Privacy Policy
Effective September 27, 2026
the operator of Lunatokkie Tarot ("we," "us") runs Lunatokkie Tarot (the "Service"). This policy explains what personal information we collect, why, how long we keep it, and the choices you have. We follow Korea's Personal Information Protection Act.
We collect only what we need to give you a Reading. We don't ask for your name, phone number, or full date of birth.
Contents
1. Information we collect
When you start a Reading
- Required
- The topic and spread you choose, and the cards drawn
- Optional
- Your question (you can leave it blank)
When you pay
- Required
- Email address and order details (order number, spread, amount, currency, time of payment)
- From Toss Payments
- Payment key, payment method, and receipt link. Toss Payments collects your card or other payment details directly — we never receive them.
When you sign in by email
- Required
- Email address and sign-in session records
Automatically, while you use the Service
- Collected automatically
- Cookies (lt_sid, lt_session), IP address, access times, browser information, and usage records
When you contact us
- Required
- Email address and your message
2. How we use it
- To provide Readings: drawing cards, writing and storing Readings, and letting you reopen them from their links
- To handle payments and refunds: approving and canceling payments, keeping transaction records, and receipts
- For accounts: email sign-in and keeping your Readings across devices
- To protect the Service: managing the free limit, preventing abuse and excessive requests, and fixing errors
- To answer questions and resolve disputes
- To improve the Service: aggregate statistics such as daily usage counts that don't identify you
We do not use your information for advertising, we do not sell it, and we do not share it for targeted advertising.
3. How long we keep it
Readings (question, cards, text)
- Kept
- Until you delete the Reading or your account. Readings left unpaid or unfinished are deleted automatically after 30 days.
Deleted Readings
- Kept
- The question and letter text are erased right away. The remaining record (Reading number, spread, and times) is used only to check payment and refund questions. It's erased after 30 days for free or unpaid Readings, and after 5 years, together with the transaction records, for paid Readings (Article 6 of the E-Commerce Act).
Account (email address)
- Kept
- Until you delete your account
Unpaid orders (checkouts you opened but didn't finish, and the email you entered)
- Kept
- Deleted automatically after 30 days
Records of contracts, cancellations, payments, and delivery (paid orders, payments, refunds, and checkout email)
- Kept
- 5 years
- Why
- Required by Korea's E-Commerce Act (Article 6) and its Enforcement Decree
Records of complaints and disputes (including your messages)
- Kept
- 3 years
- Why
- Required by Korea's E-Commerce Act (Article 6) and its Enforcement Decree
Sign-in links
- Kept
- 15 minutes (deleted as soon as they're used)
Sign-in sessions
- Kept
- 90 days (deleted when you sign out)
IP records used for the free limit and abuse prevention
- Kept
- Up to 2 days
When a retention period ends or the purpose is fulfilled, we delete the information without delay, in a way that can't be recovered. Information we must keep by law is stored separately and used only for that purpose.
4. Sharing with third parties
We don't provide your personal information to third parties, except where the law specifically requires it or when law enforcement requests it through legal procedures.
5. Service providers and international transfers
We use the service providers below to run the Service. Transfers to providers outside Korea are necessary to deliver the Service to you and are disclosed here as permitted by Article 28-8(1)(3) of Korea's Personal Information Protection Act. All transfers are encrypted in transit (HTTPS).
OpenAI, L.L.C. (United States)
- Task
- Writing the text of Readings (called by our reading engine, saju-api)
- Data
- Your question, topic, spread, the cards drawn and their orientation, and site language. We don't send your email or IP address.
- When and how
- Sent over the network each time a Reading is written
- Retention
- Under OpenAI's policy, kept for up to 30 days for abuse monitoring and then deleted. Data sent through the API is not used to train OpenAI's models.
- Contact
- privacy@openai.com (requests to access or delete data: dsar@openai.com)
Vercel Inc. (United States)
- Task
- Hosting the Service and our reading engine
- Data
- All information processed while you use the Service, including access logs
- When and how
- Sent over the network whenever you use the Service
- Retention
- Until our contract ends (access logs are kept briefly under Vercel's policy and then deleted automatically)
- Contact
- privacy@vercel.com
Upstash, Inc. (United States)
- Task
- Database (storing Readings, orders, accounts, and sessions)
- Stored in
- Japan (Tokyo data center)
- Data
- The stored information listed in section 1
- When and how
- Sent over the network whenever data is saved
- Retention
- Same as section 3
- Contact
- privacy@upstash.com
Plus Five Five, Inc. (Resend, United States)
- Task
- Sending email (sign-in links and payment receipts)
- Data
- Email address and message content (a payment receipt includes the order number, order name, amount, time of payment, payment method, and your Reading's link)
- When and how
- Sent over the network each time we send an email
- Retention
- As set by Resend's retention policy after sending
- Contact
- support@resend.com
Toss Payments Co., Ltd. (Republic of Korea)
- Task
- Processing and canceling payments
- Data
- Checkout email address, order number, order name, amount and currency, a customer identifier (a hard-to-guess value used to show the payment method you used last time first), and payment details (collected directly by Toss Payments)
- Retention
- As required by Korean law, including the Electronic Financial Transactions Act (5 years)
If you don't want your information transferred abroad, you can stop starting Readings and signing in, or delete your account. Because these transfers are essential to writing Readings and running the Service, you won't be able to use the Service without them.
6. Your rights
- You can ask to access, correct, or delete your personal information, or to stop us from processing it, at any time.
- Delete a Reading: with "Delete this reading" at the bottom of the Reading, or from My readings, one Reading at a time. Readings made without signing in can be deleted from the browser that made them. Once you clear that browser's cookies we can't tell who made them, so please delete them before clearing cookies.
- Delete your account: from My readings. Your account and email are deleted right away; only the transaction records we must keep by law are kept separately for the required period.
- For anything else, contact us by the contact details at the bottom of this site. We'll respond within 10 days.
- You can also make a request through a legal representative or someone you've authorized. We may ask for proof of authorization.
7. Children
The whole Service, including free one-card Readings and email sign-in, is only for people 14 and older. We don't knowingly collect personal information from children under 14. If we learn that we have, we delete it right away.
9. How we protect your information
- All connections are encrypted with HTTPS.
- Sign-in links and sessions are stored only as hashes, never in their original form.
- Reading links are random values that can't be guessed.
- We never store card numbers or other payment details.
- Only authorized people can open our admin pages, and we keep the number of people who handle personal information to a minimum.
10. Privacy officer
For questions, complaints, or requests about your personal information, please contact our privacy officer. We'll reply and take care of it promptly.
The name and contact details of our privacy officer will be listed here as soon as our business details are registered. Until then, please use the contact details at the bottom of the site.
11. Other places to get help
Because we are based in Korea, you can also reach out to these Korean agencies about privacy concerns:
- Personal Information Dispute Mediation Committee (www.kopico.go.kr)
- Personal Information Infringement Report Center, Korea Internet & Security Agency (privacy.kisa.or.kr)
12. Changes to this policy
This policy takes effect on September 27, 2026.
If we change it, we'll post a notice on the Service at least 7 days before the change takes effect (at least 30 days before for significant changes to your rights).