Last updated: October 27, 2026 (version 1).
This page explains what personal data is processed when you visit the website or request a reading, what it is used for, how long it is kept, and what you can do about it. The EU General Data Protection Regulation (GDPR) applies to anyone in the European Economic Area; for everyone else, the data protection laws of your own country apply (for example, California and other U.S. state privacy laws, or the laws of your Latin American country). What is promised here applies to everyone, wherever you live.
The data controller is Tarot with Rafael.
For any data matter, message +1 646 814 3732 on WhatsApp.
When you read the website. There is no sign-up and no comments. The server that hosts the site (Hostinger) logs technical data from each visit (such as the IP address, the browser and the page viewed) so the site works and is protected from attacks. The site’s fonts load from Google Fonts: your browser connects to Google’s servers, which receive your IP address.
When you request a reading (the only form). Only what is needed:
Other people’s data. If you give me another person’s data or photos (your partner, your ex, a relative), you confirm that you have a legitimate reason to share them and that you will not use them to harm that person. That person has the same rights over their data as you do (section 9).
Very personal data. What you share may include information about your intimate or romantic life, your health or your beliefs. This data gets special protection. I only process it if you decide to share it and give your explicit consent by ticking the form’s checkbox; you can withdraw it at any time (section 9).
| Purpose | Legal basis |
|---|---|
| Reading your request, messaging you on WhatsApp, doing your reading and, for the full reading, giving you the payment details | Your request (steps taken before providing the service you ask for) |
| Processing the very personal data and photos you choose to send | Your explicit consent |
| Allowing one free reading per phone number every 30 days and merging your requests into one record | Legitimate interest in preventing abuse and serving you better |
| Site security and the irreversible connection fingerprint (deleted automatically within 24 hours at most) | Legitimate interest in protecting the site |
| Counting visits (section 11) | Legitimate interest in improving the website |
| Keeping payments and receipts for as long as the law requires, if it does | Legal obligation |
I make no automated decisions about you and do no profiling. I do not sell your data or share it for advertising. I do not publish it: no conversations, names or photos.
Only Rafael and, if involved in your reading, Rafael’s assistant, and the people who administer the website. These providers are also involved, only as far as they need to be:
The website detects the country you connect from, on the server and with a country database, to offer you the right dialing code, check your number and show the price that applies. Your IP address is not stored: only the country.
Photos are re-saved without the hidden data they carry (location, phone model), with a random name, in a private folder that cannot be reached from the internet. They can only be opened from the admin panel. Receipts are stored the same way. No system is 100% secure, but I use reasonable measures to protect your data.
When you send a request, your browser stores a long, random private code in its local storage. It only lets you view, change or delete your request from that same device. It is not used for advertising and does not follow you to other sites. The server only stores an irreversible fingerprint of the code. If you clear your browser data or switch devices, message me on WhatsApp with your request number and we will handle it there. More in the Cookie policy.
You can ask me at any time to: tell you what data I have about you and give you a copy, correct it, delete it, limit its use, object to it, take your data with you, and withdraw your consent (withdrawing it does not affect what was already done). If you live in California or another state with a similar law, you can also ask which categories of data I hold; I do not sell or share personal data, and I will not treat you worse for using your rights.
I will reply within 30 days. To protect you, I may ask you to confirm that you are the person who made the request. If you believe your rights were not respected, you can complain to the data protection authority of your country or of the EU.
Rafael works with people in many countries, so your data may be processed outside your country. When data leaves the European Economic Area I use the safeguards the law requires (for example, the EU standard contractual clauses offered by providers). When you message me on WhatsApp or pay with USDT, your data also travels through those services, which are outside my control.
This website uses no third-party statistics or advertising.
The website and the services are only for people 18 and older. If I find that a request comes from a minor, I delete it.
If I change this policy, I update the date and version above. If the change is important, I will tell you on the website.
