Privacy

The controller of your personal data is Antreprenor Independent „ALEXANDR OGLAȘEVICI”, IDNO 1026023000934, mun. Chișinău, Republic of Moldova, which owns and operates the website tarotalyze.com. Processing is carried out in accordance with Law No. 195/2024 of the Republic of Moldova on the protection of personal data. You can write to us at [email protected] about anything concerning this data, including to exercise the rights described in section 16; we reply within 30 days at the latest. This period is the one set by data-protection law and applies to every request about your data — enquiries about a purchase or a refund are answered faster, under the Terms of Service. This policy applies to tarotalyze.com in all three language versions and to every service offered through it.

Account: your email address, your password (kept only as an irreversible hash by the authentication system — we never see it), the eight-digit confirmation codes sent to your inbox, and whether you have enabled second-factor authentication. Profile: your nickname — it is required and is at the same time the address of your page; optionally an avatar and links to your pages on other services. Readings: the question you asked, the cards drawn, the spread, the language, the date and the text produced by the artificial intelligence. Credits and payments: your balance, the ledger of credits added and spent, and for each purchase the package, amount, currency, the payment identifier at the provider and its status. Consent given at the moment of purchase: the time you confirmed it — set by our server, not by your browser's clock — and the dates of the editions of the Terms of Service and of the Refund Policy that were shown to you then, so that it can later be established what exactly you read and accepted; your IP address and browser details are deliberately not stored with it. ★ Your bank card details never reach us: the number, expiry and security code are entered on the secure page of the payment provider or the bank — this is true of both payment methods, we do not see them, do not receive them and do not store them, which is also why we cannot charge your card a second time or lose those details. Your public content: comments, topics and the images attached to them, likes. The notifications we show you. Technical data: your IP address and browser information at the moment of the request, and the interface language you chose. If moderation measures have been applied to your account — a record of the action, its reason and its date. We do not collect and do not ask for special categories of data — health, religious beliefs, political opinions, origin or intimate life. Please note: the text of your question is stored in your reading history and is sent to the model, so do not put into it anything you would not entrust to anyone.

The free numerology calculators and the whole Su Jok section run entirely in your browser: your birth date does not travel to our server, does not appear in the page address, leaves no trace in any log and is not linked to your account. The „Family Karma” mandala and the family-cell karma calculation are the exception: the ancestral name and the birth date are sent to our server over an encrypted connection, because the calculation itself is performed there; they are used only to return the result to you and are not written to the database. In neither case do they end up in the page address — that is precisely why the form submits them in a request rather than in a link. Bank card details, as stated above, never reach us at all.

Law No. 195/2024 requires every processing operation to have a legal ground. Ours are four. Performance of the contract with you — the account, sign-in, credits, readings, publication of your comments and topics, accepting payments and issuing refunds: without this data the service cannot be provided. Legal obligation — keeping records of payments, retaining accounting and tax documents, and recording the consents you give at the moment of purchase: consumer law requires that it be possible to establish what exactly you agreed to. Legitimate interest — the security of the service, protection against password guessing, spam and artificial inflation of counters, rate limiting, pre-moderation of publications, counting unique views of a topic, and the general operation of the site, including anonymous measurement of how fast the pages load; we use the minimum of data for this and do not build a reader profile. Consent — advertising cookies: they are not placed until you press Accept, and consent can be withdrawn at any time (section 12). Withdrawal does not undo processing carried out on that basis before the withdrawal, and does not affect the other grounds.

We process data in order to: create your account and let you sign in; show you your balance and your reading history; perform the reading you ordered and keep it for you; accept payment, add credits and, where required, refund your money; record your consent to immediate performance together with the editions of the documents shown to you at that moment; publish your comments and topics and show them to other readers; check publications before they are shown publicly and take a moderation decision; send service emails — the confirmation code and password recovery (notifications are shown to you inside the site and are not emailed); protect the service against abuse; measure, without identifying anyone, how fast the pages load; comply with tax and accounting law; and show advertising on public pages if you have consented to it. We do not sell personal data, do not pass it on for anybody else's marketing, and do not use your questions or readings to train models.

