Privacy Policy

Last updated: 14 April 2026.

Data controller — Bertoproduction (tax/NIE reference Y-45-14312-R), Torrevieja, Spain — is the controller of your personal data processed through arcanaluminara.com. Contact: privacy@arcanaluminara.com.

What we process — Account data: email, name, hashed password (bcrypt), preferred language, registration date, and optional marketing consent. Reading data: the question, name and spread you submit during a consultation are sent to our interpretation provider (OpenAI) and to our voice provider (ElevenLabs) to generate the text and audio. If you are signed in, the consultation (question, cards, interpretation) is saved to your private journal, accessible only to you after login, on servers located in the European Union; you can delete any single reading or clear the entire journal at any time from the History page. In guest mode the journal stays only on your device (localStorage).

Purposes and legal bases — (a) Providing the service and fulfilling our contract with you (GDPR art. 6(1)(b)); (b) legal obligations such as accounting if payment is activated in the future (art. 6(1)(c)); (c) legitimate interests in securing the service and preventing abuse (art. 6(1)(f)); (d) consent for optional marketing (art. 6(1)(a)), revocable at any time.

Third-party processors — OpenAI, L.L.C. (United States) for reading interpretation; ElevenLabs Inc. (United States) for voice generation; Stripe Payments Europe Ltd. (Ireland) for payment processing; ChatNode (United States) for the pre-sales support chat, activated only with your consent; Google Ireland Ltd. for Google Analytics 4 in anonymised mode, activated only with your consent. Transfers outside the EEA are governed by the European Commission’s Standard Contractual Clauses. Infrastructure hosting takes place on a server located in the European Union.

Retention — Account data and readings saved in your personal journal are kept for as long as your account exists (up to the 200 most recent readings per account) and deleted within 30 days of account closure, or immediately on request, except where longer retention is legally required. External providers (OpenAI, ElevenLabs) do not reuse the content you send to train their models.

Your rights under the GDPR — You may at any time exercise the rights of access, rectification, erasure, restriction, portability, and objection, and withdraw your consent. Send a request to privacy@arcanaluminara.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — www.aepd.es).

Children — The service is not intended for persons under 16. We do not knowingly collect data from minors.

Changes — We may update this policy; any material change will be notified on this page with a new "Last updated" date.