import type { Metadata } from "next";
import { LegalPageLayout } from "@/components/LegalPageLayout";
import { LEGAL_OPERATOR } from "@/lib/legal/constants";

export const metadata: Metadata = {
  title: "Privacy Policy",
  description: "How Songs2VID collects, uses, and protects your personal data.",
  alternates: { canonical: "https://songs2vid.com/privacy" },
};

export default function PrivacyPage() {
  return (
    <LegalPageLayout
      title="Privacy Policy"
      description="How we handle your personal data when you use Songs2VID."
    >
      <h2>1. Overview</h2>
      <p>
        This Privacy Policy explains how {LEGAL_OPERATOR.name} (&quot;we&quot;, &quot;us&quot;)
        processes personal data when you use our website, hosted cloud service, and related features
        that convert audio and images into videos for upload to YouTube.
      </p>
      <p>
        We process personal data in accordance with applicable data protection laws, including the
        General Data Protection Regulation (GDPR) where it applies.
      </p>

      <h2>2. Data controller</h2>
      <p>
        {LEGAL_OPERATOR.legalName}
        <br />
        {LEGAL_OPERATOR.address}
        <br />
        {LEGAL_OPERATOR.city}
        <br />
        Email: <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>
      </p>

      <h2>3. What data we collect</h2>
      <h3>3.1 Account and authentication data</h3>
      <p>When you sign in with Google, we receive and store:</p>
      <ul>
        <li>Your name, email address, and profile image (from Google)</li>
        <li>OAuth tokens required to authenticate your session</li>
        <li>YouTube connection data, including channel ID and title</li>
        <li>
          Encrypted YouTube API access and refresh tokens needed to upload videos, create or list
          playlists, and manage related YouTube actions you request
        </li>
      </ul>

      <h3>3.2 Uploaded content and job data</h3>
      <p>When you use the service, we temporarily process:</p>
      <ul>
        <li>Image and audio files you upload (including optional per-track cover images)</li>
        <li>Optional custom watermark assets (text, PNG logo, or font files)</li>
        <li>Generated video files prior to or during YouTube upload</li>
        <li>
          Per-video metadata you provide (title, artist, description, tags, privacy, category,
          resolution, layout, watermark settings, Made for Kids / embedding / license flags, etc.)
        </li>
        <li>
          Embedded audio tag metadata (for example ID3 title/artist/album) when we read it from
          uploaded MP3 files to help prefill fields
        </li>
        <li>Playlist titles and IDs when you create or attach YouTube playlists through the Service</li>
      </ul>

      <h3>3.3 Usage, API, and technical data</h3>
      <ul>
        <li>
          Plan type, monthly credit allocation, credits used, purchased extra credits, quota reset
          dates, and job processing status
        </li>
        <li>
          Quota reset / extension and API rate-limit extension request history (Pro) when you submit
          a request
        </li>
        <li>
          API key material for Pro users: we store a cryptographic hash and a short non-secret
          prefix; the full key is shown once at creation and is not stored in plaintext
        </li>
        <li>IP address, browser type, device information, and request logs</li>
        <li>Error reports and operational diagnostics</li>
      </ul>

      <h3>3.4 Payment data</h3>
      <p>
        If you purchase a Pro subscription or Free-plan extra credits, payment processing is handled
        by Stripe. We do not store full payment card details on our servers. We may receive and store
        billing status, Stripe customer and subscription identifiers, Checkout session or payment
        references, purchase amounts, and credit pack size for fulfilled top-ups.
      </p>

      <h2>4. Why we process your data</h2>
      <ul>
        <li>
          <strong>Contract performance:</strong> to provide video encoding, metadata handling,
          playlist actions, API access, and YouTube upload features you request
        </li>
        <li>
          <strong>Legitimate interests:</strong> to secure our service, prevent abuse, improve
          reliability, and enforce our terms
        </li>
        <li>
          <strong>Legal obligations:</strong> where required by tax, accounting, or regulatory law
        </li>
        <li>
          <strong>Consent:</strong> where you have given explicit consent, such as optional
          marketing communications if offered
        </li>
      </ul>

      <h2>5. Third-party services</h2>
      <p>We use trusted third parties to operate Songs2VID, including:</p>
      <ul>
        <li>
          <strong>Google / YouTube:</strong> authentication and video uploads via Google OAuth and
          the YouTube Data API. Your use of Google and YouTube is also subject to{" "}
          <a
            href="https://policies.google.com/privacy"
            target="_blank"
            rel="noopener noreferrer"
          >
            Google&apos;s Privacy Policy
          </a>
          ,{" "}
          <a
            href="https://www.youtube.com/t/terms"
            target="_blank"
            rel="noopener noreferrer"
          >
            YouTube Terms of Service
          </a>
          , and related Google API terms
        </li>
        <li>
          <strong>Hosting and infrastructure providers:</strong> servers, databases, queues, and
          storage
        </li>
        <li>
          <strong>Stripe:</strong> Pro subscriptions, Free-plan credit top-ups, and related billing
          webhooks (
          <a href="https://stripe.com/privacy" target="_blank" rel="noopener noreferrer">
            Stripe Privacy Policy
          </a>
          )
        </li>
      </ul>
      <p>
        These providers process data only as necessary to deliver their services and under
        appropriate contractual safeguards where required.
      </p>

