Privacy policy

Who looks after your data

62.072.739 ARTHUR PERUSSINI VIANA, CNPJ 62.072.739/0001-66, located at Endereço a definir (ambiente de teste), is the controller of your personal data. For any privacy matter, including contacting our data protection officer, write to contato@sibila.website.

Data we collect

Contact: the name, the email and, if you want, the WhatsApp number given at checkout.

Purchases: product, amount, payment method, status and payment identifiers. Card and Pix account details stay with Stripe and Mercado Pago.

Readings: the question you write, the cards drawn and the interpretation generated.

Consents: your acceptance of the terms, confirmation that you are 18 or over, and your marketing permission, with the date and document version.

Technical data: IP address and approximate country, used for security, rate limiting and choosing your market. With your consent, also analytics and advertising cookies. From the link that brought you here, we keep the campaign parameters (such as utm_source) on the order and, only with your consent, the ad click identifiers (gclid and fbclid).

Why we use it and on what legal basis

Providing the service (drawing, interpreting, delivering and storing your reading, and emailing you the link): performance of a contract.

Name: to personalize the opening of your reading and the emails about it (performance of the contract).

WhatsApp: without your permission, the number only identifies the order. With your permission, we use WhatsApp and email to send you news and offers from Sibila (consent). We do not provide support or send automated messages on WhatsApp.

Billing, tax records, fraud prevention and legal defense: compliance with legal obligations and the regular exercise of rights.

Security (rate limiting, bot protection and error logging) and internal usage statistics with a pseudonymous identifier: legitimate interest, using the minimum data necessary.

Newsletters, analytics cookies and ad measurement: consent, which you can withdraw at any time.

Questions may reveal intimate matters, such as health or relationships. That is why we treat them as sensitive data: they are used only to give you the reading you asked for, with your specific consent when you submit them, under restricted access, and never for advertising.

Who we share it with

We use providers that process data on our behalf: Supabase (database and sign-in), Vercel (hosting), Anthropic (generates the interpretation and receives the question, the cards and the language, without your email or phone number), Stripe and Mercado Pago (payments), Resend (email), Meta and Google (ad measurement, with your consent), Inngest (job scheduling; receives identifiers only), PostHog (usage statistics), Sentry (error logging, without your question), Upstash (rate limiting) and Cloudflare (bot protection).

For ad measurement, Meta receives the purchase amount and encrypted matching data (email, phone number if you gave one, and country), plus your browser and IP address, only if you accepted cookies before paying. Google receives, from your browser, the amount and the order number to measure the conversion, also only with cookies accepted.

We do not sell personal data. We may disclose data when required by law or a court order.

International transfers

Some of these providers process data outside Brazil, mainly in the United States. These transfers are made to provide the service you purchased, with providers that apply security and data protection measures compatible with the LGPD (Brazil's data protection law).

How long we keep it

Questions: anonymized 180 days after the reading, unless you choose to keep your history in My data.

Cards and interpretations: for as long as your account exists.

Orders and payments: for the period required by tax law, even after your account is deleted.

Ad measurement data: deleted as soon as the purchase is reported to Meta, or within 7 days if no payment is made. The visit source stays on the order for as long as the order is kept.

Technical logs: for as long as needed for security and email support.

Your rights

You can confirm whether we process your data, access it, correct it, ask for it to be anonymized, blocked or deleted, request portability, find out who we share it with and withdraw consent, as provided in Article 18 of the LGPD.

In My data you can download a copy of your data and delete your account and readings immediately. For other requests, write to contato@sibila.website. We reply within 15 days.

In My data you can also edit your name and WhatsApp and revoke news by email and by WhatsApp separately. The unsubscribe link in the footer of our emails revokes both at once. We keep the version of the text you accepted, the date and the IP address of each consent.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD) or with the authority in your country.

Cookies

We use essential cookies for sign-in, language, security and to remember your cookie choice. Analytics and advertising cookies (such as the Meta Pixel and the Google tag) are only activated if you accept them in the cookie notice. Rejecting is as easy as accepting and does not change how the service works. You can change your choice at any time under Cookie preferences, at the bottom of the page.

Security

Data travels encrypted (HTTPS), the database enforces row-level access control and service keys stay on the server only. Technical logs do not store your question or email in plain text.

Minors

The service is not intended for anyone under 18, and we do not knowingly collect data from minors. If this happens, write to contato@sibila.website and we will delete the data.

Changes

When this policy changes, the date at the top of the page will be updated, and significant changes will be communicated by email.