Privacy Policy

Last updated: 30 October 2026

Arcana Portrait turns your photo into a one-of-a-kind tarot card. To do that, you trust us with something personal - your face, and a few things about you. This policy explains, in plain English, what we collect, why, who helps us, and the choices you have.

1. Who we are

Arcana Portrait ("we", "us", "our"), ABN 20 997 154 827, is an online business based in Melbourne, Victoria, Australia. We sell personalised digital tarot cards and printed merchandise to customers worldwide through arcanaportrait.com.

If you have any questions about this policy or your information, email us at hello@arcanaportrait.com.

2. The information we collect

Information you give us

Your photo(s) - the image you upload to create your card.
Your quiz answers - your responses to our questions, which shape the symbols, colours and meaning of your card.
Contact details - your name and email address (for example, when you request your free preview or place an order).
Order and delivery details - your shipping address and, where the courier needs it, your phone number.
Payment information - processed securely by Stripe. We never see or store your full card number.
Reviews - your rating, comments and any photo you choose to include with a review.
Messages - anything you send us by email or social media.

Information collected automatically

Device and usage information - such as your browser type, device, approximate location (from your IP address), pages visited and how you arrived at our site.
Cookies and similar technologies - see section 9.

3. How we use your information

We use your information to:

create your personalised tarot card and your "Your card, explained" guide;
send you your preview, your purchased files and order updates;
process payments and prevent fraud;
print and deliver merchandise you order;
respond to questions and provide customer support;
publish reviews you choose to submit;
send you news and offers, if you have agreed to receive them (you can unsubscribe at any time);
understand how our site is used so we can improve it; and
meet our legal, tax and accounting obligations.

We will not use your photo or quiz answers for anything other than creating and delivering your card unless you give us separate, specific permission (for example, if we ask to feature your card on our social media).

4. Your photo - our promises

Your photo matters most, so here is exactly what happens to it:

Used only to make your card. Your photo and quiz answers are sent to our AI image provider (OpenAI) to generate your card artwork.
Not used to train AI. OpenAI does not use content submitted through its business API to train its models by default. It may keep data for a limited period for safety and abuse monitoring, as set out in its own policies.
No facial recognition. We do not create facial recognition templates or biometric profiles, and we do not use your photo to identify you.
Deleted after use. We automatically delete your original uploaded photo from our systems within 30 days of your card being created. Your finished card is kept so you can download it again or order more merchandise - you can ask us to delete it at any time.
Never sold. We never sell your photo, your card or your answers.

Photos of other people: Please only upload photos of yourself, or of someone who has given you permission. If a photo includes a child under 18, you must be their parent or legal guardian.

5. How we use AI

Your card is created using generative AI based on your photo and your quiz answers. The AI produces artwork and symbolic interpretations for entertainment and creative purposes only. It does not make any decisions about you that have legal or similarly significant effects - for example, it does not affect your price, your eligibility to buy, or your access to our service. Tarot readings and card meanings are for fun and reflection, not advice.

6. Legal basis (for customers in the UK and European Economic Area)

If you are in the UK or EEA, we rely on these legal bases under the GDPR:

Contract - to create your card, process your order and deliver it.
Consent - for marketing emails, optional cookies and featuring your card or review publicly. You can withdraw consent at any time.
Legitimate interests - to keep our site secure, prevent fraud and improve our service, where those interests are not overridden by your rights.
Legal obligation - to keep financial records and comply with the law.

7. Who we share your information with

We only share what each provider needs to do its job. Our trusted service providers include:

Provider	What they do	Where
OpenAI	Generates your card artwork from your photo and answers	United States
Stripe	Processes payments securely	United States and other countries
Printful	Prints, packs and ships your merchandise	Production facilities in the US, Europe, the UK, Canada, Australia and other countries
Couriers and postal services	Deliver your order	Your country and in transit
Lovable and its hosting providers	Run our website and store your account and order data	United States and other countries
Google	Email services and website analytics (Google Analytics)	United States and other countries

We may also disclose information if required by law, to protect our rights or the safety of others, or if the business is sold or transferred (in which case this policy would continue to apply to your information).

We do not sell your personal information, and we do not share it with third parties for their own marketing.

8. International transfers

Because we use global service providers and ship worldwide, your information will be sent to and stored in countries outside Australia - including the United States - and outside your own country. We take reasonable steps to ensure these providers protect your information to a standard consistent with the Australian Privacy Principles and, for UK and EEA customers, use recognised safeguards such as standard contractual clauses.

9. Cookies

Cookies are small files stored on your device. We use essential cookies that the site needs to work, such as keeping items in your cart and securing checkout. With your permission, we also use Google Analytics cookies to understand how our site is used, such as which pages are visited and how people find us, so we can improve it. Analytics cookies are only set if you choose "Accept" on our cookie banner, and you can change your choice at any time using the "Cookie settings" link at the bottom of every page. If we add advertising cookies in future, we will update this policy and ask for your consent first. You can also control or delete cookies through your browser settings. Blocking essential cookies may stop parts of the site from working.

10. Marketing emails

If you request a free preview or sign up for updates, we may email you about your card, new products and offers. Every marketing email includes an unsubscribe link, and you can also email us to opt out. We will still send you emails about orders you have placed.

11. How long we keep your information

Uploaded photos - deleted within 30 days of your card being created.
Finished cards and quiz answers - kept while you may want to re-download or re-order, until you ask us to delete them, or for up to 2 years after your last purchase.
Order and payment records - kept for 5 years, as required by Australian tax law.
Marketing details - kept until you unsubscribe.
Reviews - kept while published, until you ask us to remove them.

12. How we protect your information

We use reputable providers with strong security, encrypted (HTTPS) connections, secure payment processing through Stripe, and restricted access to customer data. No system is completely secure, but if a data breach occurs that is likely to cause you serious harm, we will notify you and the relevant authorities as required by law.

13. Your rights and choices

Wherever you live, you can ask us to:

give you a copy of the personal information we hold about you;
correct information that is inaccurate or out of date;
delete your photo, card and other personal information (unless we need to keep it by law, such as order records); and
stop sending you marketing.

UK and EEA customers also have the right to restrict or object to certain processing, to data portability, and to withdraw consent at any time.

California and other US state residents have the right to know what we collect, to request deletion and correction, and to opt out of the sale or sharing of personal information. We do not sell your personal information or share it for cross-context behavioural advertising.

To make a request, email hello@arcanaportrait.com. We may need to confirm your identity first, and we will respond within 30 days. We will not treat you differently for exercising your rights.

14. Reviews and public content

If you leave a review or tag us on social media, the content you choose to share (including any photo) may be visible to the public. Please don't include anything you'd prefer to keep private. You can ask us to remove your review from our site at any time.

15. Children

Our site is intended for adults. You must be 18 or older to make a purchase, and we do not knowingly collect personal information directly from children under 16. If you believe a child has given us their information, please contact us and we will delete it.

16. Complaints

If you have a concern about how we have handled your information, please email us first at hello@arcanaportrait.com and we will respond within 30 days.

If you're not satisfied with our response, you can contact:

Australia: the Office of the Australian Information Commissioner (OAIC) - oaic.gov.au
UK: the Information Commissioner's Office (ICO) - ico.org.uk
EEA: the data protection authority in your country

17. Changes to this policy

We may update this policy as our business grows or the law changes. We'll post the new version here with an updated date, and if the changes are significant we'll let customers know by email.