Privacy Policy

Last updated: 30 October 2026

This Privacy Policy explains how BOTarot (“BOTarot”, “we”, “us”) collects, uses, shares and protects personal data when you visit botarot.com or book a private or live reading, use our free tarot, horoscope and astrology tools, read card meanings and guides, buy digital guides, courses or merch, leave a review or join our newsletter. It is written to meet the EU and UK General Data Protection Regulation (GDPR and UK GDPR), US state privacy laws including the California Consumer Privacy Act (CCPA/CPRA) and the California Online Privacy Protection Act (CalOPPA), Canada’s PIPEDA, Brazil’s LGPD, Australia’s Privacy Act and similar laws worldwide.

1. Who we are

botarot.com is run by Boryana Borisova, trading as BOTarot (the data controller). Contact us about anything in this policy at bo@botarot.com. We are a very small business and do not have a Data Protection Officer; you will reach Bo directly. Our postal address is Repton House, London E4 9AE, United Kingdom.

2. What we collect

• Contact details — your name, email address and what you write when you contact us.
• Reading details — your name, email address, date of birth or birth details if you choose to give them, the questions and background you share for a reading, messages or recordings from live chat, voice or video sessions, and your booking history.
• Order details — name, billing and delivery address, email, phone number, what you bought and your order history. Card payments are handled by our payment processors (Stripe, WooPayments and PayPal); we never see or store your full card number.
• Wallet details — your wallet balance, top-ups and the minutes you use in live readings.
• Account details — if you create an account, your login email, a securely hashed password, and your orders and bookings.
• Newsletter and reader features — your email address and preferences if you subscribe, register or answer a reader survey, including through Google Reader Revenue Manager.
• Free tool inputs — choices you make in our free tarot reading, quizzes, horoscope and birth-chart tools, used only to show you your result.
• Reviews and comments — the name, email and text you submit. Comments are checked for spam by Akismet.
• Usage and device data — pages visited, links clicked, device and browser type, IP address (which gives an approximate location), referring site and the date and time of your visit, collected through cookies and similar technologies.

3. Sensitive information in readings

Questions for a reading can touch on health, relationships, sexuality, religion or beliefs. Under data protection law this is “special category” or “sensitive” personal data. We only use it to give you the reading you asked for, on the basis of your explicit consent, which you give when you book and choose to share it. You never have to share sensitive details to get a reading, and you can withdraw your consent and ask us to delete your reading details at any time. We do not use reading content for advertising, profiling or to train AI.

4. How and why we use your data (legal bases)

Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see “Your rights”). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Cookies and similar technologies

We use essential cookies to run the site, accounts, wallet, cart and checkout, and optional cookies for analytics and advertising only where you allow them. You can change your choices at any time through Google’s consent message (Google Privacy & messaging). Full details, including a list of cookies, are in our Cookie Policy.

6. Who we share data with

We share personal data only with service providers that help us run BOTarot, under contracts that require them to protect it, and only as much as they need:

• Our web hosting provider
• WordPress and WooCommerce plugins we use, including Akismet (spam filtering) by Automattic
• Google (Analytics, Tag Manager, Search Console, Site Kit, Google for WooCommerce, Reader Revenue Manager, AdSense advertising, Google Fonts, consent management)
• Stripe, WooPayments and PayPal (payments)
• Printful (making and shipping merch) and delivery couriers
• Make.com (automating booking confirmations and notifications), our email and newsletter provider, and the video, voice and chat tools used for live readings
• YouTube, when you watch or join a live reading or play an embedded video
• Professional advisers (such as an accountant) and authorities where the law requires it

We do not sell your personal data for money, and we never share your reading questions with advertisers. However, under some US state laws, letting Google use cookies to show personalised ads counts as “selling” or “sharing” personal data for “targeted advertising”. You can opt out at any time — see our US State Privacy Notice.

7. International transfers

Some of our providers, including Google, Stripe, PayPal, Make.com and Printful, process data outside your country, including in the United States. Where the law requires it, we rely on adequacy decisions (such as the EU–US Data Privacy Framework and the UK Extension), Standard Contractual Clauses or the UK International Data Transfer Addendum.

8. How long we keep your data

• Reading questions and session notes: up to 12 months after your reading, unless you ask us to delete them sooner
• Enquiries: up to 2 years after our last contact
• Orders, wallet, invoices and payment records: for as long as tax and accounting rules require (usually 6 years)
• Newsletter: until you unsubscribe
• Analytics data: 14 months
• Reviews and comments: until you ask us to remove them
• Accounts: until you close your account

9. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy (access)
• correct it if it is wrong
• delete it
• give it to you, or another business, in a portable format
• restrict or stop using it, or object to how we use it
• stop sending you marketing
• withdraw any consent you gave, at any time (this does not affect what we did before)
• opt out of “sale”, “sharing” and targeted advertising (US) — see our US State Privacy Notice

Email bo@botarot.com to use any of these rights. We may ask you to confirm your identity. We reply within one month (GDPR) or 45 days (US state laws), and we never charge you or treat you differently for using your rights. If you are not happy with our answer you can appeal by replying to us, and you can complain to your data protection authority — for example the ICO in the UK, your national authority in the EU, the California Privacy Protection Agency or your state Attorney General in the US, or the Office of the Privacy Commissioner in Canada or Australia.

10. Do Not Track and Global Privacy Control

Browsers’ older “Do Not Track” setting has no agreed standard, so we do not respond to it. We do honour Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser.

11. Security

The site uses HTTPS encryption. We use strong passwords, two-factor authentication where available, regular updates and trusted providers. No system is perfectly secure; if a breach affects your data in a way that puts you at risk, we will tell you and the authorities as the law requires.

12. Children

botarot.com is not aimed at children and readings are only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you think a child has given us their data, email us and we will delete it.

13. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we will tell you on the site or by email.

14. Contact

Questions or requests: bo@botarot.com. See also our Cookie Policy, US State Privacy Notice, Terms of Service and all our policies.