Privacy notice
This is what data we collect at tucodigonatal.com, what we use it for, who we share it with and how you can ask us to delete it.
Controller
Tu Código Natal, operated from Florida, United States. Contact for data matters: hola@tucodigonatal.com.
What we collect
Data you type: your name, your date of birth, the gender you want to be addressed with (optional), your email and the year of the reading.
Purchase data: the payment identifier Stripe gives us, the amount, the date, the payment status (paid, refunded, disputed) and a technical card identifier Stripe uses for fraud detection. We never receive or store the full card number.
Technical data: the IP address as a hash (the IP cannot be recovered from it), the browser type, the date and time of each request, and the result of the Cloudflare Turnstile anti-spam check.
If you answer the beta questions, we store your answers (scores and chosen options) with your order.
What we use it for
To compute and show your reading, charge you, send you the link and send it again when you ask; to prevent fraud and abuse (limits per address and per IP, a blocklist after refunds); to meet accounting and tax obligations; and, only if you ticked the box, to write to you about news of the service. You can opt out of those messages at any time by writing to hola@tucodigonatal.com.
We do not sell your data or use it for third-party advertising. We make no automated decisions with legal effects on you.
Who we share it with
We work with providers that process data on our behalf: Cloudflare (hosting, database and anti-spam check), Stripe (payments) and Resend (email delivery). All operate from the United States. We share with each only what its function needs, and Stripe also processes your payment data as a controller of its own under its privacy policy.
We may disclose data when the law requires it or to defend our rights against a claim.
Cookies
We use two first-party cookies and no third-party ones: tcn_lectura, which holds your access key to the reading (only on the reading page, not readable by scripts), and tcn_lang, which remembers the language chosen on these legal pages. Cloudflare Turnstile may use storage of its own for the anti-spam check. We use no analytics or advertising cookies.
How long we keep it
Order and reading data, for as long as your reading is available (at least 12 months) and afterwards for as long as accounting and tax obligations require. Technical security data, up to 12 months. Data from the interest form without a purchase, until you ask us to delete it or unsubscribe.
After a full refund we keep a hash (an irreversible fingerprint) of your email and card so as not to accept new purchases from the same person; that hash does not identify you on its own.
Your rights
You can ask us for a copy of your data, to correct it or delete it, and withdraw your consent to the messages. Write to hola@tucodigonatal.com from the email you bought or signed up with; we answer within 30 days at most. On deletion, the reading and the personal data of the order are removed; we keep only what the law obliges us to keep (payment records) and the blocklist hashes.
If you live in a country or state with a data protection authority, you can also lodge a complaint with it.
Minors
The service is for people aged 18 or over. If we learn that we have received data from a minor, we delete it.
Security
Access keys are stored only as hashes, connections are encrypted (HTTPS) and access to the data is limited to the person operating the service. No system is infallible; if we detect a breach that affects you, we will notify you by email.
Changes
If we change this notice, we update the date at the top of the page. If the change is material, we notify you by email if you have an active reading.