{% extends "base.html" %}

{% block title %}Privacy Policy - {{ config.APP_NAME }}{% endblock %}

{% block head %}
<meta name="description" content="Privacy Policy for Padelnomics. GDPR compliant. Learn how we collect, use, and protect your data. We use Umami (cookieless analytics), Paddle (payments), and Resend (email). We never sell your personal information.">
{% endblock %}

{% block content %}
<main class="container-page py-12">
  <div class="card max-w-3xl mx-auto">
    <h1 class="text-2xl mb-1">Privacy Policy</h1>
    <p class="text-sm text-slate mb-8">Last updated: February 2026 &mdash; <a href="{{ url_for('public.privacy', lang='de') }}" style="text-decoration:underline">Datenschutzerklärung auf Deutsch</a></p>

    <div class="space-y-6 text-slate-dark leading-relaxed">

      <section>
        <h2 class="text-lg mb-2">1. Controller</h2>
        <p>The data controller responsible for processing your personal data is:</p>
        <p class="mt-2">
          Hendrik Dreesmann<br>
          c/o COCENTER, Koppoldstr. 1, 86551 Aichach, Germany<br>
          Email: <a href="mailto:hello@padelnomics.io" style="text-decoration:underline">hello@padelnomics.io</a>
        </p>
      </section>

      <section>
        <h2 class="text-lg mb-2">2. Data We Collect</h2>
        <p><strong>Data you provide directly:</strong></p>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li>Email address (required for account creation and transactional emails)</li>
          <li>Name (optional, for personalisation)</li>
          <li>Financial planning inputs (court counts, budgets, timelines — stored in your scenarios)</li>
          <li>Feedback messages submitted via the site feedback form</li>
        </ul>
        <p class="mt-3"><strong>Data collected automatically:</strong></p>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li>Aggregated, anonymised page-view data via Umami (no IP address stored, no cross-site tracking)</li>
          <li>Session cookie to keep you signed in</li>
        </ul>
        <p class="mt-3"><strong>Data collected at checkout (by Paddle, our payment processor):</strong></p>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li>Payment card details, billing address, and VAT number (processed exclusively by Paddle; we never see raw card data)</li>
        </ul>
      </section>

      <section>
        <h2 class="text-lg mb-2">3. Legal Basis for Processing</h2>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li><strong>Contract performance (Art. 6(1)(b) GDPR)</strong> — account management, delivering the Service, processing payments</li>
          <li><strong>Legitimate interests (Art. 6(1)(f) GDPR)</strong> — fraud prevention, service security, aggregate analytics to improve the platform</li>
          <li><strong>Legal obligation (Art. 6(1)(c) GDPR)</strong> — retaining transaction records for tax purposes</li>
          <li><strong>Consent (Art. 6(1)(a) GDPR)</strong> — functional/A-B test cookies (where opted in); marketing communications (where opted in)</li>
        </ul>
      </section>

      <section>
        <h2 class="text-lg mb-2">4. Service Providers (Sub-processors)</h2>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li><strong>Umami</strong> (self-hosted on our own infrastructure) — cookieless, privacy-first analytics. No personal data transferred to third parties.</li>
          <li><strong>Paddle</strong> (paddle.com, UK/USA) — payment processing and subscription management. Paddle acts as merchant of record. See <a href="https://www.paddle.com/legal/privacy" target="_blank" rel="noopener" style="text-decoration:underline">Paddle's Privacy Policy</a>.</li>
          <li><strong>Resend</strong> (resend.com, USA) — transactional email delivery (magic links, receipts). Data is transferred under Standard Contractual Clauses. See <a href="https://resend.com/legal/privacy-policy" target="_blank" rel="noopener" style="text-decoration:underline">Resend's Privacy Policy</a>.</li>
        </ul>
      </section>

      <section>
        <h2 class="text-lg mb-2">5. Data Retention</h2>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li>Account data: retained while your account is active; deleted within 30 days of account deletion</li>
          <li>Financial scenarios: deleted with your account on request</li>
          <li>Transaction records: retained for 10 years to meet German commercial and tax law obligations (§ 257 HGB, § 147 AO)</li>
          <li>Feedback: retained for up to 2 years for product improvement purposes</li>
        </ul>
      </section>

