Privacy Policy — aaarcana

1. Who is responsible

The website aaarcana.com is operated by Yelyzaveta Ivanova, a natural person based in the Czech Republic, under the brand name aaarcana ("aaarcana", "we", "us"). aaarcana is a brand name, not a registered company.

Yelyzaveta Ivanova is the controller of the personal data described in this policy. Contact for all privacy matters: hello@aaarcana.com. We treat this inbox as our official channel for notices and data-protection requests.

2. What we collect

Teardown request. When you send the teardown form: your website address (or that you don't have one yet), a link to an ad you run if you add one, your contact email, what you sell and your monthly ad spend range.
Emails and calls. When you write to us or work with us: your name, email address, company details and whatever you choose to share in the conversation.
Technical data. When you visit the site: your IP address, browser and device type and the pages requested. Our hosting provider records this in server logs to deliver the site and keep it secure.
Cookies. Your cookie choices, and analytics and marketing cookies only if you accept them. See our Cookie Policy.

Your website and ads are public business information. We look at them to prepare the teardown; we do not collect data about your customers.

3. Why we use it and on what legal basis

To prepare and send your teardown and reply to you — steps you asked for before a possible contract (GDPR Art. 6(1)(b)).
To deliver services you order — performance of our contract (GDPR Art. 6(1)(b)).
To keep invoices and accounting records — our legal obligations under Czech tax and accounting law (GDPR Art. 6(1)(c)).
To run a secure website and protect our legal rights — our legitimate interest (GDPR Art. 6(1)(f)).
Analytics and marketing cookies — your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.

We do not send newsletters, sell personal data or use it for automated decisions that have legal or similarly significant effects on you.

We share personal data only with providers that help us run the website and the business:

Cloudflare — hosts the website, receives the teardown form and protects the site from attacks.
Supabase — stores teardown requests in our database.
Our email provider — stores the emails we send and receive.
Google, Meta and TikTok — only if you accept analytics or marketing cookies, as described in the Cookie Policy.

These providers process data on our instructions or under their own privacy policies. We may also disclose data when the law requires it, for example to a court or public authority.

5. International transfers

Some of these providers process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on the EU–U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses.

6. How long we keep it

Teardown requests — up to 12 months after our last contact if we don't start working together, then deleted.
Client data — for the duration of the work and up to 3 years after it ends, so we can handle any claims.
Invoices and accounting records — for the periods required by Czech law, usually up to 10 years.
Server logs — for the short period our hosting provider keeps them for security.
Cookies — as listed in the Cookie Policy.

7. Your rights

Under the GDPR you can request access to, correction or deletion of your personal data, restrict or object to its processing, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect processing that happened before. To exercise these rights, write to hello@aaarcana.com. We reply within one month. We may ask you to confirm your identity before acting on a request.

You can also complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or to the supervisory authority in your EU country of residence.

8. Security

The website is served over HTTPS. We limit access to personal data to the people who need it for the work and use providers that protect data with industry-standard measures. No method of transfer or storage is completely secure, so please don't send passwords or confidential material through the form.

9. Children

The website is meant for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

10. Changes to this policy

We update this policy when our tools, services or the law change. The version number and "Last updated" date show the current version. Previous versions are available on request at hello@aaarcana.com. Our Terms of Use explain the rules for using the website.

11. Contact

Yelyzaveta Ivanova, operating as aaarcana · hello@aaarcana.com