Privacy, Terms & Support

By accessing or using Velora Tarot you agree to these Terms of Use. If you do not agree, do not use the service. The service is provided “as is” without guarantees of uninterrupted access or guaranteed outcomes from any reading.

Age requirement

You must be at least 18 years old to use Velora Tarot. Fortune-telling content is intended for adults only. By creating an account you confirm that you are 18 or older. We do not knowingly collect data from anyone under 18. If we become aware that a user is under 18 we will delete their account and data immediately.

Acceptable use

You are responsible for keeping your account credentials secure. You agree not to create multiple accounts to circumvent free-reading limits, payment flows, sharing bonuses, or any other part of the service. You may not use the service in any way that is unlawful, harmful, or disruptive.

Entertainment disclaimer

All readings are generated by artificial intelligence for personal reflection and entertainment purposes only. Nothing provided by Velora Tarot constitutes or should be relied upon as professional advice of any kind — including medical, psychological, legal, financial, or relationship advice. If you are in crisis, please contact a qualified professional or an emergency service. The app's crisis detection is automated — no human reviews flagged messages. If you are in immediate distress, please call or text one of the following directly: Shout 85258 (UK, text SHOUT to 85258), Samaritans 116 123 (UK, free, 24/7), or 988(US, Suicide & Crisis Lifeline).

Intellectual property

All content, branding, card art, and software are owned by or licensed to Velora Tarot. You may not reproduce or distribute any part of the service without prior written consent.

Suspension and termination

We reserve the right to suspend or delete accounts that breach these terms or that are used fraudulently. We may also modify or discontinue the service at any time with reasonable notice.

Governing law

These terms are governed by the laws of England and Wales. Any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is:

The supervisory authority for data protection in the UK is the Information Commissioner's Office (ICO). You have the right to lodge a complaint with the ICO if you believe your data has been processed unlawfully (see Your rights).

This Privacy Policy explains what personal data we collect, why we collect it, the legal basis under UK GDPR, how long we keep it, and who we share it with.

Data we collect

Account data — collected when you register or sign in:

• •Email address — to identify your account, send verification and password-reset links
• •Display name (optional) — from your profile or provided by your OAuth provider (e.g. Google)
• •Profile picture URL (optional) — provided by Google if you use social sign-in
• •Bcrypt-hashed password — only if you use email + password sign-in; the plain-text password is never stored or transmitted
• •OAuth provider link — provider name and account ID if you sign in via Google

Reading and usage data — created as you use the service:

• •Reading history — cards drawn, spread type, question asked, and AI-generated interpretation
• •Daily free-reading usage timestamps and any prepaid token balance
• •Optional personalisation profile — name, star sign, life context — saved only if you choose to enter it
• •Your rating feedback on individual readings (thumbs up / down)
• •Support messages submitted via the contact form

Technical / analytics data — collected automatically:

• •Session authentication cookie (necessary for sign-in — not optional)
• •Anonymous usage events via Google Analytics 4 (only if you consent via the cookie banner)
• •Browser local storage entries for in-progress readings and your cookie-consent preference (functional — no personal data)

Legal basis for processing (UK GDPR)

Data retention

• •Account and reading data — retained for as long as your account is active, or until you request deletion
• •Payment records — retained for up to 7 years to comply with UK tax and financial regulations (even after account deletion)
• •Email verification and password-reset tokens — deleted within 24 hours of use or expiry
• •Support messages — retained for up to 2 years
• •Google Analytics data — subject to Google's own retention policy (default 14 months); we do not receive personally identifiable information from GA4

Data sharing

We do not sell your data, run advertising networks, or share data for marketing purposes. We share data only as described in the AI & Third-party services section below and as listed here:

• •OpenAI — receives reading content (cards, question, optional personalisation) to generate the interpretation
• •ElevenLabs — will receive a condensed text summary of your reading to generate optional audio narration (feature not yet active)
• •Stripe — receives payment details necessary to process your purchase (we never see your card number)
• •Resend — receives your email address to send transactional emails (verification, password reset, welcome)
• •Google Analytics — receives anonymised usage event data only if you consent via the cookie banner
• •Vercel (our hosting provider) — handles all web traffic; subject to Vercel's own DPA
• •Law enforcement or regulators — only if required by applicable law or a valid court order

We do not transfer your personal data outside the UK/EEA without appropriate safeguards. Where processors are based in the US (OpenAI, Stripe, Google) we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

OpenAI (reading interpretation)

Reading content is processed by OpenAI's GPT-4o model to generate your interpretation. OpenAI acts as a data processor on our behalf. OpenAI may process prompt data according to its Privacy Policy and Usage Policies. Per OpenAI's API data usage policy, data submitted via the API is not used to train OpenAI models by default.

