Privacy Policy

1. Controller and contact

Astra Arcana’s service operator controls the personal information handled by the site. Privacy requests can be sent to info@astraarcana.ru.

2. Information we collect

• email address and public order number;
• name, question, optional context and birth information supplied for personalization;
• selected Tarot cards, generated text, PDF and private result link;
• technical security data such as a pseudonymous device identifier, IP-derived anti-spam signal, timestamps and event logs;
• Telegram user ID only when an order originates from a verified Telegram session.

3. Why we use it

We use the data to validate the order, process payment, generate and deliver the requested result, prevent fraud and spam, provide support, investigate technical failures and comply with legal obligations.

4. Payments and processors

When Paddle Sandbox, or a Paddle live checkout approved in writing, is used for an English USD order, Paddle receives only the product, price, currency, email, order identifier and technical details required to process the transaction and prevent fraud. The customer’s question, birth details and full report are not sent to Paddle. Card data is entered directly into Paddle’s secure checkout and is not stored by Astra Arcana.

5. Security and retention

Order intake, contact details and reports are encrypted at rest. Private links use cryptographically random tokens, while the database stores a non-reversible token hash. HTTPS, rate limits and restricted server access protect the service.

Unpaid orders are retained for up to 30 days, encrypted reports and private links for 12 months, paid-order email and technical history for up to three years, and unfinished Telegram drafts for up to 48 hours unless a longer period is legally required.

6. International processing

Payment, email and AI infrastructure may process limited data in other countries under the provider’s contractual and legal safeguards. Only the data needed for each function is shared.

7. Cookies and local storage

Technical storage is used to remember the daily spread, language preference, device-bound order state and payment recovery. It is not sold for advertising profiles.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction or a copy of your data and may withdraw consent where consent is the legal basis. Include your order email or public order number, but never send card details.

9. Changes

The current version remains available at astraarcana.ru/en/privacy. Material changes will be shown with a new effective date.