songs2vid/app/privacy/page.tsx

import type { Metadata } from "next";
import { LegalPageLayout } from "@/components/LegalPageLayout";
import { LEGAL_OPERATOR } from "@/lib/legal/constants";

export const metadata: Metadata = {
  title: "Privacy Policy",
  description: "How Songs2VID collects, uses, and protects your personal data.",
  alternates: { canonical: "https://songs2vid.com/privacy" },
};

export default function PrivacyPage() {
  return (
    <LegalPageLayout
      title="Privacy Policy"
      description="How we handle your personal data when you use Songs2VID."
    >
      <h2>1. Overview</h2>
      <p>
        This Privacy Policy explains how {LEGAL_OPERATOR.name} (&quot;we&quot;, &quot;us&quot;)
        processes personal data when you use our website, hosted cloud service, and related features
        that convert audio and images into videos for upload to YouTube.
      </p>
      <p>
        We process personal data in accordance with applicable data protection laws, including the
        General Data Protection Regulation (GDPR) where it applies.
      </p>

      <h2>2. Data controller</h2>
      <p>
        {LEGAL_OPERATOR.legalName}
        <br />
        {LEGAL_OPERATOR.address}
        <br />
        {LEGAL_OPERATOR.city}
        <br />
        Email: <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>
      </p>

      <h2>3. What data we collect</h2>
      <h3>3.1 Account and authentication data</h3>
      <p>When you sign in with Google, we receive and store:</p>
      <ul>
        <li>Your name, email address, and profile image (from Google)</li>
        <li>OAuth tokens required to authenticate your session</li>
        <li>YouTube connection data, including channel ID and title</li>
        <li>
          Encrypted YouTube API access and refresh tokens needed to upload videos, create or list
          playlists, and manage related YouTube actions you request
        </li>
      </ul>

      <h3>3.2 Uploaded content and job data</h3>
      <p>When you use the service, we temporarily process:</p>
      <ul>
        <li>Image and audio files you upload (including optional per-track cover images)</li>
        <li>Optional custom watermark assets (text, PNG logo, or font files)</li>
        <li>Generated video files prior to or during YouTube upload</li>
        <li>
          Per-video metadata you provide (title, artist, description, tags, privacy, category,
          resolution, layout, watermark settings, Made for Kids / embedding / license flags, etc.)
        </li>
        <li>
          Embedded audio tag metadata (for example ID3 title/artist/album) when we read it from
          uploaded MP3 files to help prefill fields
        </li>
        <li>Playlist titles and IDs when you create or attach YouTube playlists through the Service</li>
        <li>
          Optional job callback URLs (<code>webhookUrl</code>) you provide for automation (for
          example n8n or Make) - see section 3.5
        </li>
      </ul>

      <h3>3.3 Usage, API, and technical data</h3>
      <ul>
        <li>
          Plan type (Bedroom Producer / Independent Producer / Developer &amp; Automation /
          Enterprise), monthly credit allocation, credits used, purchased extra credits, quota reset
          dates, lifetime successful video render count (used for Free-tier watermark policy), and
          job processing status
        </li>
        <li>
          Quota reset / extension request history for paid plans, and API rate-limit extension
          request history for Developer &amp; Automation / Enterprise when you submit a request
        </li>
        <li>
          API key material for Developer &amp; Automation and Enterprise users: we store a
          cryptographic hash and a short non-secret prefix; the full key is shown once at creation
          and is not stored in plaintext
        </li>
        <li>IP address, browser type, device information, and request logs</li>
        <li>Error reports and operational diagnostics</li>
        <li>
          Website and product analytics events collected via Matomo (self-hosted at
          analytics.atakanozban.com), Google Analytics (GA4 measurement IDs G-9XCHRS7LJR and G-2V3FSMMPQX),
          Google Tag Manager (container GTM-PZL4HXBR), Microsoft Clarity (project y4hxg6t7s6), and
          Google Search Console search-performance reports to understand traffic and improve the
          Service - see section 10
        </li>
      </ul>

      <h3>3.4 Payment data</h3>
      <p>
        If you purchase an Independent Producer subscription, a Developer &amp; Automation
        subscription, an Enterprise arrangement, or Free-plan extra credits, payment processing is
        handled by Stripe. We do not store full payment card details on our servers. We may receive
        and store billing status, Stripe customer and subscription identifiers, Checkout session or
        payment references, plan identifiers, purchase amounts, and credit pack size for fulfilled
        top-ups.
      </p>

      <h3>3.5 Job webhooks and automation callbacks</h3>
      <p>
        On Developer &amp; Automation and Enterprise plans (and self-hosted deployments where
        enabled), you may supply an absolute HTTP(S) callback URL when creating a render job. We
        store that URL with the job record and, when encoding or upload reaches a terminal state,
        may POST a JSON payload to it. Typical fields include event type, job and item identifiers,
        status, optional YouTube video ID, error message, and completion timestamp.
      </p>
      <p>
        You choose the destination (for example your n8n webhook, Make scenario, or your own
        server). We do not control how that endpoint stores or shares the payload. Only set URLs you
        own or are authorized to use. Delivery is best-effort; we do not guarantee receipt or
        retention by the receiving system.
      </p>

