🔒 Privacy Policy

1. General information

At Mystic Oracle (hereinafter, "the Site") we respect the privacy of our visitors and we are committed to processing your personal data with the utmost diligence, transparency and security. This Privacy Policy describes what data we collect, for what purpose, on what legal basis, with whom we share it and what rights you have over it.

This site is governed by European and Spanish data protection legislation:

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR).
• Spanish Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
• Spanish Law 34/2002, on Information Society Services and Electronic Commerce (LSSI-CE).

2. Data controller

The controller responsible for processing the personal data collected through the Site is Mystic Oracle, owner of the domain oraculo.xyz. For any matter related to your data you can reach us through the contact page.

3. Personal data we collect

The Site is designed to minimize the collection of personal data. Most features (tarot readings, oracles, psychic tests) run in your browser and do not require registration or sending information to our servers.

3.1. Data you provide voluntarily

• Contact form: name, email address and message (if you decide to write to us).
• Optional data in some apps: name or question entered in tarot or oracle readings. This data is processed in your browser and is not sent to our servers.

3.2. Data collected automatically while browsing

• Technical data: IP address (anonymized in analytics), browser type, operating system, language, screen resolution, pages visited, time spent, referring site.
• Cookies and similar technologies: see our Cookie Policy for detailed information.

3.3. Data stored locally in your browser

Some features save information on your own device using localStorage (these are not cookies and are not sent to any server). For example: the history of your psychic tests, the card of the day and your visual preferences. This data never leaves your device; you can delete it at any time from your browser panel or from the history page itself.

4. Purposes of processing

Personal data is processed for the following purposes:

• Provide the service: enable browsing, readings and interactive tests.
• Respond to your inquiries: reply to messages you send through the contact form.
• Analysis and improvement: understand the aggregated behavior of visitors to improve the content, performance and usability of the Site.
• Advertising: display ads through Google AdSense (personalized or contextual advertising, depending on your consent).
• Legal compliance: comply with legal obligations, administrative or judicial requests.

5. Legal basis for processing

Each purpose is supported by a legal basis under article 6 of the GDPR:

• Consent (art. 6.1.a): for sending your contact form, analytics and advertising cookies, and personalized advertising.
• Legitimate interest (art. 6.1.f): to ensure the security of the Site, prevent fraud and assess technical performance through aggregated and anonymized data.
• Legal obligation (art. 6.1.c): when a regulation or competent authority requires specific information from us.

6. Advertising: Google AdSense

7. Web analytics

If you have consented to analytics cookies, we may use Google Analytics, also from Google Ireland Limited, to obtain aggregated data on the use of the Site. The information collected is anonymous and is not used to identify you personally. Google Analytics provides settings to anonymize the IP address and limit data retention.

8. Recipients of the data

We do not sell or transfer your personal data to third parties for commercial purposes. Your data may be shared with the following recipients strictly for the indicated purposes:

• Google Ireland Limited — for advertising (AdSense) and analytics (Analytics) services.
• Hosting provider — to host the Site. The data passes through their servers as part of the normal technical operation.
• Competent authorities — when there is a legal obligation to do so.

9. International transfers

Some of the providers we work with (Google, in particular) may process data in countries outside the European Economic Area (mainly the United States). These transfers are carried out with adequate safeguards, primarily the standard contractual clauses approved by the European Commission (Decision 2021/914) and, where applicable, the EU-U.S. Data Privacy Framework (Adequacy Decision of 10/07/2023). More information in the Google privacy policy.

10. Retention period

• Contact form data: the time necessary to resolve your inquiry and, subsequently, during the legal limitation period for any potential liabilities (generally, up to 5 years in Spain depending on the case).
• Analytics data: according to the retention periods configured in Google Analytics (by default, 14 months for user data).
• Cookies: according to the duration indicated in the Cookie Policy for each cookie.
• localStorage data: remains in your browser until you delete it.

11. Your rights

As a data subject, the GDPR grants you the following rights, which you can exercise at any time free of charge:

How to exercise them? Send a request through our contact page clearly indicating which of the rights you want to exercise. To confirm your identity we may ask you for a copy of an identification document. We will resolve your request within a maximum period of one month from its receipt, extendable to two months if the complexity justifies it.

12. Data security

We apply technical and organizational measures that are reasonable and proportionate to the risk, aimed at protecting your data against unauthorized access, alteration, loss or misuse. Among others: encrypted connection (HTTPS/TLS), system access control, backups and periodic review of providers. However, no system on the internet can guarantee absolute security; we encourage you to also take care of passwords and the device from which you access.

13. Minors

The Site is intended for people over 14 years of age (the minimum age to give consent in Spain under the LOPDGDD; in other Member States the age may range from 13 to 16 years, in accordance with art. 8 of the GDPR). If you are a minor, you must have authorization from your legal guardians to use the Site and especially to send the contact form. We do not knowingly collect data from minors without this authorization; if we detect that this has happened, we will delete it without delay.

14. Automated decisions and profiling

We do not make decisions that produce significant legal effects on you based solely on automated processing of your data. AdSense's personalized advertising, where applicable, does not produce that type of effects: it simply adapts the ads displayed to your inferred interests.

15. Third-party content

The Site may contain links to external pages. We are not responsible for the privacy practices or the content of those sites. We recommend that you review their policies before providing them with personal data.

16. Changes to this policy

We may update this Privacy Policy to adapt it to legal, case-law or operational changes of the Site itself. The "Last updated" date indicated at the top reflects the latest revision. In case of substantial changes affecting your data, we will notify you through a prominent notice on the Site.

17. Acceptance

By using the Site, you declare that you have read and understood this Privacy Policy. If you do not agree with any part of it, we ask that you do not continue browsing or send information through the contact form.

18. Contact and complaints

If you have any questions about this policy, about the processing of your data or you wish to exercise your rights, write to us from the contact page. If you consider that we are not handling your request adequately, you can file a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, or the supervisory authority of your country of residence.