This Policy has been developed in accordance with applicable personal data protection law and describes how the personal data of users of the Arcanika service is processed and protected.
Personal data operator: the operator’s full registration details are provided at the end of this document.
1. What data we collect
- Email — for authorization and saving readings (upon registration)
- Profile name — when registering via an external authentication provider: we receive the name and email from the user’s public profile (with the user’s explicit consent on the provider’s side)
- Questions and readings — to prepare interpretations and history
- Date of birth — optional, for the Card of the Day and numerology
- Technical data — IP, user-agent, visit time (standard access log)
- Payment data — via external payment systems; the operator does not store bank card data
2. How we use it
- Providing the service’s functionality
- Communication with support
- Improving the quality of interpretations (anonymized analytics)
- Email notifications about new features (only with consent)
- Fulfilling obligations to the user regarding paid services
3. Legal grounds for processing
- Consent of the personal data subject
- Performance of a contract to which the subject is a party
- Compliance with the operator’s legal obligations (applicable tax, accounting and similar legislation)
4. Transfer of data to third parties
The operator engages technical contractors necessary to provide the Service. List of categories of recipients:
- External authentication providers — used at the user’s choice as an alternative to registering with email and password. They receive from and/or transmit to the operator only public profile data (email, name) with the user’s explicit consent expressed on the provider’s side. The use of external authentication is optional.
- Payment provider — for processing payments (order amount, user’s email, order identifier). Bank card data is processed on the payment provider’s side; the operator neither receives nor stores it.
- Technology contractors — providers of computing infrastructure and services for preparing interpretation text. Only the text of the question and the reading context are transmitted in anonymized form; the user’s contact data (email, name, date of birth, account identifiers) is not transmitted to these contractors. The user is solely responsible for the content of their question wording; it is not recommended to include in the question text any personal data (your own or that of third parties), information constituting legally protected secrets, or other sensitive information.
- Transactional email delivery service — for emails confirming email address, password recovery, and system notifications. The email address and the contents of the message are transmitted.
- Lawful requests from competent government authorities.
5. Cookies and analytics
We use functional cookies: for authorization (JWT token) and for saving tone, language, and theme settings.
We use the Google Analytics 4 web analytics service (Google LLC, USA), integrated via Google Tag Manager. It sets its own cookies (_ga, _ga_*, _gid) and collects anonymized data about visits: pages viewed, session duration, referral source, approximate location by IP, and device type. IP addresses are processed in truncated (anonymized) form. The data is used to understand the audience and improve the service. Tracking can be disabled via the Google Analytics opt-out browser add-on or your browser’s privacy settings.
6. Retention periods
- Account data — until the account is deleted by the user
- Payment data — 5 years (requirement of applicable tax legislation)
- Access logs — up to 90 days
7. Your rights
- Delete your account and all data — in your personal account
- Download all of your data in JSON — upon request via support
- Disable saving of reading history — a setting in your profile
- Opt out of the email newsletter — a link in every email
- Withdraw consent to processing — in writing via support
8. Contacts
Questions about personal data processing, including withdrawal of consent: support page.
Last updated: 23 May 2026.
Operator details
