Privacy Policy

Data controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Paper Planner
c/o IP-Management #7999
Ludwig-Erhard-Straße 18
D-20459 Hamburg
info@houseoftarot.world

Your rights as a data subject

You have the right, at any time, to request information about your stored personal data (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to request erasure (Art. 17 GDPR), to request restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and to object to processing (Art. 21 GDPR). You can exercise the access/portability and erasure rights yourself directly under "My account" (see next section); for anything else, just get in touch via the email address above or the contact form. You also have the right to lodge a complaint with a data protection supervisory authority.

Self-service: data & account deletion

Logged-in users can, at any time, download their stored data as a JSON file under "My account" (account details, ratings, wishlist, collection, own contact inquiries) and delete their account themselves, permanently. Both work instantly, without having to submit a separate request.

Hosting & server log files

When you visit this website, the web server automatically collects technical data transmitted by your browser (including IP address, date and time of the request, page requested, referrer URL, browser type). These server log files serve the technical operation and security of the website (Art. 6 (1)(f) GDPR, legitimate interest in stable and secure operation) and are not combined with other data sources.

Cookies

Session cookie (strictly necessary)

A session cookie keeps you logged in during a visit. It is automatically deleted when you close your browser and is required for the site to function (Art. 6 (1)(b) GDPR, or legitimate interest, Art. 6 (1)(f) GDPR).

"Keep me signed in" cookie (strictly necessary)

If you enable "keep me signed in" during login, we store an additional cookie pair so you don't have to request a new login link on your next visit. The legal basis is Art. 6 (1)(b) GDPR (performance of the usage contract). This cookie is valid for up to 30 days and can be removed at any time by logging out.

Visitor counting (visitor_id cookie)

For a rough, anonymous visitor statistic (number of visitors per period, shown in the admin area), we set a randomly generated, non-personal cookie (visitor_id). It contains no IP address and no other personal data, but lets us internally count returning visits. Since this cookie is not strictly necessary and serves statistical purposes, we only set it after you consent via the cookie banner (§25 TTDSG, Art. 6 (1)(a) GDPR). You can change your decision at any time by deleting the cookie_consent cookie in your browser settings (the banner will then appear again).

Country selection (country_override cookie)

If you manually select a country via the footer country switcher without logging in, we remember that for up to 180 days in a cookie (country_override) so we can show you relevant affiliate offers without asking again on every page. Without a manual selection, no cookie is set — instead we estimate your country just for the current request based on your browser's language setting. You can reset the selection to "Auto-detected" via the switcher at any time.

Registration & login (magic link)

To log in, we only need your email address. We process it to send you a one-time login link and to manage your account (including language preference and the timestamps of registration and last login). The legal basis is Art. 6 (1)(b) GDPR (performance of the usage contract). No password is stored.

Choose your Country

You can optionally provide your country under "My account", or — without logging in — via the country switcher in the footer. We use this to show you relevant affiliate offers/shops for your country (e.g. Amazon.de instead of Amazon.com). If you're logged in and have saved a country under "My account", that takes priority. Without login (or without a saved country), we remember a manual choice made via the footer switcher in a cookie (up to 180 days) — without a manual choice, we estimate your country automatically from your browser's language setting. The legal basis is your consent (Art. 6 (1)(a) GDPR) or our legitimate interest in showing relevant offers (Art. 6 (1)(f) GDPR); you can change this selection at any time or reset it to "Auto-detected".

If you sign up under "My account" for notifications about new decks, we first send a confirmation link to your email address (double opt-in) — you are only actually signed up once you click that link. The legal basis is your consent (Art. 6 (1)(a) GDPR). You can unsubscribe at any time under "My account" by unchecking the box, without needing to confirm again.

Contact form

If you use the contact form, we store your name, email address, and message in order to process your inquiry (Art. 6 (1)(b) or (f) GDPR). The message is additionally forwarded to us by email. We also briefly store your IP address (for a maximum of 24 hours) to limit abuse/spam through the form (rate limiting, Art. 6 (1)(f) GDPR, legitimate interest in a functional, spam-free contact form).

Ratings, wishlist & collection

When logged in, you can rate decks, add them to a wishlist, or mark them as "already owned". This information is stored linked to your account so it can be shown back to you (Art. 6 (1)(b) GDPR). A deck's average rating is publicly visible; your individual rating, wishlist, and collection are visible only to you.

Affiliate links to third parties

This site contains affiliate links (including the Amazon Associates program, Thalia.de, and Etsy). Clicking a buy button first goes through an internal counter link on our own site (to measure how often an offer was clicked, without linking it to you personally) before redirecting you to the external shop. Once you reach the external shop, its own privacy policy applies; we have no influence over data processing there.

Retention period

We retain personal data only as long as necessary for the respective purpose, or until you request deletion. Contact inquiries are deleted once processed and no longer needed. You can delete your user account yourself at any time under "My account" (see above); alternatively, you can contact us by email.

Changes to this privacy policy

We will update this privacy policy whenever data processing on this site changes (e.g. new features). It's worth checking back here occasionally.