      <h2>4. Why we process your data</h2>
      <ul>
        <li>
          <strong>Contract performance:</strong> to provide video encoding, metadata handling,
          playlist actions, API access, webhook notifications, and YouTube upload features you
          request
        </li>
        <li>
          <strong>Legitimate interests:</strong> to secure our service, prevent abuse, improve
          reliability, and enforce our terms
        </li>
        <li>
          <strong>Legal obligations:</strong> where required by tax, accounting, or regulatory law
        </li>
        <li>
          <strong>Consent:</strong> where you have given explicit consent, such as optional
          marketing communications if offered
        </li>
      </ul>

      <h2>5. Third-party services</h2>
      <p>We use trusted third parties to operate Songs2VID, including:</p>
      <ul>
        <li>
          <strong>Google / YouTube:</strong> authentication and video uploads via Google OAuth and
          the YouTube Data API. Your use of Google and YouTube is also subject to{" "}
          <a
            href="https://policies.google.com/privacy"
            target="_blank"
            rel="noopener noreferrer"
          >
            Google&apos;s Privacy Policy
          </a>
          ,{" "}
          <a
            href="https://www.youtube.com/t/terms"
            target="_blank"
            rel="noopener noreferrer"
          >
            YouTube Terms of Service
          </a>
          , and related Google API terms
        </li>
        <li>
          <strong>Hosting and infrastructure providers:</strong> servers, databases, queues, and
          storage
        </li>
        <li>
          <strong>Stripe:</strong> Independent Producer and Developer &amp; Automation
          subscriptions, Free-plan credit top-ups, and related billing webhooks (
          <a href="https://stripe.com/privacy" target="_blank" rel="noopener noreferrer">
            Stripe Privacy Policy
          </a>
          )
        </li>
        <li>
          <strong>Your webhook endpoints:</strong> if you configure a job <code>webhookUrl</code>,
          we send job status JSON to that URL as described in section 3.5
        </li>
        <li>
          <strong>Matomo (self-hosted analytics):</strong> privacy-friendly analytics we operate at
          analytics.atakanozban.com to measure visits and improve Songs2VID. Analytics data stays on
          infrastructure we control; we do not sell it to advertising networks.
        </li>
        <li>
          <strong>Google Analytics:</strong> Google LLC processes aggregated usage analytics for our
          sites under Google&apos;s terms when the GA4 tags (G-9XCHRS7LJR and G-2V3FSMMPQX) load. See{" "}
          <a
            href="https://policies.google.com/privacy"
            target="_blank"
            rel="noopener noreferrer"
          >
            Google&apos;s Privacy Policy
          </a>
          .
        </li>
        <li>
          <strong>Google Tag Manager:</strong> Google LLC loads our tag container{" "}
          <code>GTM-PZL4HXBR</code>, which may deploy Google Analytics and other measurement tags we
          configure. See{" "}
          <a
            href="https://policies.google.com/privacy"
            target="_blank"
            rel="noopener noreferrer"
          >
            Google&apos;s Privacy Policy
          </a>
          .
        </li>
        <li>
          <strong>Google Search Console:</strong> Google LLC provides search indexing and
          performance reports (queries, impressions, clicks, coverage) for songs2vid.com and related
          properties we verify. Search Console is a webmaster tool, not a visitor-facing tracker on
          every page. See{" "}
          <a
            href="https://policies.google.com/privacy"
            target="_blank"
            rel="noopener noreferrer"
          >
            Google&apos;s Privacy Policy
          </a>
          .
        </li>
        <li>
          <strong>Microsoft Clarity:</strong> Microsoft Corporation processes usage analytics and
          anonymized session recordings and heatmaps (project y4hxg6t7s6). See{" "}
          <a
            href="https://www.microsoft.com/privacy/privacystatement"
            target="_blank"
            rel="noopener noreferrer"
          >
            Microsoft&apos;s Privacy Statement
          </a>
          .
        </li>
      </ul>
      <p>
        These providers process data only as necessary to deliver their services and under
        appropriate contractual safeguards where required.
      </p>

      <h2>6. Google / YouTube user data (Limited Use)</h2>
      <p>
        Songs2VID&apos;s use and transfer to any other app of information received from Google APIs
        will adhere to the{" "}
        <a
          href="https://developers.google.com/terms/api-services-user-data-policy"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google API Services User Data Policy
        </a>
        , including the Limited Use requirements.
      </p>
      <p>
        We request Google OAuth access (including the YouTube Data API scope needed to upload videos
        and manage playlists on your connected channel) solely to provide prominent, user-facing
        features of Songs2VID: signing you in, connecting your channel, encoding your media, uploading
        videos you create, and creating or listing playlists you request. We do not use Google user
        data for advertising, credit scoring, or unrelated profiling.
      </p>
      <p>
        We do not sell, share, transfer, or disclose Google user data obtained via Google OAuth /
        YouTube APIs to third parties, except as needed to operate the Service infrastructure under
        our control, when required by law, or when you explicitly configure a job webhook that may
        include a YouTube video ID you caused to be published. Google / YouTube themselves process
        data when we call their APIs on your behalf to perform actions you initiate.
      </p>
      <p>
        You can revoke Songs2VID&apos;s access to your Google account at any time in{" "}
        <a
          href="https://security.google.com/settings/security/permissions"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google Account - Security - Third-party access
        </a>
        . After revocation (or when tokens can no longer be refreshed), we will stop using those
        credentials and delete or invalidate stored YouTube OAuth tokens and related connection data
        associated with that consent, subject to short-term backup or security logs and any legal
        retention duties.
      </p>

