Privacy Policy

Last updated: September 18, 2026

Tarot & Treasures operates this online store and website under the NysaCris brand. The Services are operated by STAN I. CRISTINA-ALEXANDRA PERSOANA FIZICA AUTORIZATA (“NysaCris”, “Tarot & Treasures”, “we”, “us”, or “our”).

This Privacy Policy describes how we may collect, use, process, store and disclose personal information when you visit or use nysacris.com, make a purchase, book or request a Service, communicate with us, or otherwise interact with NysaCris (collectively, the “Services”).

Depending on the Services offered or used, our Services may include, without limitation, personalized tarot readings, written or recorded readings, private or 1:1 sessions, digital products, courses and educational materials, oracle and manifestation-related products or experiences, event enquiries, private and professional tarot experiences, physical products where offered, and other products, content, features or Services offered from time to time.

Our online store is hosted and powered by Shopify, which enables us to provide the Services to you.

If there is a conflict between our Terms of Service and this Privacy Policy concerning the collection, processing or disclosure of personal information, this Privacy Policy applies to those privacy matters.

Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read this Privacy Policy and understand how your information may be processed as described below.

1. Personal Information We May Collect or Process

When we use the term “personal information,” we mean information that identifies you or can reasonably be linked to you or another identifiable individual.

Personal information does not include information that has been anonymized or de-identified so that it can no longer reasonably identify an individual.

Depending on how you interact with NysaCris, the Services you use, the technologies, applications and features enabled on our website, your device or browser settings, your consent choices, your location and applicable law, the personal information we may collect or process may include, without limitation, the categories described below.

Contact Information

Depending on your interaction with us, this may include:

• full name;

• email address;

• telephone number;

• billing address;

• shipping address, where applicable;

• country or region;

• other contact information you voluntarily provide.

Order and Transaction Information

Where applicable, this may include:

• products, content or Services viewed or purchased;

• tarot readings purchased or requested;

• digital products or courses purchased;

• booking information;

• event enquiries;

• products or Services placed in your cart;

• transaction and order history;

• payment status and confirmation;

• cancellations, refunds or withdrawal requests;

• information reasonably necessary to fulfil, administer or support your purchase.

Payment and Financial Information

Where a purchase or payment is made, payments may be processed through Shopify and/or applicable third-party payment providers.

Depending on the payment method and provider used, those providers may collect or process information such as payment card details, financial account information, billing information, payment authentication information and other information necessary to process or secure a transaction.

NysaCris may receive information such as transaction details, payment method, payment status, payment confirmation or other relevant transaction information without necessarily receiving or storing your complete payment-card or financial-account information.

Payment providers may process information according to their own privacy policies, terms and legal obligations.

Account Information

Where customer accounts or similar functionality are available or enabled, we may process information such as:

• account credentials;

• authentication information;

• preferences;

• settings;

• saved information;

• account activity;

• other information associated with the relevant account functionality.

Communications

Depending on how you communicate with us, we may process information contained in:

• emails;

• contact forms;

• customer-support requests;

• booking communications;

• event or professional enquiries;

• reviews or feedback;

• other correspondence or information you voluntarily provide.

Device, Technical and Usage Information

We, Shopify and relevant technology providers may automatically collect certain device, technical and usage information when you access or interact with the Services.

Depending on the technologies, features, applications and service providers used, this information may include, without limitation:

• IP address;

• browser type, version and settings;

• device type, model and characteristics;

• operating system and version;

• network and internet connection information;

• device, browser, session or other online identifiers;

• cookie identifiers and information collected through cookies and similar technologies;

• language and regional settings;

• time zone;

• approximate location information derived from information such as an IP address, where applicable;

• referring website, URL or source;

• pages, products, content or Services viewed;

• links, buttons or website features you interact with;

• dates and times of visits and interactions;

• navigation and browsing activity within the Services;

• shopping-cart and checkout interactions;

• information concerning how you arrived at or interact with the Services;

• advertising, attribution and campaign information, where applicable;

• analytics and performance information;

• error logs, diagnostic information and other technical records;

• information used to detect, investigate or prevent fraud, abuse, security threats or unauthorized activity;

• other technical, device or usage information automatically generated through your interaction with the Services or reasonably necessary to operate, secure, analyze and improve them.

The specific information collected may vary depending on your device, browser, privacy settings, consent choices, location, the Shopify features enabled on our Store, and the third-party technologies or applications used in connection with the Services.

Where required by applicable law, information collected through non-essential cookies or similar tracking technologies will be processed in accordance with your consent choices.

2. Information Used for Personalized Tarot Readings and Similar Services

Certain NysaCris Services may be personalized.

