Privacy Policy

1. Data Controller

The controller of your personal data is aimag.me. For data protection inquiries, contact: privacy@aimag.me.

2. What Data We Collect

As part of providing the service, we collect the following data:

• Email address — required for account creation and login (magic link).
• Tarot readings — questions, drawn cards, and generated interpretations, stored on the user account.
• Usage data — number of readings per day, last login date, language preferences.
• Preferences — chosen language (PL/EN), display settings.
• Payment data — processed exclusively by Stripe. We do not store card numbers or payment data on our servers.

3. Purpose and Legal Basis for Processing

We process your data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR) — given during account registration, specifically for processing data to provide the service.
• Performance of a contract (Art. 6(1)(b) GDPR) — necessary to provide the tarot reading service and maintain your account.
• Legitimate interest of the controller (Art. 6(1)(f) GDPR) — usage analytics to improve the service, abuse prevention.

4. Data Retention Period

• Anonymous readings (without an account) — automatically deleted after 30 days.
• Account data — stored until the account is deleted by the user. After deletion, data is removed within 30 days.
• Billing data — stored in accordance with tax law requirements (5 years from the end of the year in which the transaction was made).

5. Your Rights

Under GDPR, you have the following rights:

• Right of access — you can ask what data we process about you.
• Right to rectification — you can request correction of inaccurate data.
• Right to erasure ("right to be forgotten") — you can request deletion of your data.
• Right to data portability — you can download your data in JSON format.
• Right to restriction of processing — you can request restriction of processing in certain situations.
• Right to lodge a complaint — you can file a complaint with a supervisory authority (in Poland: Prezes UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl; or your local Data Protection Authority).

6. Cookies

We only use essential cookies: a session cookie (PHPSESSID) to maintain your login session and a language preference cookie. We do not use advertising, tracking, or cookie-based analytics cookies. Analytics (Plausible) operates without cookies.

7. Third Parties

Your data may be shared with the following third parties:

• Plausible Analytics — anonymous traffic analytics. Does not collect personal data, does not use cookies, GDPR compliant without user consent.
• NVIDIA API (NIM) — prompts (questions) are sent to the NVIDIA API to generate interpretations. NVIDIA processes data according to its own privacy policy.
• Stripe — processes payments. Payment data is sent directly to Stripe and is not stored on our servers.

8. Contact

For data protection inquiries, you can contact us at: privacy@aimag.me. We respond to inquiries within 30 days.