web/app/privacy/page.tsx

import { ShieldCheck } from "lucide-react";
import Link from "next/link";

export default function PrivacyPage() {
  return (
    <div className="min-h-screen bg-white">
      <div className="max-w-2xl mx-auto px-5 py-16">
        <Link href="/" className="text-sm text-zinc-400 hover:text-zinc-600">← Home</Link>
        <h1 className="mt-6 text-2xl font-semibold tracking-tight">Privacy Policy</h1>
        <p className="mt-2 text-sm text-zinc-400">Last updated: April 2026</p>

        <div className="mt-8 space-y-6 text-sm text-zinc-600 leading-relaxed">
          <section>
            <h2 className="text-base font-medium text-zinc-900 mb-2">What we collect</h2>
            <p>When you use ClauseGuard, we process the text you submit for analysis. This text is sent to our API for clause classification and is not stored permanently unless you have an account and choose to save scan history.</p>
            <p className="mt-2">If you create an account, we store your email address, name, and scan history. Payment information is processed by Stripe and never touches our servers.</p>
          </section>

          <section>
            <h2 className="text-base font-medium text-zinc-900 mb-2">Chrome extension</h2>
            <p>The extension reads page text on sites you visit to scan for unfair clauses. This text is sent to our API for analysis. We do not track your browsing history, and page text is not stored after analysis completes.</p>
            <p className="mt-2">When the API is unreachable, the extension uses local pattern matching that runs entirely in your browser. No data leaves your device in this mode.</p>
          </section>

          <section>
            <h2 className="text-base font-medium text-zinc-900 mb-2">How we use your data</h2>
            <ul className="list-disc pl-5 space-y-1">
              <li>Clause text: processed for classification, not stored (unless you save it)</li>
              <li>Email: account management, transactional emails, billing notifications</li>
              <li>Scan history: displayed in your dashboard, deletable at any time</li>
              <li>Usage counts: to enforce free tier limits</li>
            </ul>
          </section>

          <section>
            <h2 className="text-base font-medium text-zinc-900 mb-2">Third parties</h2>
            <ul className="list-disc pl-5 space-y-1">
              <li><strong>Supabase</strong> — authentication and database (EU region available)</li>
              <li><strong>Stripe</strong> — payment processing</li>
              <li><strong>Resend</strong> — transactional emails</li>
              <li><strong>HuggingFace</strong> — ML model hosting</li>
            </ul>
          </section>

          <section>
            <h2 className="text-base font-medium text-zinc-900 mb-2">Your rights</h2>
            <p>You can delete your account and all associated data at any time from the settings page. You can request a data export by contacting us. Under GDPR, you have the right to access, rectify, and erase your personal data.</p>
          </section>

          <section>
            <h2 className="text-base font-medium text-zinc-900 mb-2">Contact</h2>
            <p>Questions about this policy: <a href="mailto:privacy@clauseguardweb.netlify.app" className="text-zinc-900 underline">privacy@clauseguardweb.netlify.app</a></p>
          </section>
        </div>
      </div>
    </div>
  );
}