Privacy Policy
Version 1.1.0
1. Overview
This Policy explains how Grimorius processes personal data. We apply data minimization and collect what is needed to operate accounts, payments, Oracles, Tarot, support, security and legal obligations.
2. Controller
The data controller is the legal entity identified at checkout, in the Terms and official support channels.
3. Account data
We may process name, email, phone/WhatsApp, language, date of birth, authentication records and technical security data. Date of birth also supports the 18+ restriction.
4. Grimoire content
Intentions/Calls, Oracles, Tarot questions, notes and support tickets can contain information freely provided by the user. The service does not require a particular religion, but text can reveal or imply religious beliefs or other sensitive categories.
5. Sensitive data
Where users voluntarily submit sensitive data, processing is limited to the purposes described in the specific highlighted consent. Users can avoid such data and may withdraw consent subject to lawful retention needs.
6. Purposes
Data is used to operate accounts, isolate tenant data, generate Oracles and PDFs, perform readings, manage Mana, deliver support, process billing, prevent abuse, meet legal obligations, export data and retain evidence of legal acceptance.
7. AI providers
If external AI is enabled, only necessary context is sent for requested generation. An Oracle-linked Tarot reading uses that Oracle context rather than the full account history.
8. Payments
Payments may be processed by Stripe or another provider disclosed at checkout. Grimorius does not need to store full card numbers.
9. Sharing
We do not sell Oracle content to advertisers. Data is shared only with operational providers, when required by law, to protect rights or under valid user instruction.
10. Retention
Data is retained while the account is active and afterwards as necessary for legal obligations, fraud prevention and defense of rights. Oracle content without a legal retention need may be deleted or anonymized in response to a valid request.
11. Security
Controls include tenant isolation, strong password hashing, prepared statements, CSRF protection, HttpOnly sessions and access controls. No system can guarantee absolute security.
12. Data-subject rights
Users can correct profile data, export account data and request deletion/anonymization. Other applicable statutory rights can be exercised through support.
13. Logs
IP addresses, user agents, webhooks, triggers and security records may be retained for auditing and security. They are not used to assign spiritual meaning.
13.1. Moderation events
To prevent abuse and flooding and to preserve service integrity, we record technical events from the pre-check of each request: a user/session identifier, the check decision, a reason code, a timestamp and a technical digest (hash) of the normalized content. We avoid storing the full text of declined requests solely for moderation, preferring the hash and the minimal metadata required. These events are kept for a limited period under the retention policy and used for security, fraud/abuse prevention and applying temporary limits on new consultations.
14. Minors
Grimorius is not intended for people under 18.
15. International processing
Infrastructure, AI and payment providers may process data outside Brazil. Applicable transfer safeguards will be used where required.
16. Changes
This Policy is versioned. Material changes will be communicated or submitted for renewed acceptance when required.