Privacy Policy

• Contact data — your email address, used to deliver your Order and communicate with you about it.
• Recipient and personalization data — the name, age group, interests, personality traits, and other quiz answers you provide to personalize the Deck.
• Photographs — the two to three facial photographs you upload so we can illustrate the Recipient's likeness into the cards.
• Transaction data — records of what you purchased, when, and the payment status. Payment card numbers are processed solely by Stripe and are never received or stored by us.
• Consent records — where you confirm that you hold the necessary permission to use the uploaded photographs, we log that confirmation as an audit trail.

We process the personal data described above to create and deliver your personalized Deck, to communicate with you about your Order, to process payments, to maintain records for accounting and support, and to comply with our legal obligations.

We do not sell your personal data, we do not operate advertising trackers, and we do not use your photographs to train artificial-intelligence models.

Where applicable law requires a legal basis for processing, we rely on the following: performance of our contract with you (to fulfil and deliver your Order); your consent (for the use of photographs of another person, which you confirm you are authorized to provide, and for any optional marketing communications); our legitimate interests (to operate, secure, and improve the Service and prevent fraud); and compliance with our legal obligations.

We rely on a limited set of service providers to operate the Service. Each receives only the personal data necessary to perform its function and is required to protect it:

• Stripe — Payment processing. Payment card details are provided directly to Stripe and are never received or stored on our systems.
• Supabase — Database and file storage. Quiz answers, order details, and uploaded photographs are stored here.
• Google (Gemini) — AI image generation. Photographs and quiz answers are transmitted to Google's Gemini API to illustrate the cards.
• Anthropic (Claude) — AI text generation. Quiz answers are used to draft card descriptions and personalize scenes.
• Resend — Transactional email delivery. Used to send order confirmations and your finished Deck.
• Vercel — Website and application hosting.

We may also disclose personal data where required to comply with a legal obligation, to enforce our Terms, or to protect the rights, property, or safety of our users or others.

Some of the service providers listed above process data in countries outside your own, including the United States. Where personal data is transferred internationally, we take steps intended to ensure it continues to receive an appropriate level of protection consistent with applicable data-protection law.

Uploaded photographs are deleted within 90 days of delivering your Deck. If you would like them removed sooner, email us and we will delete them promptly.

Order records and quiz answers are retained for as long as necessary for accounting, support, and legal-compliance purposes, after which they are deleted or anonymized. You may request earlier deletion as described below.

We may retain certain data, including User Content, beyond these periods and notwithstanding a deletion request where necessary to comply with a legal obligation, cooperate with law enforcement or a competent authority, prevent fraud or abuse, or establish, exercise, or defend legal claims.

Because Gift Tarot Decks are typically gifts, the photographs you upload usually depict someone other than you. Before uploading, you confirm that the person is an adult and that you have their permission — or a personal relationship that gives you good reason to believe they would welcome the gift.

If a Deck has been made of you and you would like your photographs and associated data removed, email us at hello@gifttarot.com and we will delete them.

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

The Service is not directed to individuals under 18, and every person depicted in uploaded photographs must be an adult. We do not knowingly collect personal data relating to children. If you believe a child's data has been provided to us, contact us and we will delete it.

We have zero tolerance for child sexual abuse material and for any sexualized or exploitative depiction of a minor. Where we become aware of such material, we will preserve the relevant data and report it to law enforcement and the relevant child-protection authorities (including, where applicable, the National Center for Missing & Exploited Children (NCMEC) or the equivalent authority), and cooperate with any investigation, as further described in our Terms of Service.

Subject to applicable law, you may exercise the following rights by emailing hello@gifttarot.com:

• access a copy of the personal data we hold about you;
• request correction of inaccurate data;
• request immediate deletion of your photographs;
• request deletion of your entire Order and associated data;
• withdraw any consent you have given;
• ask any question about how your data is handled.

We respond to every request, typically within a few days. You may also have the right to lodge a complaint with the data-protection authority in your jurisdiction.

We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date above. Material changes will be communicated where required by applicable law.

The data controller responsible for your personal data is Beyond Patterns FZCO, a company registered in the Dubai World Trade Centre free zone, Dubai, United Arab Emirates.

Email: hello@gifttarot.com