Depending on the Service selected and the information reasonably necessary to provide it, you may voluntarily provide information such as:

• your full name;

• date of birth;

• your question, topic or area of interest;

• a photograph of yourself;

• relevant contextual information;

• preferences or instructions relating to the Service;

• other information you voluntarily choose to provide.

Where applicable, we may use this information to prepare, personalize and deliver the Service you requested, administer your order and communicate with you concerning that Service.

Please provide only information reasonably necessary for your request.

If your question or request concerns another person, please avoid providing unnecessary identifying, confidential or sensitive information about that individual.

Information submitted privately in connection with a tarot reading or personalized Service is not, by itself, permission for us to publish that information, your photograph, your question, your reading or other private content as a testimonial, review or marketing material.

3. Private Sessions, Bookings and Appointments

Where booking or appointment functionality is offered, we may process information reasonably necessary to arrange, administer and provide the relevant Service.

Depending on the Service and booking method used, this may include:

• your name;

• email address;

• telephone number, where applicable;

• booking date and time;

• time zone;

• information submitted during the booking process;

• communications concerning scheduling, cancellation or rescheduling;

• information you voluntarily provide in preparation for or during the Service.

Where a third-party booking, calendar, video-meeting, communication or similar platform is used, that provider may separately collect or process information according to its own privacy policy and terms.

4. Digital Products, Courses and Digital Experiences

Where NysaCris offers digital products or Services, these may include, without limitation, courses, educational materials, downloadable products, recorded content, oracle materials, manifestation-related content, personalized digital products, automated or interactive experiences and other digital offerings introduced from time to time.

Depending on the product, platform and delivery method used, we may process information reasonably necessary to:

• process and verify your purchase;

• provide or administer access;

• deliver content;

• personalize the product where applicable;

• communicate regarding access or delivery;

• provide customer support;

• maintain transaction and other legally required records;

• operate and improve the relevant digital Service.

Where third-party platforms or technologies are used to provide or deliver digital Services, those providers may separately process information according to their own privacy policies and applicable terms.

5. Events and Professional Enquiries

NysaCris may offer tarot experiences or related Services for private or professional engagements, which may include, without limitation, private celebrations, weddings, corporate events, hotels, luxury events, brand experiences, retreats, hospitality experiences and other engagements in Romania or internationally.

If you submit an event, partnership or professional enquiry, information we may process can include:

• your name;

• company, brand, organization or venue;

• professional role, where relevant;

• email address;

• telephone number;

• event type;

• event date or proposed dates;

• event location;

• expected number of guests or participants;

• requested Services;

• travel or accommodation requirements;

• commercial, budget or proposal information you voluntarily provide;

• other information reasonably relevant to the enquiry or potential engagement.

We may use this information to respond to the enquiry, discuss availability, prepare proposals or quotations, communicate regarding the engagement and, where an engagement proceeds, administer and provide the agreed Services.

6. Sources of Personal Information

Depending on how you interact with the Services, we may collect personal information from sources including:

• Directly from you, including when you purchase or request a product or Service, request a tarot reading, book a session, purchase or access digital content, submit an event enquiry, create an account, provide feedback or communicate with us.

• Automatically through the Services, including through your device, browser, cookies and similar technologies.

• From Shopify, in connection with the operation, security, functionality, analytics, personalization and improvement of our online store, depending on the Shopify features enabled.

• From payment providers, where applicable to transactions.

• From service providers, which may include providers supporting bookings, communications, analytics, hosting, digital delivery, customer support, security, fraud prevention or other business operations.

• From business, advertising or marketing partners, where applicable and permitted by law.

• From social media or other third-party platforms, where you interact with us through those platforms or authorize relevant information to be shared.

• From other third parties, where you direct or authorize disclosure or where collection is otherwise permitted by applicable law.

Not every source listed above will necessarily apply to every customer or interaction.

7. How We May Use Personal Information

Depending on your interaction with NysaCris, the Services used and applicable law, we may process personal information for purposes including the following.

Providing and Fulfilling Services

Where applicable, this may include:

• processing purchases and payments;

• fulfilling orders;

• providing and personalizing tarot readings;

• delivering written, photographic, audio, video or other materials;

• providing digital products, courses or other digital experiences;

• administering bookings and appointments;

• responding to event and professional enquiries;

• providing physical-product fulfilment where applicable;

• communicating regarding orders and Services;

• administering eligible cancellations, withdrawals, returns or refunds;

• providing customer support.

Personalizing Products and Services

Where a product or Service is personalized, information you voluntarily provide may be used to tailor that product or Service to your request.

