<?php

require __DIR__ . '/bootstrap.php';

use KeyLair\Helpers;
use KeyLair\Settings;

$legal = Settings::legalAll();
$pageTitle = 'Privacy Policy';
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= Helpers::e($pageTitle) ?> — <?= Helpers::e(Settings::siteName()) ?></title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@500;600;700&family=Inter:wght@400;500;600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/assets/css/tokens.css">
<?= Settings::faviconTag() ?>
<style>
  body{
    background:var(--bg-void); color:var(--text-primary); font-family:var(--font-body);
    min-height:100vh; display:flex; justify-content:center; padding:48px 20px 80px;
  }
  .page{width:100%; max-width:680px;}
  .back-link{
    display:inline-flex; align-items:center; gap:6px; color:var(--text-faint);
    text-decoration:none; font-size:12.5px; margin-bottom:24px;
  }
  .back-link:hover{color:var(--text-muted);}
  h1{font-family:var(--font-display); font-size:24px; font-weight:600; margin:0 0 8px; letter-spacing:-0.01em;}
  .updated{font-size:12px; color:var(--text-faint); margin:0 0 24px;}
  h2{font-family:var(--font-display); font-size:16px; font-weight:600; margin:0 0 10px;}
  h3{font-family:var(--font-display); font-size:13.5px; font-weight:600; margin:16px 0 6px; color:var(--text-primary);}
  p{font-size:13.5px; line-height:1.65; color:var(--text-muted); margin:0 0 10px;}
  ul{margin:0 0 10px; padding-left:20px;}
  li{font-size:13.5px; line-height:1.65; color:var(--text-muted); margin-bottom:4px;}
  .card{
    background:var(--bg-panel); border:1px solid var(--line); border-radius:var(--radius-md);
    padding:22px 24px; margin-bottom:14px;
  }
  a{color:var(--signal);}
  .legal-footer{text-align:center; margin-top:20px; font-size:11.5px; color:var(--text-faint); line-height:1.6;}
</style>
</head>
<body>
<div class="page">
  <a class="back-link" href="/">
    <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M15 18l-6-6 6-6"/></svg>
    Back
  </a>

  <h1>Privacy Policy</h1>
  <p class="updated">Last updated: <?= date('F j, Y') ?></p>

  <div class="card">
    <h2>1. Controller</h2>
    <p>The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:</p>
    <p>
      <?= Helpers::e($legal['legal_company_name']) ?><br>
      <?= Helpers::e($legal['legal_street']) ?><br>
      <?= Helpers::e($legal['legal_zip']) ?> <?= Helpers::e($legal['legal_city']) ?>, <?= Helpers::e($legal['legal_country']) ?><br>
      Email: <a href="mailto:<?= Helpers::e($legal['legal_email']) ?>"><?= Helpers::e($legal['legal_email']) ?></a>
      <?php if ($legal['legal_phone'] !== ''): ?><br>Phone: <?= Helpers::e($legal['legal_phone']) ?><?php endif; ?>
    </p>
    <h3>Data protection officer</h3>
    <?php if ($legal['legal_dpo'] !== ''): ?>
    <p><?= Helpers::e($legal['legal_dpo']) ?></p>
    <?php else: ?>
    <p>No data protection officer has been appointed, as there is no legal obligation to do so. For any privacy questions, please contact us at the address above.</p>
    <?php endif; ?>
  </div>

  <div class="card">
    <h2>2. Server log files / hosting</h2>
    <p>When you visit this website, our web server automatically collects technical data transmitted by your browser, including your IP address, the date and time of the request, the page requested, the browser and operating system used, and the referrer URL. This data is used solely to operate the website securely and reliably (e.g. to detect attacks) and is not combined with other data sources. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation).</p>
  </div>

  <div class="card">
    <h2>3. Cookies</h2>
    <p>This website uses a single, strictly necessary session cookie (<code>PHPSESSID</code>), stored only for the duration of your visit and never used for tracking or advertising. It is what keeps you signed in to the admin panel across page loads, for example. Because it is strictly necessary, no separate consent is required under Sec. 25(2) No. 2 TDDDG (German Telecommunications-Digital Services-Data Protection Act).</p>
  </div>

  <div class="card">
    <h2>4. Redeeming product keys</h2>
    <p>When you use a personalized link to redeem a product key, we store the following data about that redemption:</p>
    <ul>
      <li>the platform you selected and the product you were assigned,</li>
      <li>a salted hash of your IP address, generated with a server-side secret key — your actual IP address is never stored in plain text,</li>
      <li>your browser's user agent,</li>
      <li>the date and time of the redemption.</li>
    </ul>
    <p>This data lets us guarantee each key is only ever issued once, detect abuse (e.g. automated repeat requests), and investigate the process if a dispute arises. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fraud-resistant delivery). The same IP hash is also used briefly for basic rate limiting to fend off automated requests; those records are discarded automatically after a short time.</p>
  </div>

  <div class="card">
    <h2>5. Third-party services</h2>
    <h3>Google Fonts</h3>
    <p>This website loads fonts ("Google Fonts") from Google's servers (Google Ireland Limited, Ireland). Doing so transmits your IP address to Google; we have no information on whether or for how long Google retains this data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent, high-performance presentation). More information: <a href="https://policies.google.com/privacy" target="_blank" rel="noopener">policies.google.com/privacy</a>.</p>
  </div>

  <div class="card">
    <h2>6. Admin panel accounts</h2>
    <p>For staff with access to the admin panel, we store a username, a hashed password, and — if enabled — an encrypted two-factor authentication secret. Security-relevant actions are logged together with a salted IP hash so that abuse can be investigated. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing admin access).</p>
  </div>

  <div class="card">
    <h2>7. Data retention</h2>
    <p>Personal data is kept only as long as necessary for the purpose it was collected for, or until you exercise your right to erasure and no legal retention obligation applies.</p>
  </div>

  <div class="card">
    <h2>8. Your rights</h2>
    <p>Under the GDPR, you have the right to:</p>
    <ul>
      <li>access the personal data we hold about you (Art. 15 GDPR),</li>
      <li>have inaccurate data corrected (Art. 16 GDPR),</li>
      <li>have data erased (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR),</li>
      <li>data portability (Art. 20 GDPR),</li>
      <li>object to processing based on legitimate interest (Art. 21 GDPR),</li>
      <li>lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).</li>
    </ul>
    <p>To exercise any of these rights, an informal message to the contact address above is sufficient.</p>
  </div>

  <div class="card">
    <h2>9. Data security</h2>
    <p>This website is served exclusively over a TLS-encrypted connection (HTTPS). Admin panel access can additionally be secured with two-factor authentication.</p>
  </div>

  <p class="legal-footer">
    Structure and layout are based on common German privacy policy templates, including e-recht24.de and Dr. Thomas Schwenke's Datenschutz-Generator (datenschutz-generator.de); the content itself was written independently to describe this application's actual data processing.<br>
    See also: <a href="/imprint">Imprint</a>
  </p>
</div>
</body>
</html>
