# Privacy Policy

**Last Updated**: December 4, 2025

## 1. Introduction

Welcome to @marseilletarot_bot ("the Bot", "we", "us", or "our"). We are committed to protecting your personal data and respecting your privacy rights. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Telegram bot service.

By using the Bot, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.

## 2. Data Controller

The Data Controller responsible for your personal data is:

**HomoLapis.ai**
Email: privacy@homolapis.ai
VAT: IT01250540315

For any questions regarding this Privacy Policy or your personal data, please contact us at privacy@homolapis.ai.

## 3. Data We Collect

When you interact with the Bot, we automatically collect and process the following personal data:

### 3.1 Mandatory Data for Service Provision
- **Telegram User ID**: Your unique Telegram identifier
- **Username**: Your Telegram username (if available)
- **Language Preference**: Your Telegram language code for automated translation
- **Questions Submitted**: The questions you ask for tarot readings
- **Tarot Readings**: The interpretations generated for you
- **Last Reading Date**: Timestamp of your most recent reading
- **Interaction Timestamps**: Date and time of your activities

### 3.2 Optional Data (Provided with Your Consent)
- **Feedback**: Your rating of reading quality (positive/negative)
- **Publication Consent**: Your explicit consent to publish your reading anonymously

### 3.3 Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

- **Legitimate Interest** (Art. 6.1.f): Service delivery, daily limit enforcement, multi-language support, and service improvement
- **Explicit Consent** (Art. 6.1.a): Anonymous publication of readings (opt-in only)

## 4. How We Use Your Data

We use your personal data for the following purposes:

### 4.1 Service Delivery
- To provide tarot card readings in response to your questions
- To deliver personalized interpretations based on traditional tarot symbolism
- To communicate with you via Telegram messages

### 4.2 Daily Limit Enforcement
- To track the number of readings per user per day
- To enforce the free tier limit (1 reading per day for non-premium users)
- To reset daily limits at midnight

### 4.3 Multi-Language Support
- To automatically detect your preferred language
- To translate bot responses using automated translation services
- To provide readings in your native language

### 4.4 Service Improvement
- To analyze feedback data (aggregated and anonymized)
- To improve reading quality and bot functionality
- To develop new features based on user preferences

### 4.5 Anonymous Publication (With Consent Only)
- To publish selected readings anonymously on https://homolapis.ai/tarot-bot
- **Only if you explicitly grant consent** via the in-bot prompt
- All published readings are fully anonymized (no user identification)

## 5. Data Retention

We retain your personal data for the following periods:

- **User Profile Data** (User ID, username, language, last reading date): **2 years** from your last interaction with the Bot
- **Reading History** (questions, cards, interpretations): **1 year** from the date of the reading
- **Feedback and Consent Data**: **2 years** from submission

After these periods, your data is automatically deleted from our systems.

### 5.1 Early Deletion
You may request early deletion of your data at any time by exercising your "Right to Erasure" (see Section 6).

## 6. Your Rights Under GDPR

As a data subject in the European Union, you have the following rights:

### 6.1 Right to Access (Art. 15)
You have the right to obtain confirmation as to whether we are processing your personal data and, if so, to access that data.

### 6.2 Right to Rectification (Art. 16)
You have the right to request correction of inaccurate or incomplete personal data.

### 6.3 Right to Erasure / "Right to Be Forgotten" (Art. 17)
You have the right to request deletion of your personal data when:
- The data is no longer necessary for the purposes for which it was collected
- You withdraw your consent (for consent-based processing)
- You object to the processing and there are no overriding legitimate grounds
- The data has been unlawfully processed

### 6.4 Right to Data Portability (Art. 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

### 6.5 Right to Object (Art. 21)
You have the right to object to processing based on legitimate interests at any time.

### 6.6 How to Exercise Your Rights
To exercise any of these rights, please send an email to **privacy@homolapis.ai** with:
- Your Telegram User ID or username
- The specific right you wish to exercise
- Any additional information to help us locate your data

We will respond to your request within **30 days** as required by GDPR Article 12.

## 7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against:
- Unauthorized or unlawful processing
- Accidental loss, destruction, or damage
- Unauthorized access or disclosure

### 7.1 Security Measures Include:
- Encrypted data transmission via Telegram's secure API
- Secure cloud storage with access controls
- Regular security audits and updates
- Limited employee access on a need-to-know basis

Despite our best efforts, no method of electronic storage is 100% secure. We cannot guarantee absolute security but commit to using industry-standard practices.

## 8. Third-Party Services

To provide our service, we use the following categories of third-party processors:

### 8.1 Telegram
We use the Telegram Bot API to communicate with you. Telegram's privacy policy applies to their platform: https://telegram.org/privacy

### 8.2 AI Services
We use artificial intelligence to:
- Generate tarot card interpretations
- Translate messages into your preferred language

### 8.3 Cloud Storage
We use secure cloud storage providers to store your data. These providers are GDPR-compliant and process data only on our instructions.

**Important**: We do not sell, rent, or share your personal data with third parties for marketing purposes.

## 9. Anonymous Publication of Readings

### 9.1 Opt-In Consent Mechanism
After receiving a tarot reading, you may be asked if you consent to anonymous publication on our website. **This is entirely optional and opt-in.**

### 9.2 What Gets Published (If You Consent)
- Your question (anonymized)
- The tarot card drawn
- The interpretation provided
- **No personal identifiers** (no User ID, username, or any information that could identify you)

### 9.3 How to Withdraw Consent
You can withdraw your publication consent at any time by:
- Contacting us at privacy@homolapis.ai
- Requesting removal of specific published readings
- Requesting removal of all your published content

Published readings will be removed within **7 business days** of your request.

## 10. Cookies

The Bot operates via Telegram and does not use cookies. However, if you visit our website (https://homolapis.ai), standard website cookies may apply. Please refer to our website's cookie policy for details.

## 11. Children's Privacy

The Bot is not intended for use by individuals under the age of **16** (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children.

If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information promptly.

## 12. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). When this occurs, we ensure adequate protection through:
- **Standard Contractual Clauses** (SCCs) approved by the European Commission
- **Adequacy Decisions** for countries deemed to provide adequate protection
- Other legally compliant transfer mechanisms

## 13. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you, as defined in GDPR Article 22.

While AI services generate tarot interpretations, these are entertainment/spiritual guidance purposes only and do not constitute decisions affecting your legal rights or similar significant impact.

## 14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features.

**How You Will Be Notified:**
- Material changes will be communicated via the Bot
- The "Last Updated" date at the top of this policy will be revised
- Continued use of the Bot after changes constitutes acceptance

We encourage you to review this Privacy Policy periodically.

## 15. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

**Email**: privacy@homolapis.ai
**Data Controller**: HomoLapis.ai
**VAT**: IT01250540315

We aim to respond to all inquiries within **5 business days**.

---

**Your Rights Summary:**

✅ Right to access your data
✅ Right to correct inaccurate data
✅ Right to delete your data
✅ Right to export your data
✅ Right to object to processing
✅ Right to withdraw consent

**Contact us anytime**: privacy@homolapis.ai