Depending on the Service, this may include information such as your name, date of birth, photograph, question, preferences or relevant contextual information.

Operating, Protecting and Improving NysaCris

We may process information where reasonably necessary to:

• operate and maintain the website;

• provide website functionality;

• understand use of our Services;

• troubleshoot technical problems;

• improve customer experience;

• develop or improve products, content or Services;

• maintain security;

• detect misuse or fraud;

• measure performance.

Communicating With You

Depending on your interaction with us, we may use information to:

• respond to enquiries;

• provide customer support;

• provide order or payment information;

• provide booking information;

• deliver purchased Services;

• communicate concerning event or professional enquiries;

• send important administrative, security or service-related communications.

Marketing, Analytics and Advertising

Where applicable, enabled and permitted by law, we may process information to:

• communicate about NysaCris products and Services;

• provide information concerning courses, events, launches or offers;

• understand the effectiveness of marketing;

• analyze website and campaign performance;

• measure conversions or attribution;

• personalize marketing or advertising;

• display or measure relevant advertising through Shopify or other providers.

Where consent is required by applicable law, relevant processing will be subject to your consent choices.

Security and Fraud Prevention

Where applicable, information may be processed to:

• secure the website and Services;

• authenticate accounts or transactions;

• detect suspicious activity;

• investigate or prevent fraud;

• prevent abuse or unauthorized access;

• protect NysaCris, customers and third parties;

• comply with security obligations.

Legal, Accounting, Tax and Administrative Purposes

Where necessary, we may process and retain information to:

• maintain accounting and transaction records;

• issue or maintain invoices;

• comply with tax requirements;

• comply with applicable legal or regulatory obligations;

• respond to valid legal processes or governmental requests;

• establish, exercise or defend legal claims;

• resolve disputes;

• enforce applicable terms and policies.

8. Legal Bases for Processing

Where the General Data Protection Regulation (“GDPR”) or another law requiring a legal basis applies, the legal basis used will depend on the nature and circumstances of the processing.

Depending on the processing activity, this may include:

• Performance of a contract, where processing is necessary to provide or administer a product or Service you purchased or requested.

• Compliance with a legal obligation, where processing is necessary for applicable accounting, taxation, regulatory or other legal requirements.

• Legitimate interests, where processing is reasonably necessary for purposes such as operating, protecting, administering or improving our business and those interests are not overridden by applicable rights and interests.

• Consent, where you have voluntarily agreed to particular processing and consent is the appropriate legal basis.

Different processing activities may rely on different legal bases.

Where processing is based on consent, you may withdraw your consent at any time, subject to applicable law. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

9. How We May Disclose Personal Information

Depending on the Services used, technologies enabled and applicable circumstances, we may disclose personal information to categories of recipients including:

• Shopify, which provides ecommerce infrastructure and related functionality.

• Payment and financial-service providers, where necessary to process or administer transactions.

• Technology and service providers, which may include providers supporting website functionality, hosting, bookings, communications, analytics, digital delivery, customer support, cloud services, security, fraud prevention or fulfilment.

• Professional advisers and service providers, including accounting, tax, legal or administrative providers where reasonably necessary.

• Business, advertising or marketing partners, where applicable and permitted by law.

• Authorities, regulators, courts or other parties, where disclosure is required or permitted by applicable law or valid legal process.

• Parties involved in a business transaction, restructuring, financing, acquisition, transfer or similar event, where applicable and legally permitted.

• Other parties at your direction or with your consent, where applicable.

We may also disclose information where reasonably necessary to investigate fraud or misuse, protect the Services, enforce applicable policies, establish or defend legal claims, or protect our rights or the rights and safety of customers or others.

Not every category of recipient listed above will necessarily receive information about every customer.

10. Relationship With Shopify

Our online store is hosted and powered by Shopify.

Shopify may collect and process personal information concerning your access to and use of the Services in order to provide, support, secure, personalize and improve the ecommerce services and functionality that enable our Store to operate.

Information submitted through the Store may therefore be transmitted to or processed by Shopify and relevant third parties, including entities located in countries other than the country in which you reside.

Depending on the Shopify settings and features enabled for our Store, we may also use Shopify Network Intelligence and Enhanced Services or other Shopify functionality.

Where enabled, such functionality may use information obtained from interactions with our Store together with information concerning interactions with Shopify or other Shopify merchants for purposes that may include personalization, store performance, fraud prevention, analytics, marketing measurement, advertising-related functionality and improvement of Shopify's services.

The specific Shopify processing applicable to you may depend on the Shopify features enabled, your interaction with the Services, your location, your privacy settings and applicable law.

Where Shopify processes personal information for its own purposes, Shopify may act independently with respect to that processing and may be responsible for responding to applicable privacy requests concerning its processing.

For additional information about Shopify's processing of consumer information, please review the Shopify Consumer Privacy Policy:

https://www.shopify.com/legal/privacy/consumers

Where available, you may also use the Shopify Privacy Portal to exercise privacy choices relating to Shopify's processing:

https://privacy.shopify.com/

11. Cookies and Similar Technologies

We, Shopify and relevant service providers may use cookies, pixels, tags, local storage, software development kits and other similar technologies, depending on the technologies and Services enabled.

These technologies may be used for purposes including:

• operating essential website functionality;

• maintaining security;

• remembering preferences;

• maintaining shopping-cart or checkout functionality;

• authentication;

• understanding website performance and usage;

• analytics and measurement;

• improving Services;

• fraud prevention;

• marketing, attribution or advertising where applicable and permitted.

The particular technologies used may change over time as our website, Shopify functionality and third-party integrations evolve.

Where applicable law requires consent for non-essential cookies or similar technologies, those technologies will be processed in accordance with your consent choices.

Available choices may be managed through privacy or cookie controls displayed through the Services and, where applicable, through browser or device settings.

You may be able to accept, decline or otherwise manage non-essential cookies through the cookie banner or privacy controls made available on our Store, depending on your location and the functionality enabled.

Declining or disabling certain cookies or technologies may affect some website functionality. Cookies and technologies that are strictly necessary for the operation, security or essential functionality of the Store may operate where permitted by applicable law.

12. Targeted Advertising and Privacy Choices

Depending on your location, applicable law, the technologies enabled and how you interact with the Services, you may have rights concerning targeted advertising or certain legally defined forms of sale or sharing of personal information.

Where applicable, available privacy choices may be exercised through privacy controls or data-sharing opt-out mechanisms provided through our Store.

Our Shopify data-sharing opt-out page, where available and applicable, is:

https://nysacris.com/pages/data-sharing-opt-out

Where supported and legally applicable, Shopify or other relevant technologies may recognize browser-based privacy preference signals, including Global Privacy Control.

The availability and legal effect of these mechanisms may depend on your jurisdiction, browser, device, settings and the technologies enabled on our Store.

13. Marketing Preferences

Where applicable and permitted by law, NysaCris may send promotional communications concerning products, Services, readings, digital products, courses, events, launches, offers or other relevant NysaCris content.

Depending on the communication channel and applicable law, marketing may be based on consent or another legally permitted basis.

You may unsubscribe from promotional emails using the unsubscribe mechanism provided in the relevant communication.

Opting out of promotional communications does not prevent us from sending necessary transactional, administrative or service-related communications, such as order confirmations, purchased readings, booking information, payment communications, security notices or customer-support messages.

14. Third-Party Websites, Platforms and Services

Depending on the Services offered or used, our website may contain links to or integrations with third-party websites, applications, social media platforms, booking tools, payment providers, video-meeting platforms, digital-delivery providers or other online services.

Where you interact with an independent third-party service, that provider may collect or process information according to its own privacy policy and terms.

We do not control and cannot guarantee the privacy, security or data practices of independent third parties.

Information you voluntarily make public or semi-public through third-party platforms may also be visible to other users of those platforms.

The inclusion of a third-party integration or link does not necessarily constitute endorsement of all practices of that third party.

15. International Processing and Transfers

NysaCris may serve customers internationally and may use technology, payment, ecommerce and other service providers operating internationally.

Depending on the Services used and providers involved, personal information may therefore be transferred, stored or processed outside your country of residence, including outside Romania or the European Economic Area.

Where European data-protection law applies and personal information is transferred to a country that has not been recognized as providing an adequate level of protection, appropriate transfer mechanisms or safeguards will be used where required by applicable law.

Depending on the circumstances, these may include an applicable adequacy decision, European Commission Standard Contractual Clauses or another legally recognized transfer mechanism.

16. Security

We use reasonable administrative, organizational and technical measures designed to protect personal information, taking into account the nature of the information and Services involved.

However, no website, online service, electronic transmission or data-storage method can guarantee absolute security.

We recommend that you avoid providing unnecessary confidential or highly sensitive information through unsecured communication channels.

Where customer-account functionality is available, you are responsible for taking reasonable steps to protect your account credentials and access information.

17. Retention of Personal Information

We retain personal information for periods reasonably necessary for the purposes for which it was collected or as otherwise permitted or required by applicable law.

