Privacy Policy

AITarotReading.ai ("we") operates this Service. We can be reached at hello@aitarotreading.ai.

When you use the Service we collect:

• Account info: the email address you sign up with, and a password hash if you set one.
• Your readings: the questions you submit, the cards drawn, the AI-generated interpretations, your ratings, redraws, and deep dives. These are stored only against your account.
• Live Interactive Reading (voice): if you start a live sitting, your microphone audio is streamed to our voice provider so the reading can be a conversation, and a written transcript of what you and the guide say is produced. Audio is not kept: the voice provider is configured not to store recordings, and the transcript is deleted there after 30 days. On our side we keep only a record of the sitting — the question you asked, the cards drawn, when it happened, how long it lasted and how many coins it cost — until you delete your account. The transcript you download or have emailed to yourself is yours to keep; we do not store a copy of it.
• Billing info: handled entirely by Stripe. We store the Stripe customer ID and subscription status; we never see or store your card number.
• Technical logs: IP address, browser, and timestamps as part of standard server operation and abuse prevention.
• Cookies: a session cookie to keep you signed in, and an anonymous "trial used" cookie to enforce the one-free-reading limit.
• Personalization: optional answers you may give on the Personalize page (such as gender energy, age range, relationship status, zodiac, focus, and tone). These are kept only on your device (in your browser) and are sent with a reading request to the AI to tailor its tone. We never store them on our servers or against your account, and you can clear them at any time from the Personalize page.

We use the data above to:

• Provide the Service (generate readings, save them)
• Send transactional emails (sign-in links, reading copies)
• Process subscription payments
• Enforce limits and detect abuse
• Improve the prompts and the product

We do not sell your data, run advertising, or use your readings for marketing.

We never ask you for sensitive information, and we ask you not to share it. A reading works perfectly well from “a decision at work” or “where a relationship is heading” — it does not need diagnoses, medication, sexual history, religious or political convictions, or anything similar.

If you do choose to include such details in a written question or say them aloud during a live sitting, you are asking us to process them for the single purpose of producing that reading, and we treat that as your explicit consent for that purpose only. We do not use it to build a profile of you, we do not use it for marketing, and it is deleted along with the rest of your data when you delete your account.

One clarification about voice, since people reasonably wonder: your recordings are not used to identify you, and are not retained at all. We do not create voiceprints or any other biometric identifier.

We rely on the following providers to operate the Service:

• Supabase — database hosting and authentication.
• Vercel — application hosting and edge delivery.
• Stripe — subscription billing.
• Anthropic and OpenAI — large language model APIs used to generate readings. The question you submit, the cards drawn, and any personalization you have set on your device are sent to these providers per their privacy terms (they do not use API data to train their models).
• ElevenLabs — voice. Two separate uses. First, text-to-speech: when you choose to play a reading aloud, the reading text is sent to generate the audio. Second, the Live Interactive Reading: your microphone audio is streamed to ElevenLabs for the duration of the sitting, where it is transcribed and answered in real time. Your first name, your question and the cards drawn are sent so the guide can speak to them; your email address is never sent. The conversation itself is driven by an Anthropic (Claude) model running behind ElevenLabs, so what is said in a sitting reaches Anthropic as part of generating the guide's replies. ElevenLabs is configured not to retain recordings of your voice, and to delete sitting transcripts after 30 days.
• Resend — transactional email delivery.
• PostHog and Google Analytics — product/website analytics (page views and feature events, e.g. that a reading was started). These load only if you accept cookies in the banner, and we do not send them your readings or your personalization.

Some of this data leaves the EU. Analytics and error monitoring (PostHog, Sentry) run on their EU infrastructure. Hosting, database, payments, email, the language models and the voice provider — Vercel, Supabase, Stripe, Resend, Anthropic, OpenAI and ElevenLabs — are US companies and your data reaches the US through them. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses.

We keep your account data and readings until you delete your account. After deletion, account data and readings are removed from our database within 30 days. Billing records may be retained longer where required by tax law.

Live sittings are handled more tightly. Recordings of your voice are not retained at all, and the written transcript held by our voice provider is deleted after 30 days. When you delete your account we also ask that provider to delete the transcripts of your sittings immediately, rather than waiting for the 30 days to run out. The record we keep of a sitting — question, cards, date, duration and coins spent — is deleted with the rest of your account data.

Depending on where you live you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your readings (we'll send a JSON export on request)
• Object to processing or restrict it
• Lodge a complaint with your data protection authority

You can delete your entire account and all associated data yourself at any time from Account settings (this also cancels any active subscription) — no request needed.

Your personalization answers live only on your device — you can delete them instantly yourself with "Clear all" on the Personalize page (no request needed).

To exercise any of these rights, email hello@aitarotreading.ai.

The Service is not directed at and not intended for users under 18. We do not knowingly collect data from minors.

We protect your data with standard industry practices — encrypted connections, hashed passwords, row-level security in the database — but no system is perfectly secure. Use a strong password and do not share it.

We may update this page. Material changes will be announced by email and on this page.