Privacy Policy

This Privacy Policy explains how Individual Entrepreneur Dmitri Alenevski (“we”, “us”) collects and uses personal data when you use AXDEL at axdel.world. It is written to meet the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA).

1. Who is responsible

The controller of your personal data is Individual Entrepreneur Dmitri Alenevski, Apt. 32, Bldg. 42/1B, Paronyan St., Kentron, Yerevan 0015, Armenia. For any privacy question or request, contact vdv4500@icloud.com.

2. What we collect

We collect as little as possible. We never ask for your postal address or phone number.

Account data: your email address, a securely hashed password and your settings (language, theme, sound, email preferences).
Guest email: if you purchase a reading without an account, the email you enter.
Readings: the spread, the theme you chose, the deck, the cards drawn, the date and the text of your reading.
Your question (optional): see section 3.
Journal (optional): notes, “one small action”, mood marks, tags, saved phrases and your “resonated / still relevant” marks. See section 4.
Orders and subscriptions: product, amount, currency, discounts, credits used, status, payment provider, dates, subscription plan and renewal dates. We do not receive or store full card numbers.
Gifts: the sender’s email and name, the recipient’s email, your message and the sending date.
Referrals: who invited whom and whether a bonus was paid.
Reviews and support messages: what you write to us and the name you choose to show.
Usage events: steps of the reading flow (for example “reading started”, “payment clicked”), see section 6.
Technical data: cookies described in our Cookie Policy, and server logs (IP address, browser type, time of request) kept for security.

3. How we handle your questions

Questions to tarot can be personal. That is why:

Writing a question is optional. A reading works without one.
Your question is used only to prepare your reading.
Questions are stored encrypted in our database (AES encryption; the key is kept separately from the database).
The text of a question is deleted automatically 90 days after the reading. The reading itself (cards and interpretation) is kept.
Questions are processed only on servers we control. They are not sent to third-party AI services, not used for advertising, not sold, and not shared with third parties.
Our staff cannot see questions in the administration panel. They are read only when you contact us about a specific reading or when we are legally required to.
Shared images and public links of a reading never contain your question.
An automatic filter checks questions for critical health, financial or safety topics so that we can point you to professional help instead of giving a reading.

4. Your journal and mood marks

Notes, actions and mood marks are stored encrypted and are visible only to you. Our staff cannot see them in the administration panel.
Mood marks may reveal how you feel. We use them only to show your own history to you and, if you switch on Gentle check-ins, to send one caring email after a difficult day. This option is off by default and is based on your explicit consent, which you can withdraw at any time in Settings → Notifications.
Mood marks are not used for advertising, profiling or any decision about you.
You can delete any entry, or your whole journal together with your account.

5. Why we use your data (legal bases)

To provide the Service — readings, accounts, journal, orders, subscriptions, gifts, delivery links (performance of a contract).
To send service emails — email confirmation, password reset, order confirmations, reading copies, subscription notices and renewal reminders (performance of a contract).
To send follow-up emails about your readings — that your reading is saved, a review request, a personal offer and a two-week check-in (legitimate interests; you can switch them off in your settings or with the link in every email).
To send the welcome series and the insights digest (your consent, given at sign-up or in settings).
To send gentle check-ins based on mood (your explicit consent, see section 4).
To measure and improve the Service with aggregated usage events (legitimate interests; linked to a device identifier only with your analytics consent, see section 6).
To keep the Service secure and prevent abuse, including the Daily Card limit, rate limits and fair use of trials, promo codes and referral bonuses (legitimate interests).
To meet legal obligations, such as keeping order records for accounting and tax purposes.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.

6. Usage events and analytics

We record steps of the reading flow in our own database to understand where people get stuck. Events never include question texts, notes or mood marks. If you are signed in, an event is linked to your account; otherwise it is anonymous, unless you accept analytics cookies, in which case it is linked to a random device identifier. We do not use third-party analytics or advertising services at the moment. If we add one, we will update this policy and use it only with your consent.

7. Who we share data with

We share data only with service providers who process it on our behalf and under contract:

Vultr Holdings LLC (servers in the United States) — stores the Service and its database;
our transactional email provider (Resend or Postmark)^TEMP — delivers emails (receives your email address and the email content);
our payment provider — when payments are enabled, it processes your payment details directly.

A gift reveals the sender’s name (if given) and message to the recipient. We may disclose data if required by law. We never sell your personal information or share it for cross-context behavioral advertising.

8. International transfers

Our servers are located in the United States. If your data is transferred outside your country, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. How long we keep data

Text of questions: 90 days after the reading, or earlier if you delete your account.
Account data, readings and journal: until you delete them or your account.
Guest readings: 12 months after creation, unless you create an account with the same email. After that the reading and its link are deleted; the order record (date, amount, email) is kept for accounting.
Order and subscription records: as long as required by accounting and tax law (personal details are removed when you delete your account, where the law allows).
Copies of sent emails: 90 days. Planned follow-up emails: 180 days after sending or cancellation.
Support messages and usage events: 24 months.
Server logs: up to 30 days.

10. Your rights (GDPR)

If you are in the EU, the EEA or the UK, you have the right to:

access your data and receive a copy;
correct inaccurate data — you can change your email and settings yourself;
delete your data — you can delete journal entries and your whole account yourself (right to erasure, Art. 17 GDPR);
restrict or object to processing, including follow-up emails;
withdraw consent at any time (emails, gentle check-ins, cookies) without affecting earlier processing;
data portability;
lodge a complaint with your local data protection authority.

11. California residents (CCPA)

In the last 12 months we have collected these categories of personal information: identifiers (email address, IP address), commercial information (orders, subscriptions), internet activity (usage events, server logs) and, if you use the journal, information you choose to write about yourself, including mood marks (sensitive personal information that we use only to provide the journal to you). We collected them from you and your device, for the purposes in section 5.

We do not sell or share personal information, and have not done so in the last 12 months.
We use your question, notes and mood marks only to provide the Service you asked for.
You have the right to know, access, correct and delete your personal information, and not to be discriminated against for exercising these rights.
To make a request, email vdv4500@icloud.com. We will verify your request by confirming access to your account email. You may use an authorized agent.

12. Security

We use HTTPS for all connections, encrypt questions, notes and mood marks at rest, store passwords only in hashed form, limit repeated attempts and limit access to data to people who need it to run the Service. No system is perfectly secure, but we work to protect your data.

13. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

14. Changes

We may update this policy. The “Last updated” date at the top shows the current version.

15. Contact

Individual Entrepreneur Dmitri Alenevski, Apt. 32, Bldg. 42/1B, Paronyan St., Kentron, Yerevan 0015, Armenia · vdv4500@icloud.com