Privacy Policy

1. Data we collect

We only collect what's necessary to deliver your reading:

• Identification: name, email, phone number (with country code).
• Reading context: the question you submit and any additional context you choose to share (date of birth, relationship status, etc).
• Payment: processed by Stripe; we don't store card details. We only receive the transaction ID and status.
• Technical: IP address, browser, pages visited (Google Analytics 4), used in aggregate to understand site usage.

2. How we use your data

• Generate and deliver your personalised tarot reading.
• Send the reading by email.
• Keep a history in "My account" for future access.
• Send the "Lua Nova" (New Moon) newsletter (only if you subscribed; unsubscribe in 1 click).
• Handle support and refund requests.
• Improve the service (aggregate analysis, no individual identification).

3. When we share data

We don't sell personal data. We only share it with providers essential to operating the service:

• Stripe, payment processing.
• Supabase, account storage and authentication.
• Airtable, order records and internal management.
• Text-generation provider, processes your question to compose the reading; no payment data is included.
• Resend, email delivery.
• Google Analytics, anonymous aggregate analysis.

4. Your rights (LGPD)

Under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law 13.709/2018), you have the right to:

• Confirm whether we process your data.
• Access a copy of your data.
• Correct incomplete or inaccurate data.
• Request deletion of your data (the "right to be forgotten"), except where retention is legally required.
• Port your data to another service.
• Withdraw consent at any time.

To exercise any of these rights, send an email to contato@abruxa.com.br. We respond within 15 days.

5. Cookies

We use essential cookies (to keep you logged in, remember UI preferences) and Google Analytics tracking cookies. You can block cookies in your browser settings, but some features may stop working.

6. Retention

We keep data for as long as necessary to provide the service and meet legal and tax obligations (typically 5 years for sales records). After that period, data is anonymised or deleted.

7. Security

We adopt reasonable technical and administrative measures: encryption in transit (HTTPS), credential segregation and restricted access. No system is 100% secure; in the event of an incident affecting personal data, we will notify those affected and the ANPD (Brazil's National Data Protection Authority) as required by the LGPD.

8. Minors

The service is not intended for people under 18. We do not knowingly collect data from minors.

9. Data Protection Officer (DPO)

The person responsible for handling your questions and requests about personal data can be reached at contato@abruxa.com.br.

10. Changes

This policy may be updated. The version in force is always this one. Significant changes will be communicated on the site or by email.