property-management-network/app/(marketing)/privacy/page.tsx

import { LegalPage, Section, Callout, LegalContact } from "@/components/marketing/legal"
import { LEGAL, SUBPROCESSORS } from "@/lib/legal"

export const metadata = {
  title: "Privacy Policy",
  description:
    "How we collect, use, share, and protect personal data, and the privacy rights available to you under the GDPR and California law.",
  alternates: { canonical: "/privacy" },
}

export default function Page() {
  return (
    <LegalPage
      title="Privacy Policy"
      subtitle="This policy explains what personal data we process, why, how we protect it, and the rights you may exercise."
    >
      <Section heading="Introduction and scope">
        <p>
          <strong>{LEGAL.service}</strong> (the <strong>Service</strong>) is operated by{" "}
          <strong>{LEGAL.entity}</strong> (<strong>we</strong>, <strong>us</strong>, or{" "}
          <strong>our</strong>). This Privacy Policy describes how we handle personal data when you
          (the account holder, referred to as <strong>you</strong> or the{" "}
          <strong>Customer</strong>&mdash;typically a landlord or property manager) use the Service,
          and how we handle personal data relating to a <strong>Tenant</strong>, meaning an end user
          whose data the Customer manages within the Service.
        </p>
        <p>
          We act in two distinct roles. We are the <strong>controller</strong> of the account and
          profile data that relates to your use of the Service. We are a <strong>processor</strong>{" "}
          of the property, unit, Tenant, lease, and financial records that the Customer enters,
          because the Customer determines the purposes and means of that processing. Our processing
          of that data on the Customer&rsquo;s behalf is governed by our{" "}
          <a href="/dpa">Data Processing Addendum</a>.
        </p>
      </Section>

      <Section heading="Information we collect">
        <p>We collect the following categories of information:</p>
        <ul>
          <li>
            <strong>Account and profile data</strong>&mdash;such as your name, email address,
            password credentials, organization details, and preferences.
          </li>
          <li>
            <strong>Portfolio data you enter</strong>&mdash;property, unit, Tenant, lease, rent,
            maintenance, and expense records that the Customer creates or uploads to the Service.
          </li>
          <li>
            <strong>Payment metadata</strong>&mdash;billing information processed through Stripe.
            Stripe handles card details directly; we never receive or store full card numbers.
          </li>
          <li>
            <strong>Usage and device or log data</strong>&mdash;such as IP address, browser type,
            device information, pages accessed, and timestamps generated when you use the Service.
          </li>
          <li>
            <strong>Cookies and similar technologies</strong>&mdash;as described in our{" "}
            <a href="/cookie-policy">Cookie Policy</a>.
          </li>
        </ul>
      </Section>

      <Section heading="How we use information">
        <p>We use personal data to:</p>
        <ul>
          <li>Provide, operate, maintain, and improve the Service;</li>
          <li>Process billing, subscriptions, and payments through Stripe;</li>
          <li>Protect the Service through security monitoring and fraud prevention;</li>
          <li>Respond to support requests and communicate with you about your account;</li>
          <li>
            Generate optional AI insights when you choose to use AI features (described below); and
          </li>
          <li>Comply with legal obligations and enforce our agreements.</li>
        </ul>
      </Section>

      <Section heading="Legal bases for processing">
        <p>
          Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal
          bases:
        </p>
        <ul>
          <li>
            <strong>Performance of a contract</strong>&mdash;to provide the Service you have signed
            up for and to administer your account and billing.
          </li>
          <li>
            <strong>Legitimate interests</strong>&mdash;to secure, maintain, and improve the Service
            and to prevent fraud and abuse, provided such interests are not overridden by your
            rights.
          </li>
          <li>
            <strong>Consent</strong>&mdash;where you have given it, for example when you choose to use
            optional features such as AI insights or optional sign-in providers.
          </li>
          <li>
            <strong>Legal obligation</strong>&mdash;to comply with applicable laws, including the
            retention of certain financial records.
          </li>
        </ul>
      </Section>

      <Section heading="AI processing">
        <p>
          When you choose to use AI features, the relevant portfolio data is sent to{" "}
          <strong>OpenAI</strong> on a per-request basis in order to generate the requested insight.
          That data is <strong>not used to train models</strong>. AI features are optional: if you do
          not use them, no portfolio data is transmitted to OpenAI. See our{" "}
          <a href="/subprocessors">sub-processors</a> page for further detail.
        </p>
      </Section>

