Privacy Policy

Last updated: 2026-08-25

Who we are

TarotSpectrum is operated by VFP Services, reachable online at tarotspectrum.com. We are the data controller for the personal data described below.

What we collect

• Your name and email address, to deliver your reading and receipt.
• The question(s) you submit for your reading — this may include sensitive personal details you choose to share; only share what you are comfortable with.
• Payment information: we do not store card numbers. Payments are processed by PayPal, which has its own privacy policy.
• Basic technical data (IP address, browser) for security and fraud prevention.
• Pseudonymous usage data for product experiments (assigned layout, modal exposure, first input, checkout opening, and confirmed purchase). We use random session IDs only: never your name, email, question text, card details, or a device fingerprint.
• If you create an optional account to read your consultations privately: your password (stored as a one-way hash, never in plain text). If you choose to enable optional two-factor authentication, we also store either an authenticator app secret or, briefly, a hashed one-time code sent to your email — depending on which method is active at the time. Creating an account, and enabling two-factor authentication, are never required to order a reading.

Why we use it

To deliver the reading you purchased and communicate with you about your order. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

We use the pseudonymous experiment data to improve whether the order form is understandable and effective. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

Who we share it with

• PayPal, to process payment.
• Our transactional email provider, to send your reading and receipts.

How long we keep it

We keep your name, email address, and question text for 2 years after your order, then delete them. We may keep minimal transaction records (consultation tier, date, amount) for longer where required for accounting and tax purposes — those records no longer include your name, email, or question text.

Product-experiment logs are kept for up to 90 days, then deleted or retained only as anonymous aggregate statistics.

Your rights

Under GDPR you have the right to access, correct, delete, or export your personal data, and to object to or restrict some of our processing. To exercise these rights, contact us at privacy@tarotspectrum.com.

Cookies

TarotSpectrum does not use advertising cookies. We use privacy-oriented analytics and local browser storage to assign a stable A/B-test variant; a random session identifier is kept in session storage. These identifiers do not contain contact or consultation data.

Children

TarotSpectrum is not directed at, and should not be used by, anyone under 16.