Skip to content
Legal

Privacy and Data Processing Policy

Draft pending legal review

This English version is provided for your convenience. If there is any discrepancy between versions, the Spanish version prevails.

Last updated: October 8, 2026. This policy explains how we process your personal data in accordance with Colombian Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015).

1. Data controller

Garden of Arcana, Colombia. Legal name, tax ID (NIT), address and habeas data email address: to be completed by the controller before publication.

2. What data we process

  • Account data: name, email address, WhatsApp number and country.
  • Request data: name; date, time and place of birth; area of life; question; context; names of the people involved; and your partner's details when the service requires them. We ask for this information before payment and store it from the first step of the form, even if you do not go on to pay.
  • Source of your visit: the site or ad that brought you here (for example, Instagram or Google), the page where you landed, and your browser's time zone and language.
  • Photos of your palms and your dominant hand (palm readings only).
  • Order and payment data (no card details, which are processed by the payment gateway).
  • Minimal technical security data (IP address and logs kept for 30 days).

3. Purposes

  • To create and manage your account and your purchases.
  • To prepare and deliver your readings, rituals and digital products.
  • To keep you updated on the status of your readings by email and, if you authorize it, by WhatsApp.
  • To send you news and discounts, only if you authorize it (you may withdraw this authorization at any time).
  • To analyze, in aggregate form, which readings people are interested in and which audiences they appeal to (age, sign, area of life, approximate country and source of the visit) in order to guide our advertising. We do not use unpaid forms to contact you or to send you advertising.
  • To comply with legal and accounting obligations, and to prevent fraud.

4. Sensitive data

A photo of your palm may be considered biometric data, and your question may reveal information about your health, sex life or beliefs. For this reason:

  • We ask for your explicit and separate authorization before you send photos. Providing sensitive data is optional: you are not required to do so.
  • We use this data only to prepare your reading and never to train automated systems or for any other purpose.
  • Photos are re-encoded when we receive them (their metadata, including location, is removed), stored encrypted, and seen only by the assigned expert reader.

5. “Instant” readings and the automated system

Readings in the “Instant” option are not written by a person: they are generated by an automated system within a few minutes, based on the meanings of our deck and the details you give us in the form. To do this, we send the technology provider of that automated system only the data needed for the reading, under an alias and without your email address or phone number. This transfer is made solely to provide the service. If you would rather have your reading written by a person, choose the “With an expert” option.

6. Retention periods

  • Hand photos: automatically deleted 90 days after the reading is delivered.
  • Question and birth details: 24 months or until you request their deletion.
  • Forms that did not end in a payment: automatically anonymized after 12 months.
  • Orders and payments: for as long as accounting regulations require.
  • Technical logs: 30 days.

7. Your rights (ARCO)

You have the right to access, update, correct and delete your data, to revoke your authorization and to request proof of it. From My account you can:

  • View and update your personal data under “Personal details”.
  • Download all your data with “Export my data”.
  • Delete your account with “Delete my account”: we erase your photos, birth details, questions, email address and phone number, and we keep the order and its amount, with no data that identifies you, as required by accounting obligations.
  • Revoke your marketing consent by unchecking the box under “Personal details”.

You can also write to the habeas data email address. We answer inquiries within a maximum of 10 business days and complaints within a maximum of 15 business days. If you are not satisfied with the response, you may contact Colombia's Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio).

8. Security

We use encrypted connections, passwords stored with secure key derivation functions, photo encryption, and role-based restricted access with audit logging.

9. Changes

If we change this policy, we will let you know on the site and by email before the changes take effect.