      <Section heading="How we share information">
        <p>We share personal data only in the limited circumstances described below.</p>
        <ul>
          <li>
            <strong>Service providers and sub-processors</strong>&mdash;we engage trusted vendors to
            host, operate, and support the Service. Our current sub-processors include{" "}
            {SUBPROCESSORS.map((sp, i) => (
              <span key={sp.name}>
                <strong>{sp.name}</strong>
                {i < SUBPROCESSORS.length - 1 ? ", " : ""}
              </span>
            ))}
            . The full, current list is maintained on our{" "}
            <a href="/subprocessors">sub-processors</a> page.
          </li>
          <li>
            <strong>Legal and safety</strong>&mdash;where required to comply with law, respond to
            lawful requests, or protect the rights, property, or safety of any person.
          </li>
          <li>
            <strong>Business transfers</strong>&mdash;in connection with a merger, acquisition,
            financing, or sale of assets, subject to this policy.
          </li>
        </ul>
        <p>
          We do <strong>not</strong> sell or rent personal data.
        </p>
      </Section>

      <Section heading="International data transfers">
        <p>
          Personal data may be processed in countries other than the one in which it was collected,
          including the United States. Where we transfer personal data across borders, we rely on
          appropriate safeguards such as the <strong>Standard Contractual Clauses</strong> approved by
          the European Commission, together with supplementary measures where required.
        </p>
      </Section>

      <Section heading="Data retention">
        <p>
          We retain personal data for as long as your account remains active. Following account
          deletion, we delete or anonymize personal data within{" "}
          <strong>{LEGAL.dataDeletionDays} days</strong>, except where a longer retention period is
          required by law or for legitimate business purposes such as the retention of financial and
          tax records.
        </p>
      </Section>

      <Section heading="Security">
        <p>
          We protect personal data using encryption in transit and at rest, and we enforce access
          isolation at the <strong>application layer</strong>: every request is authenticated and
          scoped to the relevant account, so that one account cannot access another account&rsquo;s
          records. Uploaded files are stored privately and served only through authenticated,
          per-account access. We also employ authentication controls and automated bot protection on
          our sign-in forms. No method of transmission or storage is <strong>100% secure</strong>, and
          we cannot guarantee absolute security.
        </p>
      </Section>

      <Section heading="Your privacy rights">
        <p>
          Depending on where you live, you may have the following rights in relation to your personal
          data.
        </p>
        <p>
          <strong>Rights under the GDPR.</strong> If you are in the European Economic Area or the
          United Kingdom, you may request:
        </p>
        <ul>
          <li>Access to your personal data;</li>
          <li>Rectification of inaccurate or incomplete data;</li>
          <li>Erasure of your data;</li>
          <li>Restriction of processing;</li>
          <li>Portability of the data you have provided;</li>
          <li>To object to certain processing;</li>
          <li>To withdraw consent where processing is based on consent; and</li>
          <li>To lodge a complaint with a supervisory authority.</li>
        </ul>
        <p>
          <strong>Rights under California law (CCPA and CPRA).</strong> If you are a California
          resident, you may request to know, delete, and correct the personal information we hold
          about you, and to opt out of any sale or sharing of personal information. We do{" "}
          <strong>not</strong> sell or share personal information for cross-context behavioral
          advertising.
        </p>
        <p>
          To exercise any of these rights, contact us at{" "}
          <a href={`mailto:${LEGAL.privacyEmail}`}>{LEGAL.privacyEmail}</a>. We will respond within
          the timeframe required by applicable law and may need to verify your identity before acting
          on your request. For further detail on data rights, see our{" "}
          <a href="/gdpr">GDPR and Data Rights</a> page.
        </p>
      </Section>

      <Section heading="Notice to Tenants">
        <p>
          If you are a <strong>Tenant</strong>, your landlord or property manager (the{" "}
          <strong>Customer</strong>) is the <strong>controller</strong> of the data held about you
          within the Service, and we act as a <strong>processor</strong> on their behalf. Please
          direct requests to access, correct, or delete your data to the Customer who manages your
          tenancy. We will assist that Customer in responding, as set out in our{" "}
          <a href="/dpa">Data Processing Addendum</a>.
        </p>
      </Section>

      <Section heading="Children">
        <p>
          The Service is not directed to children, and we do not knowingly collect personal data from
          children. If you believe a child has provided us with personal data, please contact us so
          that we can delete it.
        </p>
      </Section>

      <Section heading="Changes to this policy">
        <p>
          We may update this Privacy Policy from time to time. When we make material changes, we will
          update the date shown above and, where appropriate, provide additional notice. Your
          continued use of the Service after an update constitutes acceptance of the revised policy.
        </p>
      </Section>

      <Callout>
        This Privacy Policy should be read together with our <a href="/terms">Terms of Service</a>,{" "}
        <a href="/cookie-policy">Cookie Policy</a>, and{" "}
        <a href="/dpa">Data Processing Addendum</a>.
      </Callout>

      <LegalContact email={LEGAL.privacyEmail}>
        {
          "If you have questions about this policy or wish to exercise your privacy rights, contact us at "
        }
      </LegalContact>
      <Section heading="Data protection contact">
        <p>
          For data-protection matters specifically, you may also contact our data protection team at{" "}
          <a href={`mailto:${LEGAL.dpoEmail}`}>{LEGAL.dpoEmail}</a>.
        </p>
      </Section>
    </LegalPage>
  )
}