Privacy Policy

Effective date: 29 October 2026

Who is responsible for your information

Madame Margo is operated by Tatiana Istomina, an individual based in Montenegro.

Website: https://madam-margo.com
Privacy contact: support@madam-margo.com

Your private Tarot question stays private

You do not type or submit the private question, person, or situation you are thinking about.

For reading generation, the application uses your selected theme, its fixed question, and the drawn cards, positions, and orientations. Your unspoken thoughts are not collected or sent to the AI provider.

Checkout and support are separate: they may require contact, billing, or transaction information.

Reading and application information

The application stores information needed to generate, deliver, recover, and troubleshoot readings. This includes:

• Reading identifiers, the selected theme and fixed question.
• Drawn cards, their positions and orientations.
• Generated reading text, execution status, and timestamps.
• A pseudonymous browser-session reference and request identifiers used to prevent duplicate generation.
• Technical diagnostics and, where available, model and prompt versions, token usage, processing time, and estimated generation cost.

These records are not necessarily anonymous. For example, a reading reference may become associated with you when you contact support.

Subscriber accounts and billing

If you use Weekly Magic Pass, we store your normalised email address, its verification status, account identifier and account timestamps. We also keep authentication and abuse-prevention records. Verification codes expire after 10 minutes and are stored as keyed hashes, not as readable codes. Session tokens are stored as hashes.

Subscription records include Dodo customer, subscription and payment references, subscription status and billing-period information. A credit ledger records grants, reservations, use, releases and any reviewed adjustments. These records link your account to its credits and saved readings, prevent duplicate grants and support recovery, refunds and disputes.

Your email address is used for sign-in and subscriber checkout. It is not added to the Tarot-generation request.

Browser storage

The application uses a session cookie and browser storage to support reading creation and recovery, prevent duplicate attempts, and reduce repetition of ritual invitations.

The anonymous reading-session cookie lasts up to 24 hours. Subscriber sign-in uses a separate secure, HttpOnly cookie with a session lasting up to 30 days, unless expired or signed out. Browser storage also keeps an attempt reference and recent ritual invitation identifiers. Cookie expiry does not mean the corresponding database records have been deleted.

Clearing browser storage or losing the relevant recovery information may affect access to a saved reading.

Service providers

Cloudflare provides website hosting, application infrastructure, and database storage. It also processes network information necessary to deliver and protect the service.

OpenAI processes the generation instructions and the selected theme, fixed question, and drawn card information to produce the reading. Your unspoken private question is not included.

Brevo sends the transactional email containing your sign-in code. It receives the destination email address and the code/message needed to deliver that email. These are sign-in emails, not marketing emails.

Dodo Payments provides checkout and acts as Merchant of Record where applicable. It processes information required for payment, billing, tax, transaction security, and legal compliance. Payment card details are handled through its checkout rather than the Tarot-reading interface.

The payment integration uses the transaction references and payment status needed to connect a successful single purchase with its reading, or a subscription payment with its account and reading-credit grant. Subscription management and cancellation use the Dodo Customer Portal.

Support messages are processed through our email forwarding and inbox providers. Please do not send payment card details or unnecessary sensitive personal information.

Providers process information under their own applicable terms and privacy policies. Processing may take place outside your country.

Why information is used

Information is used to fulfil purchases, generate and deliver readings, restore access, prevent duplicate processing and misuse, investigate technical problems, respond to support requests, and meet applicable legal obligations.

Where applicable data-protection law requires a legal basis, these purposes rely on performing the purchase agreement, legitimate operational interests, or compliance with legal obligations.

Retention

Reading and application records are stored to support delivery, recovery, troubleshooting, security, and the handling of customer requests.

There is currently no fixed automatic deletion schedule for these records. Subscription cancellation does not automatically delete the account, unused credits or their supporting ledger. These records support continued credit use and recovery. Privacy/deletion requests are reviewed separately, including any records that must be retained for legal or operational reasons. Retention depends on the purpose of the information, continuing operational needs, and applicable legal obligations. Saved readings are not guaranteed to remain available permanently.

Payment records, support correspondence, and records held by service providers are separate from reading records. They may need to be retained for different periods, including for accounting, tax, fraud prevention, disputes, and other legal requirements. Deleting an application record does not automatically delete records independently held by a payment or infrastructure provider.

Privacy requests

You may contact support@madam-margo.com to request access, correction, or deletion where applicable, or to ask about how your information is used.

Include a reading or payment reference if available, but do not send your full payment card details. We may need sufficient information to verify that the request concerns your records.

Some information may need to be retained where required or permitted by applicable law. Where applicable, you may also raise a concern with the relevant data-protection authority.

Instagram integration

Madame Margo Engagement is an internal integration for our own Instagram professional account, @margo_madame. It is used for limited authorised comment-reading tests and offline response-draft preparation. Automatic comment replies, Instagram Direct access and messaging, and engagement webhooks are not active.

For these tests, Meta provides our connected account identifier, username, owned media identifiers and details, and comment data available through the granted permissions. A selected comment may include its identifier, text, timestamp, author identifier or username, and its relationship to a Reel or reply thread. We use this information to identify the correct account and content, moderate engagement, prevent duplicate processing, and prepare relevant drafts. Reading a public comment does not make a person a registered website customer.

The account owner's Instagram access token is encrypted in Cloudflare D1 using AES-256-GCM. Decryption credentials are kept separately as service secrets. The token is not placed in public pages, operational notifications or reports. Operational records retain limited status, permission, expiry and deduplication information. Selected content used for local draft preparation is held in access-restricted storage on the operator's Mac. Our operational Telegram alerts are designed to exclude comment text, private messages and credentials.

No paid AI service is used to generate Instagram comment drafts in this integration. Existing website reading generation is a separate feature described above. Instagram Direct has not been connected: our integration does not currently retrieve private messages. Any future messaging integration would require separate account authorisation and an update to this policy before activation. Please do not send sensitive information in public comments.

Instagram comment data and thread context stored in Cloudflare D1 are automatically deleted after 30 days without activity in the thread. A new comment or stored response activity restarts this period for the thread. Cleanup checks run hourly; eligible records are removed during a subsequent cleanup run. A thread being processed is checked again after its processing lock ends. Deletion covers stored comment text, drafts, related message history and thread context. OAuth credentials and limited operational test receipts are separate from comment history. Selected local test drafts on the operator’s Mac are not covered by the D1 automatic cleanup; deletion requests can include these records. Token expiry or removal of an Instagram authorisation does not by itself delete records already retained. Requests concerning retained data are handled individually using the Data Deletion Instructions. We will not delete information held independently by Meta or other providers through this process.

Meta provides Instagram account authorisation and API data; Cloudflare provides the integration's server and encrypted database storage. If the operator uses Codex (OpenAI) to review selected comments or drafts, that selected content is processed in the operator’s existing Codex workspace. This is distinct from an automated AI API reply service, which is not active for Instagram engagement. These uses are separate from publication scheduling through Buffer. See the instructions below for privacy requests; do not send passwords, access tokens or verification codes.