Leon SerfatyandClaude Opus 4.8
c9968531e4
Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
90 lines
3.7 KiB
TypeScript
90 lines
3.7 KiB
TypeScript
// ============================================================================
|
|
// Central legal configuration — single source of truth for every legal page.
|
|
//
|
|
// ⚠️ REVIEW BEFORE LAUNCH: `entity`, `address`, `governingLaw`, and `forum`
|
|
// are placeholders. Set them to your real registered company, business address,
|
|
// and chosen governing-law jurisdiction, and have qualified legal counsel review
|
|
// all policy copy for your specific business and markets. These templates are a
|
|
// strong, comprehensive starting point — not a substitute for legal advice.
|
|
// ============================================================================
|
|
|
|
export const LEGAL = {
|
|
/** Product / service name shown to users. */
|
|
service: "Property Management Network",
|
|
/** Legal entity that operates the Service. Update to your registered company. */
|
|
entity: "Property Management Network",
|
|
/** Registered business address (shown on legal pages). */
|
|
address: "[Registered business address]",
|
|
|
|
// Contacts
|
|
contactEmail: "support@propertymanagement.network",
|
|
privacyEmail: "privacy@propertymanagement.network",
|
|
legalEmail: "legal@propertymanagement.network",
|
|
dpoEmail: "dpo@propertymanagement.network",
|
|
securityEmail: "security@propertymanagement.network",
|
|
|
|
// Dispute resolution — update to your actual jurisdiction.
|
|
governingLaw: "the State of Delaware, United States",
|
|
forum: "the state and federal courts located in Delaware, United States",
|
|
|
|
// Dates (update `lastUpdated` whenever a policy changes).
|
|
effectiveDate: "July 1, 2026",
|
|
lastUpdated: "July 1, 2026",
|
|
|
|
// Refund window for the Lifetime one-time plan.
|
|
lifetimeRefundDays: 14,
|
|
// How long personal data is retained after account deletion (days).
|
|
dataDeletionDays: 30,
|
|
} as const
|
|
|
|
/**
|
|
* Third parties that process personal data on our behalf. This list is the
|
|
* authoritative sub-processor register referenced by the DPA and GDPR pages.
|
|
* Keep it accurate — it reflects the actual production stack.
|
|
*/
|
|
export const SUBPROCESSORS = [
|
|
{
|
|
name: "DigitalOcean, LLC",
|
|
purpose: "Cloud hosting (App Platform), Managed PostgreSQL database, and Spaces object storage for uploaded files",
|
|
location: "United States / EU (data-center region dependent)",
|
|
},
|
|
{
|
|
name: "Stripe, Inc.",
|
|
purpose: "Payment processing and subscription billing (card data is handled by Stripe; we never store it)",
|
|
location: "United States (Standard Contractual Clauses)",
|
|
},
|
|
{
|
|
name: "SMTP2GO (SMTP2GO Ltd.)",
|
|
purpose: "Transactional and notification email delivery (SMTP)",
|
|
location: "United States / New Zealand (Standard Contractual Clauses)",
|
|
},
|
|
{
|
|
name: "OpenAI, L.L.C.",
|
|
purpose: "AI-generated insights; portfolio data is sent per request and is not used to train models",
|
|
location: "United States (Standard Contractual Clauses)",
|
|
},
|
|
{
|
|
name: "Cloudflare, Inc.",
|
|
purpose: "Bot-protection challenge (Turnstile) on authentication forms",
|
|
location: "Global edge network",
|
|
},
|
|
{
|
|
name: "Google LLC",
|
|
purpose: "Optional Google sign-in (OAuth) when a user chooses it",
|
|
location: "United States (Standard Contractual Clauses)",
|
|
},
|
|
] as const
|
|
|
|
/** All legal pages, in the order shown in the footer and cross-link nav. */
|
|
export const LEGAL_PAGES = [
|
|
{ href: "/terms", label: "Terms of Service" },
|
|
{ href: "/privacy", label: "Privacy Policy" },
|
|
{ href: "/cookie-policy", label: "Cookie Policy" },
|
|
{ href: "/acceptable-use", label: "Acceptable Use Policy" },
|
|
{ href: "/refund-policy", label: "Refund & Cancellation" },
|
|
{ href: "/dpa", label: "Data Processing Addendum" },
|
|
{ href: "/subprocessors", label: "Sub-processors" },
|
|
{ href: "/gdpr", label: "GDPR & Data Rights" },
|
|
{ href: "/disclaimer", label: "Disclaimer" },
|
|
] as const
|