@extends('layouts.legal')

@section('meta-title', 'Privacy Policy — ' . config('legal.app_name'))
@section('meta-description', 'How ' . config('legal.app_name') . ', built by ' . config('legal.developer_name') . ', collects, uses, and protects data for restaurant owners, staff, and their customers.')
@section('page-title', 'Privacy Policy')

@section('toc')
    <li><a href="#scope">Who this covers</a></li>
    <li><a href="#info-collected">Information we collect</a></li>
    <li><a href="#how-collected">How it's collected</a></li>
    <li><a href="#purposes">Why we use it</a></li>
    <li><a href="#disclosure">Who we share it with</a></li>
    <li><a href="#third-party">Third-party services</a></li>
    <li><a href="#advertising">Advertising</a></li>
    <li><a href="#permissions">App permissions</a></li>
    <li><a href="#cookies">Cookies &amp; sessions</a></li>
    <li><a href="#security">Security</a></li>
    <li><a href="#retention">Data retention</a></li>
    <li><a href="#deletion">Deletion &amp; your rights</a></li>
    <li><a href="#restaurant-responsibility">Restaurant responsibility</a></li>
    <li><a href="#children">Children's privacy</a></li>
    <li><a href="#international">International processing</a></li>
    <li><a href="#updates">Changes to this policy</a></li>
@endsection

@section('content')

<p id="scope">{{ config('legal.app_name') }} is a restaurant-management platform built by {{ config('legal.developer_name') }}. It's used by restaurant owners and their staff to run digital menus, QR ordering, bookings, and related tools, and by diners who scan a restaurant's QR code or order-tracking link. This policy explains what data {{ config('legal.app_name') }} collects across the owner/staff dashboard, the customer-facing menu pages, and the {{ config('legal.app_name') }} Android app, and how it's used.</p>

<h2 id="info-collected">B. Information we collect</h2>
<p>What's collected depends on how you use {{ config('legal.app_name') }}:</p>

<h3>1. Owner and staff account data</h3>
<ul>
    <li>Name, username, email, phone number</li>
    <li>Password — stored only as a one-way cryptographic hash. Nobody at {{ config('legal.developer_name') }}, including support staff, can view your actual password.</li>
    <li>Role (owner, waiter, kitchen, manager) and account status</li>
</ul>

<h3>2. Restaurant / business data</h3>
<ul>
    <li>Restaurant name, description, contact details, WhatsApp number, address</li>
    <li>Logo, cover image, menu-item photos, and other uploaded content</li>
    <li>Menu structure: categories, subcategories, items, prices, discounts</li>
</ul>

<h3>3. Customer order data</h3>
<p>Diners can place an order by scanning a restaurant's QR code — <strong>no {{ config('legal.app_name') }} account or app install is required.</strong> Placing an order collects:</p>
<ul>
    <li>Name and phone number as entered at checkout</li>
    <li>Table number (for dine-in) or delivery address (for delivery orders)</li>
    <li>Order contents, special instructions, and order amount</li>
    <li>A secure, unguessable order-tracking token used to look up order status without requiring a login</li>
</ul>

<h3>4. Booking, enquiry, lead, and review data</h3>
<p>Where a restaurant has these features enabled, customers submitting a table booking, a contact/enquiry form, or a review provide their name and, optionally, phone number, email, and free-text message or comment.</p>

<h3>5. Payment and subscription data</h3>
<p>Restaurant subscription payments and, where enabled, in-app order payments are processed by <strong>Razorpay</strong>, a third-party payment gateway. {{ config('legal.app_name') }} never receives or stores your card number, UPI ID/PIN, or bank account details — those go directly to Razorpay. {{ config('legal.app_name') }} stores only transaction references returned by Razorpay: a Razorpay order ID, a Razorpay payment ID, the amount, and the payment status (e.g. pending, paid, failed, refunded).</p>