To make the service work we use external providers. Each receives only what its role requires. Supabase — database, authentication and file storage (European Union): account, profile, readings, comments, topics, images. DigitalOcean — the application server (Germany, Frankfurt): it handles requests. Vercel — hosting and delivery of the website (European Union and United States). Vercel Speed Insights — anonymous measurement of page loading speed (European Union and United States): it receives the address of the page and technical loading figures; it sets no cookies, stores nothing in your browser and does not identify you. OpenRouter — routing the request to the AI model (United States and EU): it receives the question, the cards and the spread, but not your email address, not your nickname and not your balance. OpenRouter itself chooses which computing provider will run the request — no particular platform is fixed in the request — and Anthropic (United States), the creator of the model, is among them. Resend — sending service emails (European Union and United States): the recipient address and the message text. Lava.top — accepting international payments in RUB, USD and EUR, acting as Merchant of Record; located outside the Republic of Moldova. BC „Moldova Agroindbank” S.A. (maib) — card acquiring in Moldovan lei (Republic of Moldova); this payment method is being connected, and until it is switched on no data goes to it. Payment providers receive the amount, the currency, the order identifier and your email address for the receipt; they in turn handle the card details, which they never show us. The Yandex Advertising Network (Yandex LLC, Russian Federation) stands apart: it is a recipient, not a processor acting on our instructions — we send it nothing, the data is passed to it directly by your browser once you have consented to advertising cookies (section 12). If a new payment method appears — cryptocurrency, for instance — its provider will be added to this list; no other section of this policy changes because of that. Data is disclosed to public authorities only upon a lawful request and only to the extent of that request.

Some of the providers listed above are located outside the Republic of Moldova, so your data crosses the border. Law No. 195/2024 permits such a transfer in three situations, and we rely on two of them. The first is appropriate safeguards: our contracts with providers include standard contractual data-protection clauses obliging them to maintain a level of protection comparable to the Moldovan and European one. The second is the derogation for the performance of the contract with you: to return your reading, the question has to reach the model, and to take your payment, the order has to reach the payment provider; without the transfer the service cannot be delivered. The third situation — a decision of the National Centre for Personal Data Protection on the adequacy of the level of protection in the recipient state — applies where such a decision exists for that state. A copy of the terms a particular provider operates under can be requested from us by email.

Account, profile and balance — for as long as your account exists. Readings — for as long as your account exists; a reading you delete stops being shown immediately and does not come back, but the row itself stays in the database in a hidden state, because the credit spent on it is attached to it and because the limit on free readings is counted from it; it is erased together with the account. Records of payments and of credit movements, including the record of the consents you gave when buying — 4 years, in line with the limitation period for a tax obligation (art. 264 of the Tax Code; in the cases provided by law it extends to 6 years). Comments and topics — until you delete them; where a deleted comment stood, only the mark that it existed remains, with no text, no author and no avatar, so that replies to it are not left hanging. Former nicknames are kept indefinitely: the old address of your page must go on leading to the new one, otherwise the links you have already sent to somebody would break. Unique-view fingerprints for topics — 48 hours, then deleted; the daily key used to compute them is destroyed after two days, so recomputing them afterwards is impossible even for us. Your IP address and browser details are used at the moment of the request and are not written to our database; in the technical logs of our hosting providers they live for a limited time under those providers' own rules. Notifications — for as long as your account exists. Correspondence with support — we delete it at your request and in any case do not keep it longer than is needed to handle the enquiry and any dispute arising from it. While the service is temporarily suspended (clause 17 of the Terms of Service), we additionally keep an encrypted backup copy of the database and of the uploaded images on our own storage medium, separately from the hosting providers. It is used for nothing except restoring the service and is kept no longer than that requires; a request to delete your data is applied to this copy as well — or recorded and applied before any restore.

You can delete a topic or a comment yourself with the button on the page; a single reading is removed from your history in the same way — it stops being shown at once, although, as explained in section 8, its row stays hidden in the database until the account itself is deleted. There is not yet a „delete account” button on the site: write to [email protected] from the address the account is registered to, and we will delete it together with the content linked to it within 30 days. What remains afterwards, and why: payment records — because of the tax retention period, and they contain neither your questions nor your readings, only the amount, currency, date, the transaction identifier and the note of which editions of the documents you accepted when buying; the released nickname — in the list of former nicknames, so that nobody can take it and pass themselves off as you; and, where deleted comments stood, marks with no text and no author. Everything else is deleted. If you simply stop using the service, nothing is deleted by itself: deletion starts with your request.

Your nickname, avatar, profile links, comments and topics are visible to everyone — this is the public part of the site, and search engines read it too. The nickname is at the same time the address of your page: it appears in a link of the form tarotalyze.com/u/your-nickname. So do not use your full name as a nickname, and do not write in comments or topics anything you would not want found under your name. A topic you write becomes publicly visible only after review, and enters a search index only if it is approved and substantial enough; but once approved, a topic is public, and removing it from search results does not depend on us alone. Your private pages — account, history, readings, payment — are closed to search engines and visible only to you.

The text of a reading is produced by a language model. We have no human readers or consultants, and a reading is not a diagnosis and not financial or legal advice. The model receives only what is needed for the answer: your question, the cards drawn, the spread and the language; your email address, nickname, balance and other readings are not sent to it. The request travels through OpenRouter to the computing provider OpenRouter itself selects — no particular platform is fixed in the request — and Anthropic (United States), the creator of the model, is among those providers. What the provider does with the text it receives is governed by its terms, not ours: we have not enabled zero-retention mode, so the text of your question may be stored on its side for a time. We say this plainly because it concerns you: if your question contains something you would not entrust to anyone, phrase it differently. We take no automated decisions producing legal effects for you: neither the price, nor access, nor a block is set by an algorithm — a moderation decision is taken by a person.

