English English

Personal Data Processing Policy

Last updated: 30 June 2026

This Personal Data Processing Policy defines how personal data is processed and protected when you use the KartiTaro.ru website and related services (the “Service”) — free online tarot readings, card meanings, AI tarologist chat on Love Tarot, and booking a live tarologist consultation.

A plain-language overview is available in our Privacy settings Privacy Policy. By using the Service, you agree to this Policy.

1. General provisions

This Policy is prepared in accordance with applicable data-protection laws, including:

  • Federal Law No. 152-FZ “On Personal Data” (Russian Federation);
  • Federal Law No. 420-FZ on administrative liability for personal-data violations (where applicable);
  • other regulations governing personal data protection in jurisdictions where processing takes place.

2. Data controller

The data controller is the owner and operator of KartiTaro.ru.

Contact for personal data matters:
Email: smartotsail@yandex.ru

3. Categories of personal data processed

The Service may process the following categories of personal data:

3.1. Data provided by the user or generated when using features:

  • Questions, intentions, or focus text entered during a reading;
  • Tarot spread results: card names, positions, and displayed interpretations — stored temporarily in the browser and, when you book a consultation or use related features, transmitted to our servers with a pseudonymous visitor identifier;
  • Messages sent in the AI tarologist chat (Love Tarot): processed to generate replies and stored in dialog storage for the session and associated retention period;
  • Preferred consultation date and time when booking a session with a live tarologist;
  • Any personal data you voluntarily include in an email to us.

Free readings do not require registration or an email address.

3.2. Technical data:

  • IP address;
  • Browser and device information (User-Agent);
  • Date and time of access to the Service;
  • Session and request log entries on our servers.

3.3. Data processed by infrastructure providers:

When you use AI tarologist chat, message content and session metadata are processed in Yandex Cloud as processors acting on our instructions. Static assets are delivered from Cloud.ru; access logs may be generated by hosting providers. Consultation booking uses Yandex Calendar; consultation notifications are sent via Yandex Mail.

3.4. Analytics data (Yandex Metrika):

  • Online identifiers in Metrika cookies (_ym_uid, _ym_d, yandexuid, and related _ym_* cookies);
  • Pages viewed, clicks, navigation paths, referrer, session duration, device and browser parameters;
  • IP address and approximate location derived from IP (processed by Yandex LLC as part of Metrika);
  • Webvisor session records where enabled.

Yandex privacy information: yandex.ru/legal/confidential.

4. Purposes of processing

Personal data is processed for the following purposes:

  • Providing tarot readings, interpretations, and site functionality;
  • Operating AI tarologist chat and live consultation booking;
  • Sending consultation summaries to the tarologist by email (Yandex Mail);
  • Ensuring security, preventing abuse, and maintaining technical operation;
  • Complying with legal obligations;
  • Measuring site traffic, analysing use of readings and sections, and improving the Service (Yandex Metrika).

5. Cookies and browser storage

The Service uses cookies and browser storage necessary for its operation.

5.1. Cookies:

  • kartitaro_vid — pseudonymous visitor identifier; up to 365 days; associates readings and booking requests;
  • kartitaro_reading — compact snapshot of the latest spread; up to 24 hours; used for consultation handoff.

5.2. localStorage and sessionStorage:

  • kartitaro_locale (localStorage) — language preference;
  • kartitaro_ai_session, kartitaro_ai_reading_fp (sessionStorage) — AI chat session continuity on Love Tarot.

5.4. Yandex Metrika cookies (analytics):

  • _ym_uid, _ym_d — pseudonymous visitor identifiers in Metrika (typically up to 1 year);
  • yandexuid and related Yandex cookies — identifier used in Yandex analytics;
  • other _ym_* cookies — session analytics, hit tracking, Webvisor.

Blocking analytics cookies in the browser or using the Yandex Metrika opt-out stops Metrika measurement but does not affect essential Service cookies listed in sections 5.1–5.2.

5.3. Managing cookies:

You may block or delete cookies in your browser settings. Disabling essential cookies may prevent consultation handoff and limit some features.

6. Retention periods

  • Reading snapshot cookie: up to 24 hours;
  • Visitor ID cookie: up to 365 days;
  • Technical data (IP address, User-Agent): for the session and additionally up to 12 months for security;
  • AI dialog data (chat messages, dialog context, visitor facts): no more than 14 calendar days; deletion from the database within 5 days after expiry; the consent registry is retained separately for audit;
  • Consultation-related records (including reading content sent to the tarologist): as needed to deliver the service and meet legal requirements;
  • Yandex Metrika data: per Metrika account settings and Yandex documentation (aggregated statistics — typically up to 12 months; Webvisor — per enabled retention settings).

7. Security measures

We apply reasonable measures to protect personal data, including:

  • HTTPS for data in transit;
  • access restrictions to production systems and databases;
  • secure handling of API credentials;
  • regular security updates and backups where applicable.

8.5. Consent registry (YDB)

Significant consent actions (analytics cookies, personal data for AI chat, personal data for consultation booking, and withdrawals) are recorded in an append-only event log stored in Yandex Database (YDB), linked to visitor_id, policy version, locale, source page, timestamp, and a hashed IP address. The log supports accountability and is retained for the periods stated in section 6 unless a longer period is required by law.

You may withdraw consent via Privacy settings in the site footer or by email. Withdrawal is recorded as a new event; it does not erase prior grant records. After withdrawal, the related processing stops until you grant consent again.

8. Rights of data subjects

Under applicable law (including Federal Law No. 152-FZ where it applies), you may have the right to:

  • receive information about processing of your personal data;
  • request rectification, blocking, or erasure of inaccurate or unlawfully processed data;
  • withdraw consent where processing is consent-based;
  • lodge a complaint with a supervisory authority or court.

To exercise your rights, contact smartotsail@yandex.ru.

9. Disclosure to third parties

Personal data is not sold. It may be disclosed only:

  • when required by law;
  • to service providers to the minimum extent needed to operate the Service:
    • Yandex Cloud — AI tarologist chat processing;
    • Cloud.ru — static asset delivery;
    • Yandex LLC — web analytics (Yandex Metrika);
    • Yandex LLC — Yandex Mail and Yandex Calendar for consultation booking and notifications;
    • the tarologist — reading details and booking time;
  • with your consent.

10. Liability

Violation of personal data requirements may entail administrative liability under applicable law, including Federal Law No. 420-FZ in the Russian Federation.

11. Changes to this Policy

We may update this Policy from time to time. Changes take effect when published on this page. We recommend reviewing this Policy periodically.

12. Contact

For questions about personal data processing:

Email: smartotsail@yandex.ru

← Back to home