This Privacy Policy applies to TAROT (the "Service"), a tarot reading web service operated by Tarokids (the "Service Provider"). The Service Provider takes your personal information seriously and processes it safely in accordance with applicable laws.
1. Personal Information We Collect
The Service collects and processes the following information:
- Sign-in information (when linking a Google account): email address, display name, profile image URL, Google unique identifier (uid)
- Usage information: the tarot questions you submit, randomly drawn cards, generated interpretations, reading timestamps, feedback on reading results (like/dislike), unlock history
- Currency information: your current star balance and history of star top-ups, deductions, and unlocks
- Payment information: payment identifiers, purchased package, applied discount code, and payment timestamp processed via the payment processors Paddle (international payments) or PortOne (Korea Port One Co., Ltd., for payments in Korea only). Raw payment method details such as card numbers are not stored by the Service Provider; Paddle or PortOne handles them directly.
- Automatically collected information: access IP address, browser and operating system type, access date and time, visited pages, time spent on pages, event logs (clicks, conversions, etc., for analytics)
The Service does not collect your precise location (GPS), contacts, or photos.
2. Purposes of Use
- User identification and authentication, account security
- Generating tarot interpretations and storing reading history
- Star top-ups and deductions, payment verification, refund processing
- Service quality analysis, error diagnosis, feature improvement, A/B testing
- Responding to customer inquiries and delivering important notices
- Compliance with legal obligations and prevention of fraudulent use
3. Notice on External Processing
The question you submit and the randomly drawn card information are sent to the API of an external language model provider (currently OpenAI) to generate the interpretation. The Service Provider strives to ensure the following:
- Transmitted data is used solely for generating the interpretation for that reading, and under OpenAI's API policy it is not used for model training by default.
- We recommend that you do not include in your questions any sensitive personal information you do not wish to be transmitted to external services (resident registration numbers, financial information, medical information, identifiable information about third parties, etc.).
4. Retention and Use Period
- Account information and reading history: retained until you request account deletion, then destroyed immediately or within the period prescribed by applicable laws.
- Payment and refund records: retained for 5 years in accordance with the Act on the Consumer Protection in Electronic Commerce, Etc. of Korea.
- Access logs: retained for 3 months in accordance with the Protection of Communications Secrets Act of Korea, then destroyed.
- Readings that have not been unlocked remain partially locked after 24 hours, and inactive data may be automatically cleaned up after a certain period.
5. Third-Party Provision and Processing Entrustment
To operate the Service, some data is entrusted or transmitted to the following external services. Each company handles the data under its own privacy policy.
- Google Firebase (Google LLC): user authentication, database, analytics. Entrusted items: sign-in information, reading history, usage logs
- OpenAI, L.L.C.: interpretation generation. Entrusted items: user questions, randomly drawn card information
- Paddle.com Market Limited: payment processing (international payments). Entrusted items: payment amount, package identifier, payment method (collected directly by Paddle)
- Korea Port One Co., Ltd. (PortOne): payment processing (for payments in Korea only). Entrusted items: payment amount, package identifier, payment approval and cancellation information (raw payment method details such as card numbers are collected and processed directly by PortOne and its affiliated PG companies, and are not stored by the Service Provider)
- Vercel Inc.: web hosting and traffic handling. Entrusted items: access IP, request logs
We do not provide or sell your personal information to third parties other than the companies above, except in the following cases:
- When you have given prior consent
- When required by law or upon a lawful request from investigative authorities
- When urgently necessary to protect the life, body, or property of you or a third party
6. Your Rights
You may exercise the following rights at any time:
- Request access to, correction of, or deletion of your personal information
- Request suspension of the processing of your personal information
- Request account deletion and data erasure
- Request portability (download) of your personal information
To exercise these rights, please submit a request via the refund and issue report form. Requests are processed within a reasonable period (typically within 7 days) from the date of receipt.
7. Children's Personal Information
The Service is not directed at children under the age of 14 and does not knowingly collect personal information from children under 14. If you become aware that a child under 14 has provided personal information, please notify us immediately via the refund and issue report form. We will delete the information as soon as it is confirmed.
8. Security Measures
- Encryption in transit (HTTPS/TLS) and access control for stored data
- Two-factor authentication for administrator accounts and the principle of least privilege
- Immediate notification to users and reporting to relevant authorities in the event of a data breach
9. Cookies and Similar Technologies
The Service uses browser cookies and local storage for keeping you signed in, saving preferences, and analytics. You may refuse cookies in your browser settings, but some features may be limited as a result.
10. Changes to This Policy
This Policy may be revised in response to changes in laws or the Service. In the event of a material change, we will provide notice via in-service announcement or email at least 7 days before the effective date.
11. Privacy Officer / Contact
For inquiries, requests, or reports regarding personal information, please use the refund and issue report form.