulatory, or law-enforcement obligations.

Consent. Where we introduce processing activities that require consent, such as optional marketing communications or optional non-essential tracking, we will request consent separately and provide a way to withdraw it.

AI Providers

TarotNL uses third-party AI providers, currently DeepSeek and Google Gemini, to generate reading responses. When you submit a question, the question text, conversation context, and card draw information may be sent to these providers for the purpose of generating a response. We do not send contact-form email addresses to AI providers as part of a tarot reading unless you include such information in the reading text itself.

DeepSeek. DeepSeek is operated by Beijing DeepSeek Artificial Intelligence Co., Ltd., a company incorporated in the People's Republic of China. Data sent to DeepSeek may be processed on servers located in China or elsewhere outside the European Economic Area (EEA). China does not currently have an adequacy decision from the European Commission. Where GDPR transfer rules apply, TarotNL will use DeepSeek for GDPR-protected personal data only where an appropriate transfer mechanism is in place, such as provider data-processing terms, Standard Contractual Clauses, or another lawful transfer basis.

Google Gemini. Google Gemini is provided by Google LLC. Data sent to Google Gemini may be processed in the United States and other countries where Google operates. Google provides data protection terms for business services and participates in recognised international data transfer frameworks where applicable.

Google reCAPTCHA

We use Google reCAPTCHA to protect the website from spam and automated abuse. reCAPTCHA may collect hardware and software information, such as device and application data, and send it to Google for analysis. Use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

Google Analytics

We may use Google Analytics to understand how visitors use TarotNL, measure page views and interactions, improve the website, and identify technical issues. Google Analytics may use cookies or similar technologies and may process information such as pages visited, approximate location, device and browser information, referrer, and interaction events. We configure Google Analytics with IP anonymization where available. Google Analytics is subject to the Google Privacy Policy.

Cookies and Similar Technologies

TarotNL may rely on cookies, browser storage, and third-party scripts necessary for security, abuse prevention, analytics, and basic website functionality. Google reCAPTCHA may set necessary cookies for risk analysis. Google Analytics may set analytics cookies where enabled.

Data Retention

Tarot reading logs are kept for up to 30 days and are then automatically deleted. Contact form messages may be kept for as long as reasonably necessary to review, respond to, and manage the request, unless deletion is required by law or requested by you where applicable.

Data Security

We use reasonable technical and organizational measures to protect stored information. IP addresses used in reading and contact logs are stored as hashes rather than plain-text IP addresses. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Sharing of Information

We do not sell your personal information. We may share information with service providers that help us operate the website, including AI providers, hosting providers, database providers, security tools, and reCAPTCHA. We may also disclose information if required by law, legal process, or to protect the rights, safety, and integrity of TarotNL, its users, or the public.

If paid services are introduced, we may also share necessary transaction and account information with payment processors, fraud prevention providers, accounting tools, tax compliance providers, and customer support tools.

Data Processing Agreements and Sub-Processors

Where required by applicable data protection law, TarotNL seeks to use Data Processing Agreements or equivalent provider terms with service providers that process personal data on our behalf. These terms are intended to require providers to process data only for documented service purposes, apply appropriate security measures, assist with data-subject rights requests, and delete or return data at the end of the service relationship where applicable.

Current categories of sub-processors include AI response generation providers, security and bot-prevention providers, hosting and infrastructure providers, database providers, and, if paid services are introduced, payment and fraud-prevention providers. A current list of relevant provider categories is available on request through our contact form.

Your Choices and Requests

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with applicable data protection law, you may have rights regarding your personal data.

Access. You may ask whether we process personal data about you and request a copy of that data.

Rectification. You may ask us to correct inaccurate or incomplete personal data.

Erasure. You may ask us to delete personal data where there is no longer a lawful reason for us to keep it.

Restriction. You may ask us to limit how we process personal data in certain circumstances, for example while we review a correction or objection request.

Portability. Where applicable, you may ask to receive certain personal data in a structured, commonly used, machine-readable format.

Objection. You may object to processing based on legitimate interests, including certain security, abuse-prevention, analytics, or service-improvement processing, where applicable law gives you that right.

Withdraw consent. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You may also have the right to lodge a complaint with your local supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens. In the United Kingdom, this is the Information Commissioner's Office.

To exercise privacy rights or make a privacy request, use our contact form. We aim to respond within 30 days of receiving your request. In complex cases, we may extend this period where permitted by law and will notify you of any extension.

International Use

Our service may be accessed from different countries, and our service providers may process information in jurisdictions other than your own. By using TarotNL, you understand that information may be processed where we or our providers operate.

Children

TarotNL is intended for adults and is not directed at children. Where account registration is introduced, we will require confirmation that you are at least 16 years of age, or at least 18 years of age where required for paid services or by applicable law. We do not knowingly collect personal data from children under 13 anywhere in the world, or from children under 16 in the European Economic Area or the United Kingdom unless verifiable parental or guardian consent has been obtained where required by applicable law. If you believe that a child has submitted personal data through our service, please contact us using the contact form and we will take steps to delete that information as soon as practicable.

Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Last updated” date.

Contact

TarotNL is the data controller for information processed through this website unless otherwise stated.

Controller name: TarotNL

Controller postal address: P.O.B 39159, Jerusalem, Israel

Privacy email: ajabugroup@gmail.com

Website contact: contact form

For privacy questions, data-subject rights requests, or complaints, contact us using the privacy email address or the contact form. We aim to respond to privacy enquiries within 5 business days where practicable, and to formal data-subject rights requests within 30 days where required by law.