Privacy Policy & Legal Notice

🦇 The Short Version (Plain English)

📧 We collect your email for launch updates

If you join our waitlist, we store your email to notify you when the deck launches. That's it.

🤖 Your AI reading name is never stored

The nickname you enter for the daily draw is sent to the AI in real time and immediately discarded. We keep nothing.

🚫 We never sell your data

Your information is never sold, rented, or traded to third parties for advertising or any other purpose.

👨‍👩‍👧 Under 13? A parent must sign up

Children under 13 cannot sign up themselves. A parent or guardian must provide consent and their own email address.

📭 Unsubscribe any time

Every email we send includes an unsubscribe link. One click and you're off the list, permanently.

✉️ Questions? Email us

1. Who We Are

Baby Bats Tarot operates the website at babybatstarot.com. We create gothic cyberpunk tarot card decks designed for children, teenagers, and their parents. We are a sister brand to TarotBrats.com.

For all privacy inquiries, contact us at: privacy@babybatstarot.com

When we say "we," "us," or "our," we mean the operators of babybatstarot.com. When we say "you," we mean any person visiting or using this site — whether you are a parent, guardian, teenager, or adult.

2. What We Collect

We collect the minimum information necessary to operate this site. Here is exactly what we collect, when, why, and for how long:

What	When	Why	How Long
Email address	When you join the product waitlist	To notify you when the deck launches	Until deck launches + 90 days, then deleted unless you opt in to ongoing comms
First name (optional)	When you join the waitlist (optional field)	To personalise launch notification emails	Same as email above
Nickname / age bracket	When you use the AI Daily Draw feature	Sent to AI in real time to personalise your reading only	Not stored — used only for the duration of the API call, then discarded
Anonymous usage data	When you visit the site	To understand how the site is used (pages visited, device type)	Per our analytics provider's retention policy (no personally identifying data)

What we do NOT collect: payment card numbers (handled by Stripe at checkout), passwords, social media credentials, government IDs, biometric data, or any information beyond what is listed above.

3. How We Use Your Information

We use the information we collect only for the specific purposes stated at the time of collection:

Waitlist emails — to send you one notification email when the Baby Bats Tarot deck is available to purchase. We may send a small number of pre-launch updates if you have opted in.
First name — to personalise the "Hey [Name]!" greeting in launch emails.
AI draw inputs — passed to our AI provider (Anthropic) in real time to generate your reading. Not retained by us or used for any other purpose.
Analytics — to understand site traffic and improve the user experience. No personal profiles are built.

We will never use your information for targeted advertising, sell it to data brokers, or use it for any purpose not listed here without first obtaining your explicit consent.

4. 🧒 Children's Privacy (COPPA)

⚠️

This section is legally significant. Baby Bats Tarot is a "mixed audience" website — it serves both children and adults (parents buying for children). The Children's Online Privacy Protection Act (COPPA), as amended in 2025, applies to us. We take our obligations under COPPA extremely seriously.

4.1 Children Under 13 — Our Policy

We do not knowingly collect personal information directly from children under the age of 13 without verifiable parental consent. Specifically:

Children under 13 may not submit their own email address to our waitlist. A parent or guardian must do so on their behalf.
The AI Daily Draw feature includes an age selector. When a user selects the 8–12 age bracket, a parent consent screen is displayed before any name input is requested. The name is not stored in any case.
If we become aware that we have inadvertently collected personal information from a child under 13 without parental consent, we will delete it immediately.

4.2 Parental Rights Under COPPA

Parents and legal guardians of children under 13 have the following rights regarding any personal information we may hold about their child:

Right to review — You may request to see any personal information we hold about your child.
Right to correct — You may request that we correct inaccurate information.
Right to delete — You may request that we delete your child's personal information from our records. We will honour this request promptly.
Right to refuse further collection — You may withdraw consent and request we stop collecting your child's information going forward.
Right to consent to collection without consenting to disclosure — You may consent to us collecting your child's information for our own use without consenting to disclosure to third parties, except where disclosure is integral to the service (e.g. our email delivery provider).

To exercise any of these rights, contact us at privacy@babybatstarot.com. We will respond within 48 hours and resolve the request within a reasonable timeframe.

4.3 What Happens If a Child Under 13 Signs Up

If we receive a waitlist signup that we have reason to believe was submitted by a child under 13 without parental consent (e.g. a very young-sounding name with no parent context), we will:

Not process or use the submitted information.
Delete the record.
Not contact the submitter.

