SupaTarot Privacy Policy
한국어 원문: 개인정보 처리방침
This is a superseded version. The policy in effect is the 2026-09-15 version, which adds that a written record of the reading is kept for up to 30 days.
Your voice and what is said during a reading are sent to an AI service in the United States so the reading can happen. We do not store the raw audio. Section 3 says exactly what goes where.
1. Who processes your data
Suparain, Inc. processes personal data to provide SupaTarot. For privacy questions and to exercise your rights: help@suparain.com
2. What we process, why, and for how long
- Account and sign-in: email address, a one-way protected form of your password, a protected form of your Apple or Google identifier, sign-in and security records — to provide the account and prevent misuse, kept until you close the account.
- Adult and duplicate checks: the adult determination and a duplicate-prevention identifier — to confirm adult use and prevent duplicate benefits, kept while the account exists and for the abuse-prevention period we disclose.
- Readings: the topic you chose, the cards, the time of the reading, safety state, and an encrypted summary — to provide the service and let you revisit the reading, kept 92 days after the reading by default.
- Optional stored transcript: an encrypted transcript, only when you separately agree — to let you revisit what was said, kept up to 92 days after the reading, or until you withdraw consent.
- Payments: product, channel, a protected form of the transaction identifier, and the grant and refund record — to fulfil purchases and handle disputes, kept for the period the law requires.
- Operational security: a de-identified protected form of IP address and user agent, error and audit records — for security and incident response, kept for the minimum period per purpose.
We do not store your password in the clear, any national identification number, your legal name or date of birth in the clear, or the raw audio of the call.
3. Transfers outside Korea
We entrust the minimum necessary to the processors below, and that processing happens outside the Republic of Korea. We do not sell personal data.
| Recipient | What is transferred | Country, when, how | Purpose and retention |
|---|---|---|---|
| OpenAI, L.P. | Your voice during the reading, what is said, the cards drawn and their approved meanings, and the summary text. We do not send your account identifier — only a one-way protected value (HMAC). | United States. Streamed in real time during the reading (WebRTC), and over HTTPS when a summary or translation is requested after it ends. | Generating the AI response and the summary. Every request is sent with store: false, asking the provider not to retain it. |
| Cloudflare, Inc. | Everything listed in section 2 that we store, access logs, and outgoing email. | United States and global edge locations. Whenever the service is used. | Servers, database, file storage, and email delivery. Retention follows section 2. |
| Apple Inc. / Google LLC | Provider identifiers and tokens at sign-in; the purchase token and order number for store payments. | United States. At sign-in and at payment verification. | Authentication and payment verification, under each company's own policy. |
| NICE Payments Co., Ltd. | Order and approval details for web payments. | Republic of Korea (processed domestically). | Approving and refunding web payments, for the period the law requires. |
If you do not want these transfers, you cannot use the service: a reading passing through AI processing is what the service is. To withdraw, delete your account.
4. Destruction
When the retention period ends or the purpose is met, we delete the data in a way that makes recovery impractical. Records the law requires us to keep are stored separately by purpose and destroyed when that period ends.
5. Your rights
You may ask to access, correct, delete, or stop the processing of your personal data, withdraw consent, and delete your account. Use the settings in the service or write to help@suparain.com; we verify who you are and then act under applicable law. See Deleting your account for the steps.
6. How we protect it
We apply reasonable safeguards: least-privilege access, protected transport, encryption and one-way protection of sensitive values, separation of secrets, audit logging, and security review.
7. Children
SupaTarot is not intended for anyone under 19. The age limit is applied through the 18+ rating on the App Store and Google Play. If we learn that someone under 19 holds an account, we delete that account and the related data without delay. Tell us at help@suparain.com and we will check and act.
8. Changes
When this policy changes, we announce the effective date and the main changes in the service. Material changes follow the separate procedure applicable law requires.
9. Language
This English text is provided for users outside Korea. If the Korean and English texts differ, the Korean text governs.