      <section id="cookies">
        <h2 class="text-lg mb-2">6. Cookies</h2>
        <p>You can manage your preferences at any time via the "Manage Cookies" link in the footer.</p>

        <p class="mt-3 font-semibold text-sm">Essential (always active)</p>
        <ul class="list-disc pl-6 mt-1 space-y-1">
          <li><strong>session</strong> — Keeps you signed in. Secure, HttpOnly, SameSite=Lax. Expires after 30 days of inactivity.</li>
          <li><strong>cookie_consent</strong> — Stores your cookie preferences. Expires after 1 year.</li>
          <li><strong>lang</strong> — Stores your preferred language (en/de). Expires after 1 year.</li>
        </ul>

        <p class="mt-3 font-semibold text-sm">Functional (require consent)</p>
        <ul class="list-disc pl-6 mt-1 space-y-1">
          <li><strong>ab_*</strong> — Assigns you to an A/B test variant to help us improve the site. Expires after 30 days. Only set if you accept functional cookies.</li>
        </ul>

        <p class="mt-3 font-semibold text-sm">Payment (checkout only)</p>
        <ul class="list-disc pl-6 mt-1 space-y-1">
          <li><strong>Paddle.com cookies</strong> — Set by our payment provider only on pages where you initiate a purchase. Strictly necessary for processing payments. See <a href="https://www.paddle.com/legal/privacy" target="_blank" rel="noopener" style="text-decoration:underline">Paddle's Privacy Policy</a>.</li>
        </ul>

        <p class="mt-3">We use <a href="https://umami.is" target="_blank" rel="noopener" style="text-decoration:underline">Umami</a> (self-hosted) for analytics. Umami is cookieless and does not track individual users across sessions or store IP addresses.</p>
      </section>

      <section>
        <h2 class="text-lg mb-2">7. Your Rights (GDPR)</h2>
        <p>Under the GDPR, you have the following rights:</p>
        <ul class="list-disc pl-6 mt-2 space-y-1">
          <li><strong>Access</strong> — request a copy of your personal data (Art. 15)</li>
          <li><strong>Rectification</strong> — correct inaccurate or incomplete data (Art. 16)</li>
          <li><strong>Erasure</strong> — request deletion of your data, subject to legal retention obligations (Art. 17)</li>
          <li><strong>Restriction</strong> — restrict processing in certain circumstances (Art. 18)</li>
          <li><strong>Portability</strong> — receive your data in a machine-readable format (Art. 20)</li>
          <li><strong>Objection</strong> — object to processing based on legitimate interests (Art. 21)</li>
          <li><strong>Withdraw consent</strong> — where processing is based on consent, withdraw it at any time without affecting prior lawful processing</li>
        </ul>
        <p class="mt-3">To exercise any of these rights, contact us at <a href="mailto:hello@padelnomics.io" style="text-decoration:underline">hello@padelnomics.io</a>. We will respond within 30 days.</p>
        <p class="mt-3">You also have the right to lodge a complaint with your national supervisory authority. In Germany, the competent authority is the <a href="https://www.bfdi.bund.de" target="_blank" rel="noopener" style="text-decoration:underline">Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)</a>.</p>
      </section>

      <section>
        <h2 class="text-lg mb-2">8. International Transfers</h2>
        <p>Resend processes data in the USA. Transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission. Paddle operates under UK GDPR with an adequacy finding. Umami runs on our own EU-based infrastructure — no data leaves the EU.</p>
      </section>

      <section>
        <h2 class="text-lg mb-2">9. Changes to This Policy</h2>
        <p>We may update this policy periodically. We will notify you of significant changes via email or a prominent notice within the Service. The date at the top of this page reflects the most recent revision.</p>
      </section>

      <section>
        <h2 class="text-lg mb-2">10. Contact</h2>
        <p>For privacy inquiries: <a href="mailto:hello@padelnomics.io" style="text-decoration:underline">hello@padelnomics.io</a></p>
      </section>

    </div>
  </div>
</main>
{% endblock %}
