@page "/en/privacy"
@model Nalu.Web.Pages.En.Legal.PrivacyModel
@{
    ViewData["LangPrefix"] = "/en";
    ViewData["Title"] = "Privacy Policy — NaLU AI";
    ViewData["Description"] = "NaLU AI privacy policy. We do not store conversation content. Your data is used only to process API calls.";
}

<section class="bg-gradient-to-b from-slate-50 to-white pt-16 pb-8">
    <div class="max-w-3xl mx-auto px-4 sm:px-6">
        <h1 class="text-3xl font-extrabold text-gray-900 mb-2">Privacy Policy</h1>
        <p class="text-gray-500 text-sm">Last updated: @DateTime.UtcNow.ToString("MMMM d, yyyy", System.Globalization.CultureInfo.InvariantCulture)</p>
    </div>
</section>

<section class="py-10 bg-white">
    <div class="max-w-3xl mx-auto px-4 sm:px-6 space-y-10 text-gray-700 text-sm leading-relaxed">

        <div class="bg-nalu-50 border border-nalu-100 rounded-2xl p-6">
            <div class="font-bold text-nalu-800 text-base mb-2">TL;DR</div>
            <ul class="text-nalu-700 space-y-1">
                <li>✓ We do not store the content of conversations sent to the API</li>
                <li>✓ We use AI models configured with zero data retention</li>
                <li>✓ Payments are handled by Stripe — we never touch your card data</li>
                <li>✓ You can request account deletion at any time</li>
            </ul>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">1. What we collect</h2>
            <p class="mb-3"><strong>Account data</strong> (when you sign up):</p>
            <ul class="list-disc list-inside space-y-1 mb-4 text-gray-600">
                <li>Name and email address (via Google, GitHub or Microsoft OAuth)</li>
                <li>Profile picture provided by the OAuth provider</li>
                <li>Current plan and credit usage history</li>
            </ul>
            <p class="mb-3"><strong>Technical usage data</strong>:</p>
            <ul class="list-disc list-inside space-y-1 text-gray-600">
                <li>Number of API calls per key and per period</li>
                <li>Credits consumed per validator</li>
                <li>IP address for rate limiting and abuse prevention</li>
                <li>Error logs (without conversation content)</li>
            </ul>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">2. What we do <strong>not</strong> collect</h2>
            <div class="bg-green-50 border border-green-100 rounded-xl p-5 space-y-2">
                <p>❌ We do <strong>not store</strong> the text of <code class="bg-green-100 px-1 rounded text-xs">agent_input</code>, <code class="bg-green-100 px-1 rounded text-xs">user_input</code> or any other dialogue field sent in validation calls.</p>
                <p>❌ We do <strong>not log</strong> the content of your end-users' conversations.</p>
                <p>❌ We do <strong>not use</strong> submitted data to train models or improve services beyond immediate call processing.</p>
            </div>
            <p class="mt-3 text-gray-500">Dialogues sent to the API are processed in memory and discarded immediately after the response is returned.</p>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">3. AI models and infrastructure</h2>
            <p class="mb-3">NaLU AI uses third-party language model providers for semantic processing. All providers are contracted with <strong>data retention disabled</strong> — data sent is not stored, used for training, or shared by the provider.</p>
            <p>Data sent to these providers is exclusively the dialogue content required for validation. No identifying information about your end users is transmitted.</p>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">4. Payments</h2>
            <p>Payments are processed by <strong>Stripe</strong>, PCI DSS Level 1 certified. NaLU AI does not store, process or transmit credit card data. When subscribing, you are redirected to Stripe's secure environment.</p>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">5. Social login (OAuth)</h2>
            <p>Login via Google, GitHub or Microsoft provides only your name and email. We do not request additional permissions such as access to emails, calendar or other account data.</p>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">6. Cookies and local storage</h2>
            <ul class="list-disc list-inside space-y-1 text-gray-600">
                <li><strong>Session cookie</strong> — required to keep you logged in. Expires when the browser is closed or after inactivity.</li>
                <li><strong>No tracking cookies</strong> — we do not use Google Analytics, Meta Pixel or any behavioral tracking tools.</li>
            </ul>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">7. Data retention and deletion</h2>
            <p class="mb-3">Account data is retained while the account is active. To request deletion:</p>
            <ul class="list-disc list-inside space-y-1 text-gray-600">
                <li>Dashboard → Settings → Delete account</li>
                <li>Or email <a data-email class="font-semibold"></a></li>
            </ul>
            <p class="mt-3">After the request, all account data is removed within 30 days. Anonymized technical logs may be retained for up to 90 days for security requirements.</p>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">8. Data sharing</h2>
            <p>We do not sell or share your data with third parties for commercial purposes. Data is shared only with the service providers described in this policy (Stripe, AI providers) strictly for service execution.</p>
        </div>

        <div>
            <h2 class="text-xl font-bold text-gray-900 mb-3">9. Contact</h2>
            <p>Privacy questions: <a data-email class="font-semibold"></a></p>
        </div>

    </div>
</section>
