Privacy Policy

O Mundo Astral("we", "our" or "Platform") is committed to protecting your privacy and handling your personal data responsibly, in accordance with Brazil's General Data Protection Law — LGPD (Law No. 13,709/2018), the European Union General Data Protection Regulation — GDPR (Regulation EU 2016/679) and other applicable rules.

This Policy describes what data we collect, how we use it, who we may share it with and what your rights are as a data subject. By using the Platform, you agree to the practices described here.

The party responsible for processing your personal data is:

We use your data for the following purposes and on the following legal bases (LGPD):

We do not sell your personal data. We may share it only in the following situations:

• Supabase: database and authentication — your data is stored on secure servers managed by Supabase Inc., encrypted at rest and in transit;
• Stripe: payment processing — subject to Stripe's Privacy Policy;
• Anthropic (Claude AI): the text of your readings is processed through Anthropic's API to generate responses. We do not send personally identifying data (name, email) to the API;
• Vercel: hosting infrastructure — technical access logs may be processed by Vercel Inc.;
• Authorities: when required by law or court order, or to protect the Platform's legal rights.

We use cookies and local storage to:

• Session: keep you signed in across pages;
• Preferences: save music player and notification settings;
• Analytics: understand how Users interact with the Platform (anonymized data);
• Marketing: the Meta (Facebook) pixel for campaign measurement, based on your implied consent when accepting these terms.

You can disable cookies in your browser, but this may affect how the Platform works.

We keep your data for as long as needed to provide the service and meet legal obligations:

• Active account: for as long as the account is active;
• After account deletion: minimal data (email, payment records) is kept for up to 5 years to meet tax and legal obligations;
• Technical logs: up to 90 days;
• Daily tips and messages (cache): content generated for the day (tarot tip, message of the day) is kept for up to 9 days and then deleted automatically — it is only a temporary cache, with no value as history;
• Daily forecasts and daily numerology: kept for up to 365 days and then deleted automatically;
• Reading history (tarot readings and ancestral knowledge conversations): kept for as long as the account exists; deleted on request, unless a legal obligation applies.

As a data subject, you have the following rights under the LGPD, which you can exercise by writing to omundoastralcontato@gmail.com:

We will respond to requests within 15 business days. If you are not satisfied with our response, you can contact Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

If you live in the European Economic Area (EEA) — including Spain and the other countries of the European Union — the processing of your personal data is also subject to the General Data Protection Regulation (GDPR, Regulation EU 2016/679).

We take technical and organizational measures to protect your data, including:

• TLS encryption for all communications;
• Password storage with a secure hash (bcrypt);
• Role-based access control (Row Level Security in the database);
• API keys and secrets stored as environment variables, never in the source code;
• Continuous infrastructure monitoring.

If a security incident affects your data, we will notify the competent authorities and the affected users within the deadlines set by the LGPD and the GDPR (72 hours for notifying supervisory authorities, where applicable).

Some of our service providers (Supabase, Stripe, Anthropic, Vercel) operate outside Brazil. These transfers are made with adequate safeguards, including standard contractual clauses and internationally recognized certifications, in accordance with art. 33 of the LGPD and the Standard Contractual Clauses provided for in the GDPR for transfers outside the European Economic Area.

The Platform is not directed at people under 18. We do not knowingly collect data from minors. If we learn that a minor's data was collected without appropriate parental consent, it will be deleted immediately.

If we identify misuse of O Mundo Astral content, the account may be suspended or closed without prior notice, even if it still has paid, unused credits, as set out in section 6.1 of the Terms of Use. That account's data continues to be handled under this Policy, including to defend the Platform's rights.

We may update this Policy from time to time. The date of the last update will always be shown at the top of the document. For significant changes, we will notify Users by email or by a notice on the Platform. Continuing to use the Platform after changes are published constitutes acceptance of the new Policy.

To exercise your rights, ask questions about this Policy or report any issue related to the privacy of your data: