import type { Metadata } from "next";
import { PageIntro, SiteShell, StatusNote } from "../_components/SiteShell";

export const metadata: Metadata = { title: "Privacy notice", description: "How SmartCut64 handles website, purchase, activation and support information." };

const nav = [["Status", "status"], ["Controller", "controller"], ["Information", "information"], ["Uses and bases", "uses"], ["Providers", "providers"], ["Retention", "retention"], ["Security", "security"], ["Rights", "rights"], ["Contact", "contact"]] as const;

export default function PrivacyPage() {
  return <SiteShell>
    <PageIntro eyebrow="Privacy notice" title="No advertising, behavioural tracking or general app telemetry"><p>This notice explains the limited information used by the website, official activation service and customer support.</p></PageIntro>
    <div className="section"><div className="content-wide prose-layout">
      <aside className="side-nav" aria-label="On this page">{nav.map(([label,id]) => <a href={`#${id}`} key={id}>{label}</a>)}</aside>
      <article className="prose">
        <div className="policy-meta"><div><strong>Published</strong>20 August 2026</div><div><strong>Effective</strong>When live checkout opens</div><div><strong>Version</strong>Pre-launch merchant review</div></div>
        <section id="status"><h2>1. Status and scope</h2><StatusNote tone="warn">Checkout is not active. This notice is published for merchant and independent privacy review and will govern the production website, activation service and support process when sales open.</StatusNote></section>
        <section id="controller"><h2>2. Who is responsible</h2><p><strong>LINEKERPANDI LIMITED</strong>, company number 06406014, registered at 1035A Finchley Road, London, NW11 7ES, United Kingdom, is responsible for personal information handled through SmartCut64 activation and support. Contact <a href="mailto:privacy@linekerpandi.com">privacy@linekerpandi.com</a>.</p><p>Lemon Squeezy separately handles checkout, payment, tax, order, receipt, refund and licence-key administration as merchant of record under its own privacy terms.</p></section>
        <section id="information"><h2>3. Information we handle</h2><h3>Website</h3><p>Cloudflare may process technical request information needed to deliver and protect the site, such as IP address, request time, page, browser and security signals. We do not intentionally set advertising or behavioural-analytics cookies.</p><h3>Purchase and activation</h3><p>When you choose <strong>Activate This Computer</strong>, the application sends the purchase email, Lemon Squeezy licence key and a 32-character Installation ID over HTTPS. The Installation ID is one-way and domain-separated; the raw Windows MachineGuid is not transmitted.</p><p>The activation service stores a SHA-256 hash of the key, the already-hashed Installation ID, relevant Lemon order/licence/instance identifiers, customer email and name, entitlement status and timestamps. It does not retain the raw licence key. On the computer, the email and raw key are encrypted for the current Windows user with Windows DPAPI.</p><h3>Support and security reports</h3><p>We handle the sender address, message, attachments and technical evidence you choose to provide. Do not send a licence key, private video or unnecessary personal information unless a suitable private transfer route is explicitly arranged.</p></section>
        <section id="uses"><h2>4. Why we use information and the lawful bases</h2><table className="data-table"><thead><tr><th>Purpose</th><th>Typical information</th><th>Basis</th></tr></thead><tbody><tr><td>Deliver and secure the website</td><td>Request and security data</td><td>Legitimate interests in reliable, abuse-resistant publishing</td></tr><tr><td>Verify purchase and provide clean-export entitlement</td><td>Email, hashed identifiers, licence/order status</td><td>Contract and steps requested before/under a contract</td></tr><tr><td>Enforce the advertised activation limit and prevent abuse</td><td>Hashed installation/key identifiers and status</td><td>Contract and legitimate interests, balanced against minimal identifiers</td></tr><tr><td>Answer support and security reports</td><td>Contact details and supplied evidence</td><td>Contract, legitimate interests and, where necessary, legal obligation</td></tr><tr><td>Accounting, disputes and legal compliance</td><td>Order/refund correspondence and records</td><td>Legal obligation and establishment or defence of legal claims</td></tr></tbody></table><p>We do not sell personal information and do not use activation data for advertising or automated decisions with legal or similarly significant effects.</p></section>
        <section id="providers"><h2>5. Service providers and international transfers</h2><p>The production service uses Lemon Squeezy for merchant-of-record purchase/licensing functions and Cloudflare for website delivery, security and activation hosting. Their systems may process information outside the United Kingdom. We rely on their contractual and legal transfer safeguards where required.</p><ul><li><a href="https://www.lemonsqueezy.com/privacy" rel="noreferrer">Lemon Squeezy privacy policy</a></li><li><a href="https://www.cloudflare.com/policies/privacy/" rel="noreferrer">Cloudflare privacy policy</a></li></ul></section>
        <section id="retention"><h2>6. Retention</h2><ul><li>Active entitlement records are kept while needed to provide the purchased licence and update/support entitlement.</li><li>Deactivated, refunded or disabled activation records are retained for up to 24 months where reasonably needed for reset history, disputes and fraud prevention, then deleted or anonymised.</li><li>Ordinary support correspondence is retained for up to 24 months after closure; longer only for an active complaint, security incident or legal claim.</li><li>Application-security logs controlled by us are retained for up to 90 days unless an incident requires proportionate longer preservation.</li><li>Transaction/accounting records are kept for the period required by applicable tax, company and consumer law.</li></ul><p>Provider-controlled records may follow the provider&apos;s published retention rules.</p></section>
        <section id="security"><h2>7. Security</h2><p>Activation uses HTTPS, one-way identifiers, raw-key minimisation, signed offline entitlements, bounded activation counts and Windows DPAPI for local secrets. No internet service can be guaranteed completely secure; suspected vulnerabilities should be reported privately to <a href="mailto:security@linekerpandi.com">security@linekerpandi.com</a>.</p></section>
        <section id="rights"><h2>8. Your rights</h2><p>Depending on the purpose and applicable law, you may ask for access, correction, deletion, restriction, portability or to object. You may also complain to the UK Information Commissioner&apos;s Office or the supervisory authority available where you live or work. Some records must be retained for legal, tax, fraud or dispute purposes.</p><p><a href="https://ico.org.uk/make-a-complaint/" rel="noreferrer">Information Commissioner&apos;s Office complaint information</a></p></section>
        <section id="contact"><h2>9. Contact and changes</h2><p>Privacy requests: <a href="mailto:privacy@linekerpandi.com">privacy@linekerpandi.com</a>. We will publish material changes here and update the date above. A change will not retroactively reduce rights attached to an existing purchase.</p></section>
      </article>
    </div></div>
  </SiteShell>;
}