<h3>6. Technical and security data</h3>
<ul>
    <li>IP address and browser user-agent string</li>
    <li>Login session data and login/logout/failed-login activity, recorded for account security</li>
    <li>QR-code scan activity (which QR code was scanned and when), used for restaurant analytics</li>
</ul>
<p>{{ config('legal.app_name') }} does not collect device GPS location. Where a delivery or booking address is required, it is the text the customer types in themselves, not a device location reading.</p>

<h2 id="how-collected">C. How information is collected</h2>
<ul>
    <li><strong>Directly from you</strong> — when you register, fill in a form, place an order, or upload content.</li>
    <li><strong>Automatically</strong> — technical data such as IP address and session activity, captured as part of normal request handling.</li>
    <li><strong>Via service providers</strong> — payment status updates from Razorpay.</li>
    <li><strong>Via restaurant configuration</strong> — a restaurant owner or staff member may enter customer details on a diner's behalf (e.g. taking a phone booking).</li>
</ul>

<h2 id="purposes">D. Why we use this information</h2>
<ul>
    <li>Creating and managing owner/staff accounts and authenticating logins</li>
    <li>Operating orders, bookings, staff assignments, and restaurant settings</li>
    <li>Processing subscription and (where enabled) order payments via Razorpay</li>
    <li>Customer support and responding to enquiries</li>
    <li>Detecting and preventing fraud, abuse, and unauthorised access</li>
    <li>Security auditing and activity logging</li>
    <li>Meeting legal and regulatory obligations</li>
</ul>
<p>{{ config('legal.app_name') }} does not use your data for third-party advertising or sell it to data brokers — see <a href="#advertising">Advertising</a> below.</p>

<h2 id="disclosure">E. Who we share information with</h2>
<p>We distinguish three different things people sometimes lump together as "sharing":</p>
<ul>
    <li><strong>The restaurant you're ordering from or working for</strong> can see the orders, bookings, and account data that relate to their own restaurant. {{ config('legal.app_name') }} is multi-tenant software — a restaurant cannot see another restaurant's data, and this is enforced at the database-query level, not just hidden in the interface.</li>
    <li><strong>Service providers who process data on our behalf</strong>, strictly to help operate the service: our hosting/infrastructure provider, and Razorpay for payment processing. These providers only receive what's necessary to do their job.</li>
    <li><strong>We do not sell personal data</strong>, and we have not integrated any advertising network or data-broker SDK into {{ config('legal.app_name') }} — this was verified directly in the current codebase while writing this policy.</li>
</ul>
<p>We may also disclose information: when a customer clicks a WhatsApp link to message a restaurant directly (that message goes to WhatsApp/Meta under WhatsApp's own terms, not through {{ config('legal.app_name') }}); when required by law, court order, or a valid request from a government or regulatory authority; to our professional advisors (e.g. legal, accounting) under confidentiality obligations; or to a successor entity if {{ config('legal.developer_name') }} is involved in a merger, acquisition, or asset sale, subject to that successor honouring this policy.</p>

<h2 id="third-party">F. Third-party services we actually use</h2>
<table class="legal-table-stack">
    <thead><tr><th>Service</th><th>Purpose</th><th>Data involved</th></tr></thead>
    <tbody>
        <tr><td data-label="Service">Razorpay</td><td data-label="Purpose">Subscription &amp; order payment processing</td><td data-label="Data involved">Payment amount, status, and Razorpay's own transaction IDs — never your card/UPI/bank details</td></tr>
        <tr><td data-label="Service">WhatsApp (wa.me links)</td><td data-label="Purpose">Optional, customer-initiated messaging to a restaurant</td><td data-label="Data involved">Only triggered when a customer taps a WhatsApp link themselves</td></tr>
        <tr><td data-label="Service">Google Fonts</td><td data-label="Purpose">Web font delivery for the interface</td><td data-label="Data involved">Standard font-request traffic (IP address, browser) to Google's font CDN</td></tr>
        <tr><td data-label="Service">Hosting provider</td><td data-label="Purpose">Runs the {{ config('legal.app_name') }} application and database</td><td data-label="Data involved">All data described in this policy, as required to run the service</td></tr>
        <tr><td data-label="Service">Google Play</td><td data-label="Purpose">Android app distribution</td><td data-label="Data involved">Governed by Google Play's own developer/distribution terms</td></tr>
    </tbody>
</table>
<p>We have <strong>not</strong> integrated Google Analytics, Facebook Pixel, AdMob, Firebase Analytics, or any similar analytics/advertising SDK — confirmed by auditing the codebase. If that changes in future, this policy will be updated first (see <a href="#updates">Changes to this policy</a>).</p>

