Privacy Policy

DRAFT, to be reviewed by a lawyer before launch. Placeholders in [brackets].

Last updated: [date]

Who we are: Tarot from me is a free, non-commercial project run by [Name], a private individual in [city], Croatia. [Name] is the controller of your personal data. Contact: [privacy@domain].

This policy covers the site as it is now: the waitlist, artist sign-up and founding deck uploads. We will update it before we add new features.

In short

• Tarot from me is free. We never ask for payment details.
• We collect only what we need to run the waitlist and review your deck.
• No advertising, no tracking cookies. We count page visits with cookieless, aggregated statistics.
• We don't sell your data or share it with advertisers.
• Our database is in the EU (Frankfurt).
• Every deck is reviewed by a person. No decision about you is made automatically.

What we collect and why

If you join the reader waitlist

• Data: your email, first name, the optional words you write about decks you love, and when you signed up.
• Why: to email you when Tarot from me opens, and to get a feel for what readers want to see.
• Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it anytime.
• Kept: until 30 days after the launch email, or until you ask us to delete it.

If you sign up as an artist

• Data: your email, first and last name, optional artist or studio name, Instagram and/or TikTok, shop link (or that you don't have one yet), your 16+ confirmation, the version of the Content policy you accepted, and when you confirmed your email.
• Why: to create your account, hold your founding spot and contact you about it. Your first and last name are never shown publicly.
• Legal basis: our contract with you (art. 6(1)(b)).
• Kept: while your account exists, and 30 days after you delete it.

If you add a founding deck

• Data: the deck's title, subtitle, description, type, release year and edition, its tags, availability, shop and Kickstarter links, 5 to 20 photos with any descriptions you write, card and back images if you choose to upload them, your confirmation that the art is made by people and not generated by AI, and your agreement to the Instagram feature.
• Why: to review your deck, publish it when approved and feature it on our Instagram as part of the founding offer.
• Legal basis: our contract with you (art. 6(1)(b)).
• Kept: while your account exists, and 30 days after you delete it. Instagram posts stay up until you ask us to remove them.
• Images: your original files stay private and are only seen by us during review. The copies we make for the site have their metadata (such as camera or location data) removed.

If you ask for a reminder

• Data: the date you chose.
• Why: to send you the "remind me later" email.
• Kept: until the reminder is sent or you send your deck for review.

If an account is removed for AI-generated art

• Data: a one-way code (keyed hash) made from the email, handle and social or shop links of that account. The original details cannot be read from it.
• Why: to stop the same person from signing up again.
• Legal basis: our legitimate interest in keeping the gallery free of AI-generated art (art. 6(1)(f)).
• Kept: permanently.

Technical logs

Our hosting and database providers keep short-lived server logs (such as IP address, browser and time of request) to keep the site running and secure. Legal basis: legitimate interest (art. 6(1)(f)). These are deleted automatically within [30] days.

Page statistics

We use Vercel Web Analytics to see which pages are visited, from which kind of device and country, and which site sent the visitor. It sets no cookies and builds no profile of you. Visits are grouped using a code made from the request that resets every day, so we can't recognise you from one day to the next. We only see totals. Legal basis: legitimate interest in understanding which pages work (art. 6(1)(f)).

Cookies

We only use cookies that are strictly necessary: the login cookie for artists. That's why there is no cookie banner. If you follow a buy link to an artist's shop, that shop may set its own cookies under its own policy.

Who helps us

These companies process data on our behalf, under data processing agreements:

• Supabase (database and login), EU region, Frankfurt
• Cloudflare (image storage and delivery), EU storage
• Vercel (website hosting and page statistics)
• Resend (sending emails)

Some of these companies are based in the US. Where data may leave the EU, it is protected by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

When we post your deck on Instagram, Meta handles that post under its own privacy policy.

Your rights

You can ask us to see, correct, delete or export your data, to limit or object to how we use it, and to withdraw consent. Write to [privacy@domain] from the email you signed up with. We reply within one month.

If you're unhappy with how we handle your data, you can complain to the Croatian data protection authority, AZOP (azop.hr), or to the authority in your country.

Age

Tarot from me is for people aged 16 and over.

Changes

If we change this policy, we'll post the new version here and email artists about important changes.