LEGAL
Privacy Policy
1. Controller and contact
Project Arcana is operated from Spain. The public controller/operator and contact information is published on the Legal Notice. Privacy requests can be submitted through Support / Contact.
2. Data we process
- Account and identity data: supported identity-provider identifier, verified email where supplied, display name or nickname, linked-provider state, locale and account identifiers.
- Authentication and security data: session identifiers, policy acceptance, login/linking events, security and abuse-prevention signals.
- Tarot and product data: saved readings, spread/card selections, reading metadata, user-entered notes and preferences when you choose to save them.
- Billing data: internal product/entitlement identifiers, subscription state, transaction/refund status, amount/currency, provider and provider transaction references. Raw card PAN/CVV is handled by the payment provider and is not stored by Arcana.
- Support data: feedback, support messages, category, diagnostic context and account linkage when you submit while signed in.
- Technical data: request/security telemetry, application version, error/correlation identifiers, rate-limit/abuse signals and other data needed to operate and secure the service.
3. Why we process data and our legal bases
- Accounts, authentication and saved features: to create and operate your account, authenticate you, link supported identity providers, save readings and preferences, and provide requested account features. We rely primarily on performance of our contract with you or steps you request before entering that contract.
- Paid access and billing: to present and fulfil purchases, activate entitlements, reconcile payment/provider events, manage subscriptions, refunds and disputes, and keep required transaction records. We rely on contract performance and, where applicable, legal obligations relating to accounting, tax, consumer protection and record keeping.
- Security, fraud and abuse prevention: to protect accounts and the service, enforce rate limits and eligibility rules, investigate misuse, prevent deletion/re-registration from improperly resetting protected free benefits, and preserve evidence needed for disputes or security incidents. We rely on our legitimate interests in operating a secure and fair service and, where applicable, legal obligations. We minimise the data used for these purposes and apply finite retention where the purpose does not justify indefinite storage.
- Support and privacy requests: to receive, investigate and respond to messages, rights requests and account/billing issues. We rely on contract performance, our legitimate interests in supporting users and resolving disputes, and legal obligations where a request concerns a statutory right.
- Service reliability and improvement: to diagnose errors, measure operational reliability and improve Arcana using bounded technical evidence. We rely on legitimate interests in maintaining and improving the service, subject to data minimisation and applicable rights.
- Consent-based processing: if Arcana later introduces processing for which consent is legally required, such as certain non-essential tracking, we will request consent before that processing and you may withdraw it as described in the relevant control.
Our legitimate interests include service security, fraud and abuse prevention, fair enforcement of free-benefit eligibility, support and dispute resolution, and reliable operation of Arcana. We do not rely on legitimate interests where your rights and freedoms override those interests.
4. Service providers and recipients
Depending on the feature you use, personal data may be shared with categories of recipients that provide cloud hosting and delivery, supported identity/authentication, hosted payment and Merchant-of-Record services, operational communications, and support tooling. We limit disclosure to data reasonably necessary for the relevant role. A hosted payment/Merchant-of-Record provider may independently process payment, billing-address, tax, fraud-prevention and order-support data under its own terms and privacy information. We may also disclose data when required by law or where necessary to establish, exercise or defend legal claims.
5. International transfers
Some service providers may process data outside Spain or the European Economic Area. Where a transfer requires a safeguard, the transfer must rely on an applicable legal mechanism such as an adequacy decision, approved standard contractual clauses or another mechanism permitted by data-protection law. Information about applicable safeguards can be requested through Support / Contact.
6. Retention and account deletion
We keep personal data only for as long as needed for the purpose for which it is processed. Account and saved-content data is ordinarily kept while the account remains active or until you delete it. Support, security and dispute records are kept only for the period reasonably needed to handle the relevant request, incident or claim. Transaction and accounting evidence may be retained for longer where required for tax, accounting, payment disputes, fraud prevention or legal claims.
Signed-in users can permanently delete their Arcana account from Account / Settings. Successful deletion revokes Arcana sessions, removes linked external identities and active account contact/profile data, and deletes saved readings, private notes and other private product data that does not need to be retained for a separate legal purpose.
Deletion does not blindly erase transaction or provider records that Arcana must retain for accounting, tax, chargeback, dispute or legal-claims purposes. Any retained account shell is inactive and minimised and cannot be used to sign in.
To prevent account deletion from being used to restart protected introductory or free-use allowances, Arcana may retain a purpose-limited anti-abuse record for a finite period. That record uses keyed pseudonymous blind indexes derived from a verified email or linked-provider identity together with only the minimum free-benefit usage/cooldown evidence needed to preserve still-active eligibility rules. The anti-abuse record does not retain your plaintext email, display name, saved readings or private notes for this purpose, and it is not kept indefinitely by default. If you later register again with a matching identity while the relevant restriction or cooldown is still active, Arcana may create a new account but will not treat deletion as resetting those protected free benefits.
7. Data you provide and your rights
Data needed to authenticate an account is required if you choose to create an account. Billing and transaction data required by the hosted payment flow is necessary if you choose to purchase paid access. Reading notes and similar optional content are not required to use features that do not depend on them. If required account or billing information is not provided, the corresponding account or purchase feature may not be available.
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent where processing relies on consent, and complain to a data-protection authority. In Spain, you may lodge a complaint with the Agencia Española de Protección de Datos (AEPD). These rights can be subject to legal exceptions. Submit requests through Support / Contact.
8. Cookies and local/session storage
Arcana uses strictly necessary browser/session storage and cookies for authentication, security, preferences and service operation. If Arcana later introduces non-essential analytics, advertising or similar tracking that legally requires consent, the privacy/cookie controls will be updated before that processing begins.
9. Age
Arcana is intended for adults aged 18 and over. We do not intend to offer age-gated account or paid services to children.
10. Security
We use technical and organisational safeguards designed to protect personal data, including access controls, server-owned authorisation, secure-session practices, minimal payment-data handling, audit/reconciliation controls and abuse protection. No system can guarantee absolute security.
11. Automated processing
Arcana may use automated rules for access control, quota enforcement, security, abuse prevention and payment-provider responses. Tarot and astrology-inspired outputs are entertainment content and are not used by Arcana to make legal or similarly significant decisions about you.
12. Changes
We may update this policy as the service, providers or legal requirements change. Material changes will be communicated when required by law. The current version and effective date will remain available on this page.
13. Contact
Submit privacy questions or rights requests through Support / Contact.