<h2 id="advertising">G. Advertising</h2>
<p>{{ config('legal.app_name') }} does not display third-party advertisements and does not use an advertising ID. This was verified against the live source code, not assumed. Should {{ config('legal.app_name') }} introduce advertising in a future version, this section — and the app's Google Play Data Safety declaration — will be updated in advance, not retroactively.</p>

<h2 id="permissions">H. App permissions</h2>
<p>The {{ config('legal.app_name') }} Android app is a Trusted Web Activity (TWA) — a thin Android wrapper around this website, not a separate native codebase. Because of that, it doesn't declare its own broad permission list the way a fully native app would; it only triggers the standard Android permission prompts that correspond to web features actually used on the page you're viewing:</p>
<table class="legal-table-stack">
    <thead><tr><th>Permission</th><th>Triggered by</th><th>Optional?</th><th>If declined</th></tr></thead>
    <tbody>
        <tr><td data-label="Permission">Internet access</td><td data-label="Triggered by">Required for the app to load any page</td><td data-label="Optional?">No</td><td data-label="If declined">App cannot function</td></tr>
        <tr><td data-label="Permission">Notifications (Android 13+)</td><td data-label="Triggered by">Browser Notification API, used to alert restaurant staff of new orders</td><td data-label="Optional?">Yes</td><td data-label="If declined">You won't get new-order alerts; the dashboard still works</td></tr>
        <tr><td data-label="Permission">Photo/file picker</td><td data-label="Triggered by">Standard file-upload input, used for logo/menu-photo uploads</td><td data-label="Optional?">Yes, per upload</td><td data-label="If declined">You can't attach a photo for that specific upload</td></tr>
    </tbody>
</table>
<p>{{ config('legal.app_name') }} does <strong>not</strong> request camera access, precise or coarse device location, contacts, or SMS — these were checked directly against the app's own JavaScript and are not present. No data collected via these permissions is transmitted off-device beyond what's already described in this policy (e.g. an uploaded photo is sent to {{ config('legal.app_name') }}'s own servers, the same as any other content you choose to upload).</p>
<div class="legal-todo">TODO (legal/business sign-off): once the Android package is built and signed, confirm the final declared permission list in the Play Console Data Safety form matches this table exactly before each release.</div>

<h2 id="cookies">I. Cookies, sessions &amp; local storage</h2>
<p>{{ config('legal.app_name') }} uses a session cookie to keep you signed in — this isn't optional if you want to use the dashboard, since login depends on it. The browser also stores a small amount of local data (e.g. a "notifications seen" counter, or your last-used order-tracking token) directly on your device to make the interface responsive; this data isn't transmitted to any third party. We do not use third-party advertising or cross-site tracking cookies.</p>