      <h2>6. Google / YouTube user data (Limited Use)</h2>
      <p>
        Songs2VID&apos;s use and transfer to any other app of information received from Google APIs
        will adhere to the{" "}
        <a
          href="https://developers.google.com/terms/api-services-user-data-policy"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google API Services User Data Policy
        </a>
        , including the Limited Use requirements.
      </p>
      <p>
        We request Google OAuth access (including the YouTube Data API scope needed to upload videos
        and manage playlists on your connected channel) solely to provide prominent, user-facing
        features of Songs2VID: signing you in, connecting your channel, encoding your media, uploading
        videos you create, and creating or listing playlists you request. We do not use Google user
        data for advertising, credit scoring, or unrelated profiling.
      </p>
      <p>
        We do not sell, share, transfer, or disclose Google user data obtained via Google OAuth /
        YouTube APIs to third parties, except as needed to operate the Service infrastructure under
        our control or when required by law. Google / YouTube themselves process data when we call
        their APIs on your behalf to perform actions you initiate.
      </p>
      <p>
        You can revoke Songs2VID&apos;s access to your Google account at any time in{" "}
        <a
          href="https://security.google.com/settings/security/permissions"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google Account → Security → Third-party access
        </a>
        . After revocation (or when tokens can no longer be refreshed), we will stop using those
        credentials and delete or invalidate stored YouTube OAuth tokens and related connection data
        associated with that consent, subject to short-term backup or security logs and any legal
        retention duties.
      </p>

      <h2>7. Data retention and account deletion</h2>
      <ul>
        <li>
          Uploaded source files and generated outputs are retained only as long as needed to complete
          your jobs (typically removed after successful processing/upload or when no longer required)
        </li>
        <li>Account data is kept while your account remains active</li>
        <li>Billing records may be retained as required by law</li>
        <li>Logs are retained for a limited period for security and troubleshooting</li>
        <li>
          API key hashes are removed when you revoke the key, downgrade from Pro (where applicable),
          or delete your account
        </li>
      </ul>
      <p>
        You may delete your account from <strong>Dashboard → Settings</strong> (account deletion
        control) or by emailing{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>. Deletion removes
        account and connection data from active systems subject to legal retention obligations
        (for example certain billing records). Cancelling a subscription does not by itself delete
        your account.
      </p>

      <h2>8. Self-hosted deployments</h2>
      <p>
        If you deploy Songs2VID on your own infrastructure, you are the data controller for data
        processed on your instance. This Privacy Policy applies to the hosted cloud service
        operated by us, not to independent self-hosted installations unless we provide managed
        hosting for you under contract.
      </p>

      <h2>9. Your rights</h2>
      <p>Depending on your location, you may have the right to:</p>
      <ul>
        <li>Access the personal data we hold about you</li>
        <li>Request correction or deletion</li>
        <li>Restrict or object to certain processing</li>
        <li>Data portability</li>
        <li>Withdraw consent where processing is consent-based</li>
        <li>
          Lodge a complaint with a supervisory authority (in Hungary, the Nemzeti Adatvédelmi és
          Információszabadság Hatóság — NAIH)
        </li>
      </ul>
      <p>
        To exercise these rights, contact{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>, or use in-product
        account deletion where available. You may also revoke Google access as described in section
        6.
      </p>

      <h2>10. Cookies and local storage</h2>
      <p>
        We use essential cookies and similar technologies for authentication, session management,
        and security. We do not use non-essential tracking cookies unless disclosed separately and
        enabled with your consent where required.
      </p>

      <h2>11. Security</h2>
      <p>
        We implement appropriate technical and organizational measures to protect your data,
        including encryption in transit, encrypted storage of YouTube OAuth tokens at rest, access
        controls, and isolated processing environments. No method of transmission or storage is
        100% secure.
      </p>

      <h2>12. International transfers</h2>
      <p>
        If data is transferred outside your country, we ensure appropriate safeguards such as
        standard contractual clauses or equivalent mechanisms where required by law. Google, Stripe,
        and infrastructure providers may process data in other countries as described in their
        policies.
      </p>

      <h2>13. Children</h2>
      <p>
        Songs2VID is not directed at children under 16. We do not knowingly collect personal data
        from children. If you believe a child has provided us data, please contact us.
      </p>

      <h2>14. Changes to this policy</h2>
      <p>
        We may update this Privacy Policy from time to time. Material changes will be posted on
        this page with an updated effective date. If we change how we use Google user data, we will
        update this policy and, where required, notify you or obtain renewed consent.
      </p>

      <h2>15. Contact</h2>
      <p>
        Questions about this Privacy Policy or our privacy practices:{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>
      </p>
    </LegalPageLayout>
  );
}