Arcanauta Privacy Policy

Information We Collect

• Account and contact data: email address, authentication identifiers, user ID and, if you contact us, the content of your messages.
• Reading and interaction data: questions, intentions, selected decks or spreads, mood archetypes, chosen cards, saved readings, journal entries and usage metadata related to the experience.
• Payment data: handled by MercadoPago or PayPal, depending on your country. We receive customer identifiers, access status, confirmation tokens and limited billing details, but never full card numbers.
• Reading and AI data: when you receive a reading, we process your question and selected cards through AI models to generate a personalized interpretation.
• Technical and analytics data: approximate IP address, device type, browser, operating system, viewed pages, interaction events and cookies or similar technologies used for security, operation and analytics.
• Local browser data: we use localStorage and similar storage for daily-card limits, pending sessions, preferences and functional product signals.
• Gift reading data: if you receive a gift reading, we collect your email, optional name, selected deck, preferred language and campaign attribution data. We never store raw IP addresses or user agents without hashing.
• Testimonial and publication consent: if you choose to leave a testimonial, we store the text, your display name (if provided) and the consent date. We only publish testimonials with your explicit, revocable permission.

How We Use Information

• To authenticate users and protect accounts.
• To provide tarot readings and save your history.
• To process one-time payments, subscriptions, renewals, cancellations, fraud prevention and billing.
• To provide customer support and respond to legal requests.
• To improve deck quality, guiding questions and the experience.
• To measure product performance, prevent abuse and enforce our Terms.
• To send access emails for gift readings and nurture emails if you have given marketing consent.
• To publish testimonials only with your explicit, revocable consent.

Legal Bases

We process your data under the following legal bases, depending on the applicable jurisdiction:

• Chile (primary law): Arcanauta operates from Chile. Data processing is governed by Personal Data Protection Law 21,719 (effective from 1 December 2026, modernizing and replacing former Law No. 19,628) and, where applicable, Consumer Law No. 19,496. The bases are performance of the contract, informed consent for specific purposes, and legitimate interest for operational improvements and security.
• Other Latin American countries: if you reside elsewhere in Latin America, we respect rights under applicable frameworks, including Brazil’s LGPD, Argentina’s Law 25,326, Colombia’s Law 1581 of 2012, Mexico’s LFPDPPP and equivalent laws in your country.
• EU/UK: we rely on (i) performance of the contract to provide readings and manage purchases, (ii) legitimate interest to protect platform integrity and analyze use, and (iii) consent for optional communications, marketing, and non-essential cookies or analytics.

Providers and Transfers

We share data with service providers only where necessary to operate the Services. This may include Supabase (authentication and database), MercadoPago and PayPal (payment processors), PostHog (product analytics), and AI model providers when required by a feature. Data may be processed in the United States or other countries where these providers operate. Where appropriate, we use contractual commitments and reasonable safeguards for these transfers.

Cookies, Analytics and Similar Technologies

We use cookies, SDKs, local storage and similar technologies to maintain sessions, remember preferences, apply functional limits, measure usage and improve the product. Where your jurisdiction requires consent for non-essential technologies, we will request it or offer management options when applicable.

Retention and Security

We retain personal data according to defined criteria by category:

• Active account: profile data, reading history and preferences are kept while your account remains active. If you delete your account, data is deleted within 30 days, unless a legal obligation requires longer retention.
• Readings: reading content is retained while the account is active. Usage metadata (without question content) may be retained for up to 24 months for analytics and product improvement.
• Payment and billing data: retained for the period required by Chilean tax law (at least six years under the Tax Code).
• Support and security records: up to 12 months after the inquiry or incident is resolved.
• Unclaimed gift readings: unclaimed snapshots are deleted after 30 days. Claimed readings are kept while the account is active.
• Lead and marketing data: emails and marketing preferences are kept until you unsubscribe. On deletion requests, data is irreversibly anonymized. Published testimonials are removed within 30 days of a revocation request.

We implement reasonable technical and organizational measures to protect your data, although no system is completely infallible.

Your Rights

Depending on your location, you may exercise the following rights over your personal data:

• Access: request a comprehensible copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed for its original purpose, you have withdrawn consent, or processing is unlawful.
• Objection: object to processing for specific purposes, including profiling.
• Portability: receive your data in a structured, commonly used, machine-readable JSON format and transmit it to another controller.
• Restriction: temporarily suspend processing while a request for rectification, objection or erasure is resolved.

Sensitive Information and Content You Provide

Questions, notes and reflections you share with Arcanauta may reveal sensitive information about mental health, relationships, finances, spirituality or other intimate matters. We treat this data with enhanced protection: restricted access, encryption in transit and at rest, and exclusion from any use for model training or marketing communications.

If the system detects content suggesting a crisis or risk situation, the reading is interrupted and a message with help resources is displayed. This check is automated, is not reviewed by people, and does not store or label your account as a result.

We recommend that you do not include data you do not wish to store or that is unnecessary for your experience. Do not use the Services to disclose third-party information without a legal basis or sufficient permission.

Children

The Services are not directed to people under 18, and we do not knowingly collect their personal data. If you believe we have collected a minor’s data, contact us and we will delete it immediately.

Your Rights: requests and complaints

To exercise any of these rights, write to [email protected] with enough detail for us to verify your identity. We will respond within a maximum of 30 calendar days, extendable once for a further 30 days where circumstances justify it (we will notify you within the initial period). Rectification, erasure and objection are always free. Access is free at least once per quarter.

If you believe we have not adequately handled your request, you may complain to Chile’s Personal Data Protection Agency, the supervisory authority created by Law 21,719.

Updates and Contact

We may update this Privacy Policy to reflect operational or legal changes. Important updates will be posted on this page with a new “Last updated” date. For questions, contact [email protected].

Related documents: Terms of Service and Legal & Credits.