Privacy policy

Last updated: May 24, 2026

This Privacy Policy explains how tarotcards.io ("we," "us," "our") collects, uses, and protects your information when you visit our store or place an order.

Information we collect

When you visit our store, place an order, or sign up for marketing, we may collect:

Identity and contact information: name, email address, shipping and billing address, phone number (if provided)
Payment information: processed directly by our payment providers (Shopify Payments, Stripe, PayPal). We do not store or have access to your full card details.
Order information: items purchased, order value, currency, fulfillment details
Device and browsing data: IP address, browser type, operating system, pages viewed, referring URL, and similar technical information collected automatically via cookies and analytics tools
Marketing preferences: if you sign up for our email list or interact with marketing campaigns

How we use your information

We use your information to:

Process and fulfill your orders
Communicate with you about orders, shipping, and customer support
Send marketing emails (only if you've opted in, and you can unsubscribe at any time)
Improve our website, products, and customer experience
Detect and prevent fraud
Comply with legal obligations

Who we share information with

We share information only with service providers necessary to operate our store:

Shopify — our e-commerce platform (hosting, checkout, order management)
Printful — our production and fulfillment partner (receives shipping address and order details to produce and ship your items)
Payment processors — Shopify Payments, Stripe, and PayPal handle all payment transactions
Shipping carriers — USPS, DHL, FedEx, and local postal services receive shipping details to deliver your order
Email marketing platform — if you opt in to our newsletter (e.g., Shopify Email, Klaviyo, Mailchimp)
Analytics and advertising platforms — Google Analytics, Google Ads, Meta (Facebook/Instagram) Pixel, TikTok Pixel, and Pinterest Tag may be used to understand traffic and run advertising
Legal authorities — when required by law, court order, or to protect our rights

We do not sell your personal information to third parties.

Cookies

We use cookies and similar technologies to operate the site, remember your cart, analyze traffic, and (with your consent where required) personalize advertising. You can control cookies through your browser settings, and EU/UK visitors can manage consent through the cookie banner on our site.

Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data ("right to be forgotten")
Object to or restrict certain processing
Withdraw consent for marketing at any time
Data portability
Lodge a complaint with your local data protection authority

EU/UK residents have these rights under GDPR. California residents have these rights under CCPA/CPRA, including the right to opt out of the sale or sharing of personal information (note: we do not sell personal information).

To exercise any of these rights, email mark@tarotcards.io. We will respond within 30 days.

Data retention

We keep order and customer data for as long as necessary to fulfill orders, comply with tax and accounting obligations (typically 7 years), and resolve any disputes. Marketing data is kept until you unsubscribe.

Data security

We rely on Shopify's enterprise-grade security infrastructure, which includes encryption in transit (SSL/TLS) and PCI-DSS compliant payment handling. No system is 100% secure, but we take reasonable steps to protect your information.

Children

Our store is not intended for users under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top indicates when it was last revised. Material changes will be communicated via email or a notice on our site.