📋

COPPA 2025 note: The FTC's updated COPPA Rule (effective June 23 2025, full compliance by April 22 2026) requires us to maintain a written data retention policy published in this notice, obtain separate parental consent for any third-party sharing, and maintain a written information security program. This policy satisfies those publication requirements. See Section 10 for our written retention policy.

5. 🤖 AI Feature Privacy

The Baby Bats Tarot Daily Draw uses an AI language model to generate personalised tarot readings. Here is a complete disclosure of how this feature works:

5.1 What is sent to the AI

The nickname or name you type into the draw input field
The age bracket you selected (8–12, 13–17, or 18+)
The name of the randomly drawn tarot card

5.2 What is NOT stored

We do not log, store, or retain your name or age bracket on our servers.
Your input is transmitted to our AI provider's API in real time, a reading is generated and returned, and the transaction ends. Nothing persists.
We do not build user profiles from AI draw inputs.
We do not use children's AI draw inputs to train, fine-tune, or improve any AI model. This would be inconsistent with COPPA 2025 data retention requirements and is not our practice.

5.3 Our AI provider

We use Anthropic as our AI provider. Our requests are made via Anthropic's Claude API. Anthropic's API terms state that API inputs are not used to train their models by default. For Anthropic's full privacy policy, visit anthropic.com/privacy.

Our AI requests are routed through a Cloudflare Worker proxy. Cloudflare may log request metadata (timestamps, IP addresses) in accordance with their standard terms. See cloudflare.com/privacypolicy for details.

💡

Tip for extra privacy: You do not have to use your real name in the Daily Draw. Use any nickname you like — "Luna," "Bat," or just "friend" — and the reading will be just as meaningful.

6. Cookies & Tracking

We use privacy-respecting analytics only. We do not place advertising cookies, tracking pixels, or third-party ad network scripts on this site.

Our analytics provider (Plausible Analytics or Fathom Analytics — TBC at launch) collects aggregate, anonymous data such as page views, device type, and general geographic region. These tools are specifically designed to be GDPR-compliant and do not require a cookie consent banner because they do not place tracking cookies or collect personally identifying information.

We do not use Google Analytics, Facebook Pixel, or any advertising tracking technology.

Our email delivery provider (see Section 7) may place a tracking pixel in emails to record whether emails have been opened. This is standard practice for email platforms. You can disable image loading in your email client to prevent this.

7. Third Parties

We share minimal data with the following third-party providers, only as necessary to operate the site:

Provider	Purpose	Data Shared	Their Privacy Policy
Mailchimp / ConvertKit	Email delivery for waitlist notifications	Email address, optional first name	mailchimp.com/legal / convertkit.com/privacy
Anthropic	AI language model for Daily Draw readings	Nickname, age bracket, card name (real-time only)	anthropic.com/privacy
Cloudflare	API proxy, CDN, and DDoS protection	Request metadata (IP, timestamp) — standard web traffic	cloudflare.com/privacypolicy
Stripe	Payment processing (future checkout)	Payment data only — handled entirely by Stripe, never touches our servers	stripe.com/privacy
Plausible / Fathom	Privacy-respecting analytics	Anonymous aggregate data — no personal identifiers	plausible.io/privacy / usefathom.com/privacy
Hosting provider	Website hosting and delivery	Standard server logs (IP, browser type, page requests)	Per hosting provider's terms

We do not sell, rent, lease, or trade your personal information to any third party. We do not share children's personal information with third parties for targeted advertising or any non-integral purpose without separate verifiable parental consent, as required by COPPA 2025.

8. Your Rights

8.1 Rights Under COPPA (US — for children's data)

As detailed in Section 4, parents and guardians have the right to access, correct, delete, and restrict processing of their child's data. Contact us at privacy@babybatstarot.com.

8.2 Rights Under UK GDPR / Australian Privacy Act

If you are located in the United Kingdom, Australia, or the European Economic Area, you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — request correction of inaccurate or incomplete data.
Right to erasure — request deletion of your personal data ("right to be forgotten").
Right to restrict processing — request that we limit how we use your data.
Right to data portability — request your data in a machine-readable format.
Right to object — object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, withdraw it at any time (e.g. by unsubscribing from emails).

To exercise any of these rights, email privacy@babybatstarot.com. We will respond within 48 hours and resolve requests within 30 days.

8.3 Unsubscribing from Emails

Every email we send includes an unsubscribe link. You can also email us directly at privacy@babybatstarot.com to be removed from our list immediately.