<h2 id="security">J. Security</h2>
<p>We've implemented the following safeguards, verified against the live application at the time this policy was written:</p>
<ul>
    <li>HTTPS in production, with HTTP Strict Transport Security (HSTS) enforced</li>
    <li>Passwords hashed with a modern, salted one-way algorithm — never stored or logged in plain text</li>
    <li>Role-based authorisation, with restaurant-level (tenant) data isolation enforced at the database-query level</li>
    <li>CSRF protection on every state-changing request</li>
    <li>Session ID regeneration on login, and full session invalidation on logout</li>
    <li>Rate limiting on login and other sensitive actions, with progressive account lockout after repeated failed logins</li>
    <li>Security-relevant activity logging (login, logout, failed login, permission denials) for audit purposes, which never includes passwords, session IDs, or payment credentials</li>
    <li>A Content-Security-Policy configured to reduce cross-site-scripting exposure</li>
    <li>Razorpay's own PCI-compliant infrastructure for anything payment-card related — {{ config('legal.app_name') }} never touches raw card data</li>
</ul>
<p>No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We have not sought or obtained PCI-DSS or ISO 27001 certification for {{ config('legal.app_name') }} itself, and we do not claim end-to-end encryption or encryption-at-rest for the application database unless and until that has been separately verified and this policy is updated to reflect it.</p>

<h2 id="retention">K. Data retention</h2>
<p>We keep personal data only for as long as reasonably necessary: for the lifetime of an active account and restaurant, for as long as needed to provide the service you've requested, and for any additional period required to meet a legal, tax, or regulatory obligation.</p>
<div class="legal-todo">TODO (legal/business sign-off): specific, fixed retention periods per data category (e.g. "orders retained for N years") have not yet been approved and are intentionally not stated here as exact numbers — this section should be revisited once those figures are confirmed.</div>

<h2 id="deletion">L. Deletion &amp; your rights</h2>
<p>You can request deletion or correction of your data, or ask what data we hold about you, via our dedicated <a href="{{ route('legal.data-deletion') }}">Data Deletion page</a>, or by emailing <a href="mailto:{{ config('legal.support_email') }}">{{ config('legal.support_email') }}</a> or calling <a href="tel:{{ config('legal.support_phone_link') }}">{{ config('legal.support_phone_display') }}</a>. Because these requests affect account access and business records, we verify the requester's identity before acting on them. Some records may be retained despite a deletion request where we have a legal obligation to keep them, where data has been fully aggregated/anonymised such that it no longer identifies you, or where retaining a minimal record is necessary to protect against fraud or enforce our terms.</p>

<h2 id="restaurant-responsibility">M. Restaurant responsibility for their own customer data</h2>
<p>Each restaurant using {{ config('legal.app_name') }} is responsible for the customer data it collects through its own menu, bookings, and orders, and for responding appropriately to its own customers' requests about that data. {{ config('legal.app_name') }} provides the deletion/correction request channel described above and will route or action requests as appropriate, but day-to-day responsibility for a restaurant's own customer relationships sits with that restaurant.</p>

<h2 id="children">N. Children's privacy</h2>
<p>{{ config('legal.app_name') }} is a business management tool intended for restaurant owners, staff, and their adult customers — it is not directed at children, and we do not knowingly collect personal data from children through the owner/staff dashboard. If you believe a child's information has been submitted to {{ config('legal.app_name') }} in error (for example, through a public order or booking form), please contact <a href="mailto:{{ config('legal.support_email') }}">{{ config('legal.support_email') }}</a> and we will investigate and remove it as appropriate.</p>

<h2 id="international">O. International data processing</h2>
<div class="legal-todo">TODO (legal/business sign-off): the specific country/region where {{ config('legal.app_name') }}'s hosting infrastructure and database physically reside has not yet been formally confirmed for this policy. This section will name the actual processing location(s) once that's verified — we won't state a jurisdiction we haven't confirmed.</div>

<h2 id="updates">P. Changes to this policy</h2>
<p>We may update this policy as {{ config('legal.app_name') }} changes. The "Last updated" date at the top of this page reflects the most recent revision. Material changes — anything that meaningfully changes what we collect or how we use it — will be reflected here with an updated date; continued use of {{ config('legal.app_name') }} after a change constitutes acceptance of the revised policy.</p>

@endsection