@extends('layouts.app', ['title' => 'Privacy Policy — Rsync Studio'])

@section('content')
@php
    $legal = config('rsync-studio.legal');
    $retention = config('rsync-studio.privacy.support_retention_days', 730);
@endphp
<article class="legal-page">
    <header class="legal-head">
        <span class="eyebrow">Privacy</span>
        <h1>Privacy Policy</h1>
        <p>Last updated 9 September 2026 · Policy version {{ config('rsync-studio.privacy.policy_version') }}</p>
    </header>

    <div class="legal-intro">{{ $legal['controller_name'] }} is the data controller for personal data processed through the Rsync Studio website, licence portal and support service. We process only the information needed to sell, license, secure and support Rsync Studio.</div>

    <section><h2>Information we process</h2><p>We may process your name, email address, account credentials in hashed form, licence and activation identifiers, subscription and billing status, support requests, and technical server logs required to operate and secure the service. Rsync Studio does not send the files you sync, SSH passwords or private SSH keys to the licensing service.</p></section>

    <section><h2>Payments</h2><p>Payments and subscription checkout are handled by Paddle. Payment-card details are entered into Paddle's checkout and are not stored by Rsync Studio. We receive identifiers and subscription information needed to provision and manage your licence. Paddle acts independently for parts of its payment and tax processing and provides its own privacy information.</p></section>

    <section><h2>Why we use your information</h2><div class="legal-table"><div><strong>Contract</strong><span>Creating your account, providing licences, validating activations, managing subscriptions and delivering support you request.</span></div><div><strong>Legitimate interests</strong><span>Securing the service, preventing abuse, troubleshooting faults and maintaining reliable operational records where those interests do not override your rights.</span></div><div><strong>Legal obligations</strong><span>Records we must keep for accounting, tax, fraud prevention or other applicable legal requirements.</span></div><div><strong>Consent</strong><span>Any optional analytics or marketing storage, if introduced, is disabled until you choose to enable it through Cookie Settings.</span></div></div></section>

    <section><h2>Support requests</h2><p>Support requests are stored in our database and emailed to the configured support team. We retain resolved support tickets for up to {{ $retention }} days, unless a longer period is necessary for an unresolved dispute, security matter or legal obligation. A scheduled retention process removes eligible resolved tickets.</p></section>

    <section><h2>Licence and account records</h2><p>Licence, activation and subscription records are kept while your subscription or licence relationship is active and for a reasonable period afterwards where required for licence recovery, fraud prevention, accounting, dispute handling and legal obligations. We minimise retained data and do not use licence validation to inspect your synced files.</p></section>

    <section><h2>Who receives data</h2><p>Information may be processed by service providers that are necessary to run Rsync Studio, such as Paddle for checkout and subscription processing, our hosting/infrastructure providers, and email delivery infrastructure. We limit disclosure to what is necessary for the relevant service and require appropriate safeguards where applicable.</p></section>

    <section><h2>International transfers</h2><p>Some service providers may process information outside the UK or EEA. Where data-protection law requires it, appropriate transfer mechanisms and safeguards must be used by the relevant controller or processor.</p></section>

    <section><h2>Cookies and local storage</h2><p>Necessary cookies are used for security, authentication, sessions and your privacy preferences. Optional analytics and marketing categories default to off and must not be loaded before consent. See our <a href="{{ route('cookies') }}">Cookie Policy</a> or use <button type="button" class="link-button" data-cookie-settings>Cookie Settings</button>.</p></section>

    <section><h2>Your rights</h2><p>Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing of your personal data, request portability, and withdraw consent at any time where processing relies on consent. You also have the right to complain to the UK Information Commissioner's Office or your applicable supervisory authority.</p><p>Use the <a href="{{ route('support') }}">support form</a> and choose “Privacy / data request”. We may need to verify your identity before acting on a request.</p></section>

    <section><h2>Security</h2><p>We use access controls, TLS, password hashing, CSRF protection, rate limiting and restricted administrative access. No internet service can guarantee absolute security, so we also minimise the personal data we collect.</p></section>

    <section><h2>Contact</h2><p>Controller: <strong>{{ $legal['controller_name'] }}</strong><br>Country: {{ $legal['country'] }}<br>Privacy contact: <a href="mailto:{{ $legal['privacy_email'] }}">{{ $legal['privacy_email'] }}</a></p></section>
</article>
@endsection