Privacy Policy

1. Data controller

2. What personal data we collect

Account data

• email address, first name (if you give it), password (stored only as a secure hash by our authentication provider) or Google sign-in identifier
• your language (English or Spanish), membership status and settings, such as daily letter preferences
• messages you send to support

Reading data

• your questions and chat messages, the guide and reading type you choose, and the guide's answers
• your birth date and, if you give them, birth time and birth place, and the chart and numerology numbers we calculate from them
• names, birth dates and details about other people that you choose to write in your questions
• photos you upload for vision readings, such as a photo of your palm
• tarot cards drawn, rituals you create (including the name of the person a ritual is for), saved insights and reading history
• guide memory: short private notes the system keeps from your readings (for example the person you asked about, the guide's read, what you shared and what happened since), so a guide can remember you next time
• check-ins you schedule and your answer to them (for example "it happened" or "not yet")

Payment and order data

• membership plan, billing period, payment status, amounts, and Stripe customer and subscription identifiers
• for shop orders: name, shipping address, phone number, email, items ordered, amounts, and shipping and tracking information

Card details are entered directly with Stripe. We never see or store your full card number.

Email data

• which emails we sent you, whether they were delivered, unsubscribes and bounces
• if you send a ritual to someone, that person's email address and name, used only to deliver that email

Technical, usage and advertising data

• IP address, browser, device and operating system, pages visited, referring page and ad campaign parameters (such as UTM tags), timestamps
• events in the app, such as starting a reading, viewing the membership offer or starting checkout
• advertising identifiers set by Meta (the _fbp and _fbc cookies) and Google Analytics identifiers
• security logs, error logs and usage counters used for rate limiting

3. How we use your data

• to create and run your account and sign you in;
• to generate readings, chat replies, check-ins and daily letters, including sending your question and context to our AI providers;
• to let guides remember your earlier readings and keep their answers consistent;
• to apply free limits, memberships, introductory offers and promotion codes, and invitation rewards (if you join through a friend's link we record that they invited you; they see only how many people joined, never who);
• to take payments and to fulfil, ship and support shop orders;
• to send emails you request or need (sign-in, receipts, order and shipping updates, check-ins, daily letters), up to three reminders if you start a membership checkout and do not finish it (stopped as soon as you join, and every one with an unsubscribe link) and, where allowed, news and offers about Velvet Astral;
• to measure how the site and our ads perform, and to show our ads to people likely to be interested; for this we save with each reading the address of the first page you visited on this device in the last 30 days and, when you start it from an article, which article (page addresses only, never their parameters);
• to review conversations in order to improve the quality, accuracy and tone of our guides;
• to keep the Services secure, prevent fraud and abuse, and comply with the law.

We do not use your data to make decisions that have legal or similarly significant effects on you.

4. Legal bases (EU/EEA, UK and similar laws)

• Contract: your account, readings, membership, shop orders and the emails these need.
• Consent: information about your private life you choose to share in readings, photos you upload, daily letters, non-essential cookies and advertising where consent is required, and marketing emails where required. You can withdraw consent at any time.
• Legitimate interests: security, fraud prevention, analytics, improving the Services, guide memory, and marketing to existing users where the law allows.
• Legal obligation: accounting, tax and responding to lawful requests.

5. Sensitive information and information about others

Readings often touch on relationships, emotions and personal life, and you may choose to share details such as your sexual orientation, health or beliefs. This is voluntary, and we use it only to give you the reading you asked for and the features described here. Please do not share anything you do not want processed.

If you write about other people (for example their name and birth date), use only information you are entitled to share. We use it only to answer your question.

6. AI processing

Our guides are AI personas. Your questions, the relevant parts of your profile and earlier readings, and any photo you upload are sent to large language model providers through OpenRouter (currently models from providers such as Google and Anthropic) to generate answers. These providers process the data on our behalf to return a response. Where their terms give us the choice, we choose settings that do not allow them to train their models on your data. AI outputs can be inaccurate; see our Terms of Use.