Advertising from the Yandex Advertising Network is shown only on the public pages people come to read: the card pages (/tarot/cards), the spread-diagram pages (/tarot/spreads), the Tarot articles, the numerology interpretation and reference pages, the Su Jok pages and the topics written by users. It loads ONLY after you have pressed Accept in the consent banner: until then the advertising script is not requested at all and no advertising cookie is set. We never pass the network your email address, your nickname, your balance, your questions or your readings — it receives only what your browser sends it directly when the advertisement loads. There is no advertising on your account pages, on the page of your own reading (/tarot/reading), in your reading history or on the payment page, nor in the reading builder and the topic form, and its cookies are not set there. Consent can be withdrawn by clearing this site's data in your browser — the banner will appear again and you will be able to answer Decline. We run no tracking or profiling systems and we set no cookies for analytics; the only measurement in place is anonymous page-speed telemetry (Vercel Speed Insights, section 6), which does not identify you and writes nothing into your browser.

Strictly necessary — the few entries without which the service does not work. There are four of them. The NEXT_LOCALE cookie: the interface language you chose. The session token which the authentication system keeps in your browser's local storage under a name of the form sb-…-auth-token: it is what keeps you signed in. The cookie_consent entry in local storage: your saved answer to the consent banner, so that it is not asked again. The topic-view:{topic address} entry in this tab's storage: the mark that this tab has already counted a view of that topic; it disappears when the tab is closed. They are always active, because without them you cannot sign in, the language cannot be kept, and the fact that you have already answered the advertising question cannot be remembered. Advertising: set by the Yandex Advertising Network and only after your consent — section 12. We set no cookies for analytics: the anonymous measurement of page speed works without them and writes nothing into your browser. Cookies can be managed in your browser settings; disabling the strictly necessary ones means you will not be able to stay signed in. The details are in our separate Cookie Policy.

All communication with the site and with our server goes over HTTPS. Your password is kept only as an irreversible hash — we do not see it and cannot recover it, which is why password recovery works through a code sent to your email. Access to your rows in the database is restricted at the database level (row-level security): even a wrong request from the browser will not show somebody else's data, because the database decides that, not the page code. Write operations require your token; if you have enabled the second factor, the server demands confirmation of it rather than trusting a tick in the settings. Images are stored under random names that cannot be derived from your identifier. Texts written by people are stored and displayed as plain text — HTML does not exist at any layer, so a foreign script cannot reach a page through a comment or a topic. Administrative actions are written to a separate log. No system is absolutely secure; if a security breach occurs that could affect your rights, we will inform you and notify the National Centre for Personal Data Protection within the time limits set by law. Backup copies are encrypted.

The service is intended for adults. By creating an account you confirm that you are at least 18 years old. We do not knowingly collect children's data; if it turns out that an account was created by someone under 18, we will delete it together with the associated data. If you are a parent or guardian and believe that a child has left us their data, write to [email protected].

Under Law No. 195/2024 you have the right: to access your data and learn how it is processed; to have inaccurate data corrected; to have it erased; to restrict processing; to receive it in a portable format; to object to processing based on our legitimate interest; and to withdraw consent where processing rests on consent. To exercise any of these rights, write to [email protected] from the address of your account — that is how we make sure the request comes from you and not from someone acting in your name. We reply within 30 days at the latest; if the request is complex, we will tell you about the extension and explain why. Exercising your rights is free of charge. If our answer does not satisfy you, you may turn to the supervisory authority — the National Centre for Personal Data Protection (Centrul Naţional pentru Protecţia Datelor cu Caracter Personal, CNPDCP): MD-2004, mun. Chișinău, str. Serghei Lazo 48, telephone +373 22 820 801, email [email protected], datepersonale.md — or to a court. Please note: consumer-rights matters are handled by a different authority, named in the Terms of Service and the Refund Policy.

We may update this policy. The version in force is always published on this page, and the date of the last update is shown at the top. We will tell you about material changes — a new provider, a new purpose of processing, a new retention period — by a visible notice on the site, before the change takes effect. We do not send newsletters: the only emails we send are the confirmation code and password recovery, so the notice on the site is the way you learn about a change. By continuing to use the service after that you accept the updated version; if it does not suit you, you can ask us to delete your account (section 9).

The Romanian version is the authoritative one. The Russian and English translations are provided for convenience; in case of discrepancy the Romanian text prevails. Controller: Antreprenor Independent „ALEXANDR OGLAȘEVICI”, IDNO 1026023000934, Republic of Moldova. Email for any question and for requests concerning personal data: [email protected]. We have not appointed a data protection officer — the law does not require it of us — so requests are handled by the controller.