Who is responsible
Evidens ICT (Joris Eversen) Scottweg 29a 4462 GS Goes The Netherlands info@cartaserena.com Evidens ICT is the controller for the personal data processed on this site. For any question about your data, email info@cartaserena.com.
In short
Carta Serena works without an account. There are no ads, no analytics tools and no tracking pixels from third parties. Fonts and card images are served from our own server. We only process what the site needs to work: your IP address while you visit, two small cookies of our own, the readings you draw and, if you sign up, your email address. We never sell your data.
Hosting and server logs
The site runs on a server at TransIP B.V. in the Netherlands. When you visit a page, the server records technical data in log files: your IP address, the date and time, the page you requested and your browser type. We need this to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Log files are deleted automatically after 14 days.
Cloudflare
All traffic to the site passes through Cloudflare (Cloudflare, Inc., USA), which protects the site against attacks and delivers images faster. Cloudflare processes your IP address and technical request data on our behalf. Data may be transferred to the United States; Cloudflare is certified under the EU-U.S. Data Privacy Framework and has signed the EU Standard Contractual Clauses. Legal basis: legitimate interest in a secure and fast site (Art. 6(1)(f) GDPR).
Cookie “cs_vid”
A first-party cookie containing a random visitor ID, valid for one year. It keeps your daily card the same all day and lets us count visitors without counting the same person twice. It contains nothing about who you are and is never shared with third parties. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can delete it at any time in your browser; you will then simply get a new ID.
Cookie “cs_tz”
A first-party cookie containing your browser’s time zone (for example America/New_York), valid for one year. It makes your daily card change at your own midnight. It is not shared with anyone.
Session cookie
A technically necessary session cookie that keeps forms secure and remembers a question you typed on the home page while you move to a spread. It expires two hours after your last visit.
Saved readings
When you draw cards, we save the reading: the spread, the cards, the question you typed (if any), the language and your visitor ID. That way your reading stays available at its own link, which you can come back to or share. Anyone who has the link can open the reading, including your question, so please don’t put sensitive personal details in a question. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR). Readings are kept until you ask us to delete them: email the link to info@cartaserena.com and we will remove it.
Newsletter
If you sign up for the weekly card, we store your email address, the time of your signup and confirmation, and which form you used. We only send email after you confirm your address through the link in our first message (double opt-in). Emails are sent through the email service of TransIP B.V. in the Netherlands, which acts as our processor. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email or by writing to info@cartaserena.com; we then delete your address.
Your rights
You have the right to access, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. Email info@cartaserena.com and we will respond within one month. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Changes
If the site starts processing data in a new way (for example ads or a paid reading), we will update this page first. Last updated: October 2026.