Privacy policy

Draft pending legal review. This document was written by the La Bruja editorial team to cover the requirements of the EU General Data Protection Regulation (GDPR) and Spain's LOPDGDD, Brazil's LGPD, Colombia's Ley 1581 de 2012 and Decreto 1377 de 2013, and Mexico's LFPDPPP. It must be reviewed and approved by a lawyer before it is considered final.

1. Data controller

Controller: La Bruja ("La Bruja", "we"), operator of labrujaa.com and its applications. [Legal name, tax ID and registered address to be completed by the founder.]
Privacy contact: oraculo@labrujaa.com. If we appoint a Data Protection Officer (DPO) or an LGPD "encarregado" (art. 41) we will publish their contact details here.

2. Who this applies to and minimum age

This policy applies to anyone who visits the site, creates an account, draws a spread, calculates a natal chart or purchases a paid plan.

The service is intended for people aged 18 and over. If you are under 18 you must not register or provide personal data. We absolutely block registration by anyone under 13 and will delete any account we detect belongs to a child under that age. If you are a parent or guardian and believe a minor has given us data, contact us and we will erase it.

3. What data we process

Category	Data	Source
Account	email, name, profile picture, sign-in provider (Google or email), hashed password	You, at sign-up
Birth data	date, time and place of birth, derived coordinates and time zone, calculated zodiac sign	You, when calculating your natal chart or completing your profile
Oracle usage	the questions you ask, cards drawn, generated readings, journal entries, saved rituals	You, while using the service
Community	comments, images you upload, likes, notifications	You, when participating
Payments	Stripe or Mercado Pago customer ID, plan, amount, currency, payment status. We never store card numbers.	Stripe / Mercado Pago
Technical	IP address, device and browser type, pages visited, language, usage events, errors	Automatic (cookies and logs)
Communications	emails we send you, opens, subscription preferences	You and our email provider

Date, time and place of birth are not a "special category" of data under the GDPR, but combined they can identify you precisely. That is why time and place are optional, stored encrypted at rest and sent to third parties only for the calculation you request (see §6).

4. Why we use your data and on which legal basis

Purpose	Legal basis (GDPR art. 6 / LGPD art. 7 / Ley 1581 / LFPDPPP)
Create and manage your account, save your readings and journal	Performance of a contract (GDPR 6.1.b; LGPD 7.V)
Calculate your natal chart, horoscope and compatibility from your birth data	Performance of a contract and your express consent when you enter them (GDPR 6.1.a; LGPD 7.I; Ley 1581 art. 9; LFPDPPP art. 8)
Generate AI readings from your question	Performance of a contract (GDPR 6.1.b)
Process payments, invoice and prevent fraud	Performance of a contract and legal obligation (GDPR 6.1.b and c)
Send welcome, password-recovery and service emails	Performance of a contract
Send horoscopes and news by email	Consent, revocable at any time via the unsubscribe link
Display advertising (Google AdSense) and measure site usage	Consent via the cookie banner; legitimate interest only for cookie-less aggregate analytics
Moderate the community and keep the service secure	Legitimate interest (GDPR 6.1.f; LGPD 7.IX)
Meet tax obligations and respond to authorities	Legal obligation (GDPR 6.1.c; LGPD 7.II)

We do not make automated decisions with legal effects on you. Oracle readings are entertainment and reflection content, not profiles with legal consequences.

5. AI-generated content

Conversational readings are generated with language models operated by OpenRouter and OpenAI (see §6). To do so we send the text of your question, the cards drawn and, if you asked for it, a summary of your natal chart (planetary positions, without your name or email). We configure these services so that your data is not used to train their models to the extent their terms allow. More in our AI disclosure.

6. Who we share data with (processors)

We only share data with providers that process it on our behalf, under contract and with GDPR (art. 28) and LGPD (art. 39) safeguards:

Provider	Service	Country	Data
Vercel Inc.	hosting and CDN	USA (plus edge regions)	IP, technical logs, all site traffic
Neon (managed PostgreSQL)	database	USA/EU depending on region	all account and usage data
OpenRouter / OpenAI	AI reading generation	USA	question, cards, anonymised natal summary
Resend	email delivery	USA	email, name, message content
Cloudinary	storage of uploaded images	USA/EU	profile and comment images
Google LLC (Analytics, AdSense)	analytics and advertising	USA	cookie identifiers, truncated IP, events, subject to your consent
Microsoft Clarity	session recordings and heatmaps	USA	on-screen interactions (text masked), subject to your consent
Mercado Pago	payments in Latin America	Argentina/Brazil/etc.	payment data; we never see your card
Stripe Payments	subscriptions and payments	USA/Ireland	payment data; we never see your card

We do not sell your data or hand it to third parties for their own purposes, except where required by law or by a competent authority.

7. International transfers

Several providers are located in the United States. Transfers from the EU/EEA rely on the EU-US Data Privacy Framework where the provider is certified and otherwise on the European Commission's Standard Contractual Clauses. For Brazil (LGPD arts. 33-36), Colombia (Ley 1581 art. 26) and Mexico (LFPDPPP art. 36) we rely on contractual clauses and on your informed consent where the law requires it. You may request a copy of the applicable safeguards.

8. How long we keep data

Data	Retention
Account, readings, journal, birth data	While your account is active. Deleted when you delete the account.
Inactive account	After 24 months without sign-in we will notify you and, absent a reply, delete the account.
Comments	While the account exists; deleted with it (or anonymised if someone replied).
Payment records and invoices	As long as tax law requires (up to 10 years), anonymised with respect to the deleted account.
Technical and security logs	Up to 12 months.
Cookies	See the table in the Cookie policy.

9. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction and portability (GDPR arts. 15-22), the rights in LGPD art. 18 (confirmation, access, correction, anonymisation, portability, deletion, information on sharing, and withdrawal of consent), the rights under Ley 1581 de 2012 (know, update, rectify, revoke authorisation and request deletion) and the ARCO rights under the LFPDPPP (access, rectification, cancellation and opposition).

From your account: in Settings you will find "Download my data (JSON)" and "Delete my account and my data". Deletion is immediate and irreversible.
By email: write to oraculo@labrujaa.com stating the right you are exercising and your account email. We will answer within 30 days at most (15 days under the LGPD; 10 business days for queries and 15 for complaints under Ley 1581; 20 days under the LFPDPPP).
Supervisory authority: if you believe we have not handled your request properly you may complain to the authority in your country: the AEPD (Spain) or another EEA authority, the ANPD (Brazil), the Superintendencia de Industria y Comercio (Colombia) or the INAI (Mexico).

10. Security

We use TLS encryption on all connections, bcrypt-hashed passwords, encryption at rest in the database, role-based access control, rate limiting and incident logging. No system is infallible: should a breach affect your data we will notify you and the competent authority within the legal deadlines (72 hours under the GDPR).

11. Cookies and similar technologies

We use first-party cookies (session, preferences, consent) and third-party cookies (Google Analytics, Google AdSense, Microsoft Clarity) that are only activated if you accept them in the banner. The full list, retention periods and how to withdraw consent are in the Cookie policy.

12. Changes to this policy

Any change will be published here with its update date and version number. If the change is material we will notify you by email or through a notice on the site before it takes effect.