7. Who we share data with

We share personal data only with service providers that help us run Velvet Astral, under agreements that limit how they may use it:

• Supabase: database, authentication, file storage (including uploaded photos) and server functions
• Cloudflare: website hosting, delivery and security
• OpenRouter and AI model providers (such as Google and Anthropic): generating readings
• Stripe: payments, memberships, billing portal and sales tax
• Resend: sending and receiving email, and managing email lists and unsubscribes
• Google: Google sign-in (if you use it) and Google Analytics
• Meta Platforms: the Meta Pixel and Conversions API, which receive page and conversion events (such as sign-up, starting checkout and purchase) with your IP address, browser details, Meta cookies and a hashed (encrypted one-way) email address and account ID, to measure and improve our ads
• Photon (komoot): looking up the coordinates of the birth place you type
• Fulfilment partners (for shop orders): your name, shipping address, phone, email and items ordered, so they can ship your order; carriers receive what they need for delivery
• accountants, legal advisers and authorities where required by law

We do not sell your personal data for money. Sending browsing and conversion data to Meta and Google for advertising may count as "sharing" or "targeted advertising" under some US state laws; see section 12.

8. International transfers

Several of our providers are based in, or process data in, the United States and other countries outside the EU/EEA. Where the law requires it, we rely on adequacy decisions (such as the EU-US Data Privacy Framework for certified providers) or standard contractual clauses.

9. How long we keep data

• Account, readings, photos, rituals and guide memory: while your account exists. When you delete your account, we delete them, except backups that are overwritten on a rolling basis.
• Payment and order records: as long as tax and accounting law requires (in Slovenia, generally up to 10 years for invoices and accounting documents).
• Email logs and unsubscribe records: as long as needed to deliver email reliably and respect your choices; we keep a suppression record so we do not email you again after you unsubscribe.
• Analytics and security logs: for a limited period, according to the retention settings of our analytics provider (no longer than 14 months) and shorter for technical logs.

10. Security

We use encryption in transit, access controls and row-level security in our database, so you can only read your own readings and orders, and private storage for uploaded photos. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

11. Your rights

Depending on where you live, you can:

• access your data and get a copy in a portable format;
• correct inaccurate data;
• delete your account and data;
• restrict or object to certain processing, including direct marketing at any time;
• withdraw consent at any time, without affecting earlier processing; and
• complain to a data protection authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si); you can also contact the authority where you live.

To use any of these rights, email info@velvetastral.com. We answer within one month, or sooner where the law requires. We may ask you to confirm your identity.

12. Notice for US residents

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Texas), you have the right to know what personal information we collect, to access, correct and delete it, and to opt out of targeted advertising and the "sale" or "sharing" of personal information. The categories we collect and why are described in sections 2 and 3, and who receives them in section 7. We do not knowingly sell or share personal information of anyone under 18.

To opt out of advertising-related sharing, email info@velvetastral.com with the subject "Do not share", and we will stop sending your data to advertising partners for that purpose. You can also block the Meta Pixel and Google Analytics with your browser or ad settings. We will not discriminate against you for using your rights. You can also appeal a decision we make about your request by replying to our answer.

13. Cookies and similar technologies

We use cookies and browser storage for:

• Essential purposes: keeping you signed in, remembering your language, saving a reading you started before signing in, and security.
• Analytics: Google Analytics 4, to understand how the site is used.
• Advertising: the Meta Pixel (_fbp, _fbc), to measure our ads and reach people likely to be interested.

You can block or delete cookies in your browser settings and opt out of personalised ads in your Google and Meta ad settings. Visitors in the EU/EEA, the UK and Switzerland are asked first: analytics and advertising cookies stay off, and no conversion data is sent to Meta, until you choose "Accept". You can change your choice at any time with "Cookie settings" at the bottom of every page.

14. Emails and unsubscribing

You can unsubscribe from daily letters, check-ins and marketing emails with the link in every such email, or manage daily letters in your account. Emails needed for your account or purchases, such as sign-in links, receipts and shipping updates, are still sent while you use the Services.

15. Children

Velvet Astral is only for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

16. Changes to this Privacy Policy

We may update this Privacy Policy as the Services change. The updated version applies from the date at the top. If changes are significant, we will tell you by email or on the site.

17. Contact