Retention periods may vary depending on factors including:

• the category and nature of the information;

• the product or Service involved;

• whether an active customer or contractual relationship exists;

• whether information remains necessary to provide or support a Service;

• accounting and taxation requirements;

• contractual obligations;

• applicable legal or regulatory retention requirements;

• security and fraud-prevention considerations;

• dispute resolution;

• establishment, exercise or defence of legal claims.

Certain transaction, invoice, accounting or legally required records may therefore be retained after other customer information is no longer necessary.

Where appropriate and permitted by law, information that is no longer reasonably necessary may be deleted, anonymized or otherwise securely handled.

18. Your Privacy Rights and Choices

Privacy rights vary depending on your location and applicable law.

Subject to applicable conditions, exceptions and limitations, you may have rights including:

• the right to access certain personal information;

• the right to correction of inaccurate or incomplete information;

• the right to deletion in applicable circumstances;

• the right to restriction of processing;

• the right to object to certain processing;

• the right to data portability where applicable;

• the right to withdraw consent where processing is based on consent;

• rights concerning certain forms of targeted advertising, sale or sharing of personal information;

• rights relating to marketing communications;

• other privacy rights available under applicable law.

Not every right listed above necessarily applies to every individual, processing activity or jurisdiction.

You may exercise applicable rights through mechanisms available through the Services or by contacting us using the information below.

Depending on the nature of the request and applicable law, we may need to verify your identity or request additional information reasonably necessary to process your request.

Where applicable law permits an authorized representative to submit a request on your behalf, we may require appropriate evidence of that authorization.

We will respond to valid requests within the period required by applicable law.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

Where Shopify independently processes personal information, applicable privacy requests concerning Shopify's processing may also be submitted through Shopify's privacy mechanisms.

19. European Economic Area and United Kingdom

If European Economic Area or United Kingdom data-protection law applies to you, you may have rights relating to access, correction, deletion, restriction, objection, portability and withdrawal of consent, subject to applicable conditions and exceptions.

Depending on your circumstances and applicable law, you may also have the right to lodge a complaint with a competent data-protection supervisory authority.

Because the business operating NysaCris is established in Romania, its competent Romanian data-protection supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

Individuals elsewhere may also have rights to contact an applicable supervisory or regulatory authority in accordance with the law applicable to them.

20. Complaints

If you have a concern or complaint about how we collect, use, disclose or otherwise process your personal information, please contact us at nysacrisa@gmail.com so that we can review and respond to your concern.

Depending on where you live and the privacy or data-protection laws applicable to you, you may also have the right to lodge a complaint with a competent data-protection or privacy authority.

If the General Data Protection Regulation (“GDPR”) applies to you, you may have the right to lodge a complaint with a supervisory authority, including an authority in the country of your habitual residence, your place of work or the place of the alleged infringement, as applicable.

Because the business operating NysaCris is established in Romania, the competent Romanian data-protection supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

For individuals in the European Economic Area, information about the relevant national data-protection supervisory authorities is available through the European Data Protection Board (EDPB):

https://www.edpb.europa.eu/about-edpb/our-members_en

Nothing in this section limits any other administrative or judicial remedy that may be available to you under applicable law.

21. Children's Privacy

The Services are not intended for children who cannot legally provide the relevant consent or enter into the relevant transaction under applicable law.

We do not knowingly collect children's personal information in circumstances where legally required parental or guardian authorization has not been obtained.

Age requirements may differ depending on the Service offered and the law applicable to the individual.

If you are a parent or guardian and believe that a child has improperly provided personal information through the Services, please contact us so that we can review the matter and take appropriate action where required.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to:

• our products or Services;

• Shopify functionality;

• applications or integrations;

• payment or technology providers;

• business practices;

• privacy practices;

• legal or regulatory requirements.

When this Privacy Policy is updated, the revised version will be published through the Services and the “Last updated” date will be amended.

Where applicable law requires additional notice, consent or another action concerning a material change, we will take the steps required by that law.

23. Contact and Data Controller

NysaCris may serve customers internationally. However, the business operating NysaCris and responsible for the processing described in this Privacy Policy is established in Romania.

For purposes of applicable data-protection law, the data controller is:

STAN I. CRISTINA - ALEXANDRA PERSOANA FIZICA AUTORIZATA

Brand: NysaCris
Shopify store: Tarot & Treasures
Website: nysacris.com
Registered business address: B-dul Bucurestii Noi, nr. 136, Ap. 5, Parter, Sector 1, Bucuresti B, Romania
Email: nysacrisa@gmail.com

For questions concerning this Privacy Policy, our privacy practices, complaints or the exercise of applicable privacy rights, please contact us using the information above.