What is sent to OpenAI: selected card names and positions, spread type, your question (if any), and your Oracle Memory profile when set (name, sun sign, moon sign, birth date, focus areas, life phase, and life context — paid spreads only for extended fields). Do not enter sensitive personal information such as identification numbers, medical details, or financial data in any free-text field.

OpenAI is based in the United States. Transfers are covered by Standard Contractual Clauses as part of OpenAI's API terms.

ElevenLabs (voice narration — coming soon)

Voice narration is a planned future feature and is not currently active. When launched, a brief text summary of your reading will be sent to ElevenLabs to generate audio narration. No data is currently sent to ElevenLabs. ElevenLabs' privacy policy is available at elevenlabs.io/privacy.

What will be sent when active: a condensed summary of the reading interpretation only (no name, star sign, or other personal fields). This page will be updated before the feature launches.

Resend (transactional email)

Resend processes your email address to deliver verification links, password reset links, and welcome emails. We do not send marketing emails. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Google Analytics 4 (analytics — consent required)

When you consent via the cookie banner, anonymised usage events (e.g. page views, spread type chosen) are sent to Google Analytics 4. No personally identifiable information is included. You can opt out at any time by reopening the consent banner through your browser's site-data controls and choosing essential-only access, or via the Google Analytics Opt-out browser add-on. Google's privacy policy: policies.google.com/privacy.

We use a small number of cookies and browser local storage entries. UK law (PECR) requires your consent for non-essential cookies. The cookie banner shown on your first visit lets you choose.

Strictly necessary (no consent required)

Functional local storage (no consent required)

Analytics cookies (consent required)

To change your cookie preference at any time, clear this site's stored data or local storage and reload the page — the consent banner will reappear.

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights regarding your personal data:

To exercise any right, contact us at privacy@veloratarot.com. We will respond within 30 days as required by UK GDPR. We may ask you to verify your identity before actioning a request.

Paid readings and bundles are processed by Stripe, Inc. a PCI-DSS Level 1 certified payment processor. We do not store, see, or process your card number or payment credentials. Payment pages are hosted and secured by Stripe.

Prices are shown in GBP (British Pounds Sterling). Premium readings are one-off purchases. Bundles provide a balance of prepaid reading tokens redeemable at any time on your account. Tokens do not expire.

Reading purchases are generally non-refundable once a reading has been generated and delivered, except where applicable consumer law (including the UK Consumer Rights Act 2015) requires otherwise. Unused bundle tokens may be refunded at our discretion within 14 days of purchase. If you believe you were charged incorrectly, contact support@veloratarot.com with the email address linked to your account and any relevant order reference.

For details on how Stripe handles payment data, see Stripe's Privacy Policy and Services Agreement.

Deleting individual readings

You can delete individual readings from your reading history inside the app at any time.

Deleting your personalisation profile

Personalisation data (name, star sign, life context) can be cleared at any time from the Personalise page while signed in. Clearing your profile immediately stops it from being included in future reading requests.

Deleting your account (right to erasure)

To delete your account and all associated data — including your email address, reading history, personalisation profile, and any remaining token balance — go to Account and use the “Delete Account” option. Deletion is immediate and permanent. We cannot recover deleted accounts.

Alternatively, email privacy@veloratarot.com with the email address linked to your account. We will complete valid erasure requests within 30 days.

Note: payment transaction records are retained for up to 7 years as required by UK financial regulations, even after account deletion. These records do not contain your reading content or personalisation data.

Revoking third-party access

If you signed in with Google, you can revoke the app's access through your Google Account permissions at any time. This does not delete your Velora Tarot account; use the Delete Account option for full erasure.

Data portability

To request a machine-readable export of your data, email privacy@veloratarot.com. We will provide your account data and reading history in JSON format within 30 days.

The fastest route is the contact form in your Account. If you prefer email, use the addresses below:

We aim to respond within 2 business days. For data subject requests (access, erasure, portability) we have up to 30 days under UK GDPR.

Supervisory authority

If you are not satisfied with our response to a privacy concern, you have the right to contact the UK's supervisory authority directly: Information Commissioner's Office (ICO) — 0303 123 1113.