Skip to content
VIDASTRAL
The pass

Legal

Privacy Policy

Last updated 2026-10-15

Vidastral ("we", "us") is an AI tarot reading service. This policy describes what personal data we collect, why we collect it, how long we keep it, and the rights you have over it. We operate from the European Union (Portugal) and serve users worldwide, so this policy is written to comply with the EU GDPR and the Brazilian LGPD.

1. What we collect

  • Email address — if you sign up, join the waitlist, or request a magic sign-in link.
  • Readings — the cards drawn, any optional question you typed (up to 280 characters), the reading text we generated, and a short summary used to give future readings context.
  • Reading by a tarot reader — if you order one: the question and cards of that order, the notes and the draft the AI prepares for the tarot reader, the text she writes with her signature, and the email you paid with, to let you know when it is ready.
  • Anonymous session cookie — a first-party cookie we set so anonymous readings stay associated with your device for 30 days.
  • Session cookie — if you sign in, an HTTP-only first-party cookie that expires 30 days after issue.
  • Consent preference — whether you accepted or declined non-essential cookies (stored locally on your device).
  • Analytics — if you accept, we record page views and a small number of named events (reading started, reading completed, account created, waitlist signup). We use a privacy-friendly analytics provider that does not build cross-site profiles for these product events, and Google Analytics 4 for aggregate page-view and traffic measurement. Neither loads until you opt in via the cookie banner.
  • Purchases — if you buy the pass, a single reading of a pass spread or a reading by a tarot reader: the amount, the currency and a Stripe payment-session identifier. Your card details go straight to Stripe and never pass through us.

2. Why we collect it

  • To deliver the service you asked for: generating and displaying your reading (or passing your order to the tarot reader who writes it), signing you in, sending the magic-link email.
  • To give signed-in users a three-reading memory so new readings have context. This is a core product feature.
  • To understand whether the product is working (aggregate funnel numbers), gated on your consent.
  • To comply with our legal obligations.

3. How long we keep it

  • Accounts & readings: until you ask us to delete them.
  • Anonymous sessions: the cookie expires after 30 days; the server record is retained for audit but contains no personal identifier.
  • Waitlist signups: until you ask us to remove you or until the waitlist is retired.
  • Purchases: the payment record is kept for as long as accounting rules require; if you bought a reading about another person while it was sold, the name and birth date you typed, until you ask us to delete them.
  • Reading by a tarot reader: the tarot reader can open the order while she writes it and for up to 30 days after it is delivered, or refunded; after that she no longer sees it. The reading, the AI's notes and draft, and the order are kept like your other readings and purchases.

4. Your rights

Under GDPR and LGPD you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. MVP does not yet offer self-serve deletion — to exercise any of these rights, email privacy@vidastral.com. We respond within 30 days.

5. Cookies

We use first-party cookies only. Essential cookies (your session, your anonymous session, your consent preference) are strictly necessary for the site to function and do not require consent. Non-essential analytics cookies — including those set by Google Analytics — are only set after you opt in via the cookie banner; you can change your mind at any time by clearing the preference in your browser.

6. Sharing

We do not sell personal data. We share it only with sub-processors we use to operate the service (hosting, email delivery, reading generation, and analytics — including Google Analytics). Some of these providers, including Google, may process data outside the European Union, such as in the United States. Each sub-processor is contractually bound to handle your data per this policy.

Payments are processed by Stripe Payments Europe, Ltd. (Ireland) as a processor: Stripe receives your email address and the payment details you give it directly, and handles them under its own privacy policy.

If you order a reading by a tarot reader, we share with the tarot reader it is assigned to only what she needs to write it: the order's question and cards; the earlier questions on that same thread, with their cards, their dates and whether they resonated with you; and, on a thread about another person, that person's name. She does not see your email, your account details, your other threads or the text of your earlier readings. The tarot reader prepares the reading with Vidastral's tools, including AI, reviews it and signs it: the order's data is processed by AI, which uses it to prepare notes and a draft for her, and is sent for that purpose to the provider that generates readings. The tarot reader uses this data only to write that reading, is bound to keep it confidential and may not copy or share it. She may live outside the European Union.

7. Contact

Privacy questions, requests, or complaints: privacy@vidastral.com. You also have the right to lodge a complaint with your local supervisory authority (in the EU: the CNPD in Portugal; in Brazil: the ANPD).