9. Data Security

We implement and maintain appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. Our security measures include:

HTTPS/TLS encryption on all data transmitted to and from this website.
Email data stored with our email platform provider (Mailchimp/ConvertKit) which maintains industry-standard security practices.
AI draw inputs transmitted securely via our Cloudflare Worker proxy over encrypted connections.
No payment card data handled on our servers — all payment processing delegated to Stripe's PCI-DSS compliant infrastructure.
Access to any data we hold is restricted to authorised personnel on a need-to-know basis.

No method of internet transmission or electronic storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

📋

Written Information Security Program: We maintain a written information security program appropriate to the sensitivity of the children's personal information we process, the size and nature of our operations, and current industry standards. This satisfies the COPPA 2025 requirement for a written security program.

10. Data Retention Policy

In compliance with the FTC's 2025 COPPA amendments, we publish our complete written data retention policy here. We retain personal information only for as long as necessary to fulfil the specific documented purpose for which it was collected.

Data Type	Purpose Collected	Business Need	Deletion Timeline
Waitlist email address	Launch notification	To notify interested customers when the product becomes available	Deleted within 90 days after deck launch, unless user opts in to ongoing marketing communications
Optional first name	Email personalisation	To address notification emails personally	Deleted at same time as associated email address
AI draw inputs (name, age, card)	Real-time reading generation	Required only for the duration of the API call	Not retained — never stored by us
Anonymous analytics data	Site improvement	To understand usage patterns and improve the site	Per our analytics provider's policy — no personal identifiers retained
Transaction/order data (future)	Order fulfilment and legal compliance	Required for tax records, returns, and legal obligations	7 years from transaction date, per standard accounting requirements

Indefinite retention of personal data is not permitted under our policy. All data is reviewed periodically and deleted when its retention purpose is fulfilled.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or site features. When we make material changes, we will:

Update the "Last updated" date at the top of this page.
Where required by law, notify affected users via email.
Post a prominent notice on the site homepage for a reasonable period.

We encourage you to review this page periodically. Your continued use of the site after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

✉️

Privacy & Legal Enquiries
Email: privacy@babybatstarot.com
Response time commitment: within 48 hours for all privacy-related requests.
Resolution commitment: within 30 days for data subject rights requests.

For general enquiries: hello@babybatstarot.com

If you are a parent or guardian with concerns about your child's data, or if you believe we have inadvertently collected information from a child under 13 without your consent, please contact us immediately at privacy@babybatstarot.com. We will prioritise these requests.

If you are not satisfied with our response to a privacy concern, you may have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK, the OAIC in Australia, or the FTC in the US).

13. Terms of Use

By accessing or using babybatstarot.com, you agree to the following terms. If you do not agree, please do not use this site.

13.1 Permitted Use

This site is provided for personal, non-commercial use. You may browse the site, use the AI Daily Draw for personal reflection, and join the product waitlist. You may not:

Reproduce, distribute, or commercially exploit any content from this site without our written permission.
Attempt to scrape, reverse-engineer, or disrupt the operation of this site or its AI features.
Submit false or misleading information, including falsely representing yourself as a parent or adult.
Use this site in any way that violates applicable law.

13.2 Intellectual Property

All content on this site — including card illustrations, design, text, and the Baby Bats Tarot brand — is owned by us or our licensors and protected by copyright and trademark law. The card art, character designs, and triptych frame design are original works. Unauthorised reproduction is prohibited.

13.3 Limitation of Liability

This site and its content are provided "as is." To the fullest extent permitted by law, we disclaim all warranties, express or implied. We are not liable for any damages arising from your use of this site, including any reliance on AI-generated tarot readings. Tarot readings are for entertainment and personal reflection only.

13.4 Governing Law

These terms are governed by the laws of the applicable jurisdiction. Any disputes shall be resolved through good-faith negotiation. We reserve the right to seek injunctive relief for intellectual property infringement.

13.5 Changes to Terms

We may update these Terms of Use at any time. Continued use of the site constitutes acceptance of updated terms.

14. Disclaimer

🔮

Tarot Disclaimer: Baby Bats Tarot cards and AI readings are tools for reflection, creative thinking, and self-exploration. They are not a substitute for professional advice of any kind — medical, psychological, legal, financial, or otherwise. Baby Bats Tarot makes no claims of supernatural prediction, fortune-telling, or the ability to reveal future events. Our cards and AI-generated readings are produced for fun, personal reflection, and entertainment only.

Tarot has a rich 600-year history as a game, art form, and reflective tool. We present it in that spirit — as a beautiful, thoughtful framework for asking better questions about your life, not as a source of literal predictions or supernatural guidance.

⚖️

Legal Review Recommendation: