Privacy Policy

1. Who we are

Leya Tarot is operated by SIA EASYMAT, registration number 40203221390. Contact: [email protected].

This policy explains how we process personal data when you use the Leya Tarot website, submit a question through our private web flow, make a payment through Stripe, or contact support.

2. Data we collect

• Website and technical data: IP address, browser, device, user agent, page URL, referrer, approximate country, security logs and server logs.
• Advertising and analytics data: privacy-filtered page paths, page titles, UTM parameters, campaign IDs, ad IDs, placement, fbclid, Meta browser identifiers such as fbp and fbc where available and permitted.
• Service data: for the original reading, three selected symbolic intention cards; for the relationship reading, one or two selected context tags. We also process your name, email, topic, question, optional written context, visit token, protected session ID and delivery status events. If you use the short reading form, we also collect your date of birth to provide context for your reading and check that you are 18 or older.
• Reading content: the spread image and card details, written reading, Clarity Summary, practical next step and included follow-up.
• Payment data: payment status, order information and transaction references processed through Stripe. We do not store full card details.
• Support data: messages you send to us by email or other support channels.

3. Why we use the data

• To provide the requested entertainment/self-reflection reading and communicate with you about it.
• To process payments, refunds and customer support requests.
• To measure website and advertising performance, including Meta Pixel and Meta Conversions API where consent and applicable law allow it.
• To protect the website, prevent abuse and keep records required for legal, tax and accounting reasons.

4. Legal bases

• Contract: to deliver the reading and handle related service communication.
• Consent: for non-essential cookies, marketing tracking and similar technologies where required.
• Legitimate interests: to secure the service, prevent abuse and understand basic performance.
• Legal obligation: to keep required payment, tax and accounting records.

5. Service providers

When Google Analytics 4 is enabled and you allow product analytics, Google receives privacy-filtered page and technical usage data. When Google Ads measurement is enabled and you allow advertising measurement, Google receives technical advertising identifiers and confirmed purchase data: an opaque order identifier, the amount paid and currency. Standard tag requests also expose technical connection information such as an IP address and browser information to Google. These integrations exclude your name, email, date of birth, question, reading content and private access links from event fields, and do not enable Google signals, enhanced conversions or personalized advertising. You can withdraw either choice using Cookie settings. Learn more about how Google uses information from partner sites.

We may use service providers including Resend for order updates and separately subscribed promotional emails, Meta Pixel and Conversions API for optional marketing measurement, Stripe for payments, Cloudflare for security and delivery, hosting providers for server infrastructure, and internal admin notification tools. These providers process data under their own terms and privacy practices.

If you separately opt in to Leya emails, we use your subscription record and saved quiz to send a limited series about your reading. Entering an email for order delivery alone does not subscribe you. You can unsubscribe using the link in any promotional email; necessary order updates continue separately.

We use Keitaro to measure visits and purchases from these emails. Links carry a random message identifier, not your email, name, or question. A separate protected link restores your saved order. We record delivery, returns to the website, purchases, refunds, and unsubscribe requests to operate the series and compare its results with a group that receives no promotional emails. We do not use email-open tracking for this series.

AI service providers may be used as assistive tools to help prepare, structure and format written responses and to create or process graphics. Depending on the task, they may receive service data such as your question, optional written context, relationship context tags, card and spread details, draft or approved reading content, included follow-up question and relevant graphics. We limit the data shared to what is reasonably necessary for the task and do not provide full payment-card details.

6. Retention

• Paid reading materials and the included written follow-up are available while the service operates, unless you remove the reading or a full refund revokes access. You can save the PDF locally.
• Secure result links, passwordless sign-in links and library sessions expire or can be revoked for security. Removing a reading hides it and revokes its result links; account-level erasure can be requested through support.
• Questions, reading requests and other service records are retained only as long as reasonably necessary to deliver and support the service, prevent abuse, resolve disputes and meet legal obligations.
• Advertising identifiers, UTM parameters and campaign attribution data: up to 180 days.
• Payment, refund and accounting records: for the period required by applicable tax and accounting law.

7. Your rights

Depending on your location, especially if you are in the EEA/UK, you may request access, correction, deletion, restriction, portability, objection to processing, or withdrawal of consent. You may also lodge a complaint with your local data protection authority.

To exercise your rights, email [email protected].

8. Age limit

Our service is intended for adults aged 18 or older. We do not knowingly provide readings to minors.