Life in Cards

Privacy Policy

Effective date: 8 March 2026

Life in Cards is operated by Arca Digital Ltd (“we”, “us”, “our”). We are committed to protecting your privacy and handling your personal data transparently. This policy explains what data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the California Consumer Privacy Act (CCPA).

1. Data Controller

Arca Digital Ltd is the data controller responsible for your personal data. Our company is registered in England and Wales (company number 17084212). For data protection enquiries, contact us at support@lifeincards.com.

2. Data We Collect

When you use Life in Cards, we may collect the following categories of personal data:

  • Account information: your email address and name, collected when you sign up.
  • Optional profile data: birth date, sun sign, personal goals, current life situation, and relationship context. You choose whether to provide this.
  • Questions and prompts: text you submit when requesting readings or asking follow-up questions. This includes the content of your questions and any additional context you provide.
  • Reading history: the tarot spreads you receive, cards drawn, AI-generated interpretations, and follow-up conversation threads.
  • AI-generated memories: contextual notes created by our AI to personalise future readings based on your past sessions.
  • Payment information: payment details are collected and processed by our payment processor. We do not store your credit card numbers or bank details. We receive your subscription status, transaction history, and billing email from our payment provider.
  • Usage metadata: timestamps of your readings and interactions, subscription tier, and credit balances.

3. How We Use Your Data

We use your personal data to generate personalised tarot readings, remember context across sessions so that follow-up readings build on previous ones, manage your account and subscription, deliver the core service functionality, and communicate with you about your account. We do not use your data for advertising or marketing profiling.

4. AI Processing and Automated Decision-Making

Your tarot readings are generated entirely through automated processing by artificial intelligence models, without human review. When you request a reading, your question, any profile context you have provided, and relevant memories from past readings are sent to the AI model to produce an interpretation.

Your inputs are processed solely to generate your readings and to create contextual memories for personalisation. Your data is not used to train or fine-tune AI models.

Under Article 22 of the UK GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects. Tarot readings are provided for entertainment and reflection only and do not produce legal or similarly significant effects on you.

5. Data Sharing and Processors

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes. We share data only with the following service providers, who act as data processors and process your data on our behalf and only according to our instructions:

  • Stripe — payment processing and invoicing. Stripe processes your payment details directly; we never see or store your card information.
  • Resend — transactional email delivery (e.g. magic link sign-in emails).
  • Google — provides OAuth sign-in (name, email, and profile picture if you choose to sign in with Google) and AI model services (Google Gemini) used to generate your tarot readings. Your questions and profile context are sent to Google's Gemini API to produce interpretations. Google does not use your inputs for model training under our API terms.
  • Neon — database hosting for your account data and reading history.
  • Railway — application hosting.

6. Legal Basis for Processing

We process your personal data on the following legal grounds under Article 6(1) of the UK GDPR:

  • Contract (Article 6(1)(b)): processing necessary to provide the service you have signed up for, including generating readings, managing your account, and processing payments.
  • Consent (Article 6(1)(a)): for optional profile information such as your birth date, sun sign, goals, current situation, and relationship context. You can withdraw consent at any time by removing this data from your profile.
  • Legitimate interest (Article 6(1)(f)): for service improvement, security monitoring, and fraud prevention.

7. International Data Transfers

Some of our service providers (including AI model providers, hosting providers, and payment processors) may process your personal data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, adequacy decisions, or the provider's participation in recognised data protection frameworks. You may contact us for further details about the safeguards we use.

8. Data Retention

Your account data is retained for as long as your account is active. If you request deletion, your personal data is anonymised immediately and permanently hard-deleted from our systems after 30 days.

Automated backup copies may persist for a limited period (up to 30 days) after deletion before they are automatically purged from backup systems.

9. Data Security

All personally identifiable information is encrypted at rest using AES-256-GCM. Data in transit is protected using TLS encryption. We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction.

10. Your Rights Under the UK GDPR

If you are located in the United Kingdom or the European Economic Area, you have the following rights:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — request correction of inaccurate or incomplete data.
  • Right to erasure — request deletion of your personal data.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to restrict processing — request that we limit how we use your data.
  • Right to object — object to processing based on legitimate interest.
  • Right to withdraw consent — withdraw consent at any time for data processed on the basis of consent, without affecting the lawfulness of processing before withdrawal.

11. Your Rights Under the CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Right to delete — request deletion of personal information we have collected from you.
  • Right to opt-out of sale — we do not sell your personal information to third parties.
  • Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

12. Right to Complain

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We encourage you to contact us first so we can try to resolve your concern directly.

13. How to Exercise Your Rights

You can exercise your data rights directly from your profile page, which includes “Download My Data” and “Delete My Account” buttons.

Alternatively, you can contact us at support@lifeincards.com to make any data rights request. We will respond within 30 days.

14. Cookies

We use a single session cookie that is strictly necessary for the functioning of the service (keeping you logged in). We do not use tracking cookies, advertising cookies, or analytics cookies. For more information, see our Cookie Policy.

15. Children

Life in Cards is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from someone under 18, we will take steps to delete that information promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email before the changes take effect. The “Effective date” at the top of this page indicates when this policy was last revised.

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@lifeincards.com.

See also: Terms of Service · Cookie Policy