      <h2>7. Data retention and account deletion</h2>
      <ul>
        <li>
          Uploaded source files and generated outputs are retained only as long as needed to complete
          your jobs (typically removed after successful YouTube upload or when no longer required for
          retries)
        </li>
        <li>
          Job metadata (status, titles, YouTube IDs, errors, optional <code>webhookUrl</code>) is
          kept while your account remains active and may be purged on account deletion, subject to
          short-term backups and troubleshooting logs
        </li>
        <li>Account data is kept while your account remains active</li>
        <li>Billing records may be retained as required by law</li>
        <li>Logs are retained for a limited period for security and troubleshooting</li>
        <li>
          API key hashes are removed when you revoke the key, leave Developer &amp; Automation /
          Enterprise (where applicable), or delete your account
        </li>
      </ul>
      <p>
        You may delete your account from <strong>Dashboard - Settings</strong> (account deletion
        control) or by emailing{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>. Deletion removes
        account and connection data from active systems subject to legal retention obligations
        (for example certain billing records). Cancelling a subscription does not by itself delete
        your account.
      </p>

      <h2>8. Self-hosted deployments</h2>
      <p>
        If you deploy Songs2VID on your own infrastructure, you are the data controller for data
        processed on your instance. This Privacy Policy applies to the hosted cloud service
        operated by us, not to independent self-hosted installations unless we provide managed
        hosting for you under contract.
      </p>

      <h2>9. Your rights</h2>
      <p>Depending on your location, you may have the right to:</p>
      <ul>
        <li>Access the personal data we hold about you</li>
        <li>Request correction or deletion</li>
        <li>Restrict or object to certain processing</li>
        <li>Data portability</li>
        <li>Withdraw consent where processing is consent-based</li>
        <li>
          Lodge a complaint with a supervisory authority (in Hungary, the Nemzeti Adatvédelmi és
          Információszabadság Hatóság - NAIH)
        </li>
      </ul>
      <p>
        To exercise these rights, contact{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>, or use in-product
        account deletion where available. You may also revoke Google access as described in section
        6.
      </p>

      <h2>10. Cookies, analytics, and local storage</h2>
      <p>
        We use essential cookies and similar technologies for authentication, session management,
        and security.
      </p>
      <p>
        We also use <strong>Matomo</strong>, a self-hosted analytics tool on{" "}
        <code>analytics.atakanozban.com</code>, <strong>Google Analytics 4</strong> (measurement
        IDs <code>G-9XCHRS7LJR</code> and <code>G-2V3FSMMPQX</code>), and{" "}
        <strong>Microsoft Clarity</strong> (project <code>y4hxg6t7s6</code>) on our website
        (including the landing page and dashboard) and documentation site. These tools help us
        understand how people use Songs2VID so we can improve functionality, reliability, and
        content. Typical data includes pages viewed, approximate location derived from IP,
        device/browser type, referring site, interaction events, and (for Clarity) anonymized
        session recordings and heatmaps. We configure Matomo for our domains under{" "}
        <code>*.songs2vid.com</code>. Google Analytics is provided by Google LLC; see{" "}
        <a
          href="https://policies.google.com/privacy"
          target="_blank"
          rel="noopener noreferrer"
        >
          Google&apos;s Privacy Policy
        </a>
        . Microsoft Clarity is provided by Microsoft Corporation; see{" "}
        <a
          href="https://www.microsoft.com/privacy/privacystatement"
          target="_blank"
          rel="noopener noreferrer"
        >
          Microsoft&apos;s Privacy Statement
        </a>
        .
      </p>
      <p>
        We also use <strong>Google Tag Manager</strong> (container <code>GTM-PZL4HXBR</code>) to
        load and manage measurement tags on our website, including Google Analytics. Tag Manager is
        a delivery mechanism; tags it loads may set cookies or collect usage data as described in
        this section.
      </p>
      <p>
        We use <strong>Google Search Console</strong> to verify site ownership and review search
        indexing and performance reports (such as queries, impressions, and clicks) for
        songs2vid.com. Search Console is operated by Google LLC and is not a page-level visitor
        tracking pixel.
      </p>
      <p>
        We collect this analytics data to improve the Service, not to sell personal profiles to
        advertisers. The legal basis is our legitimate interest in operating and improving
        Songs2VID (and consent where required by local law). You can block analytics with browser
        settings, extensions, or Do Not Track / equivalent controls where supported. For rights
        requests related to analytics data, contact{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>.
      </p>

      <h2>11. Security</h2>
      <p>
        We implement appropriate technical and organizational measures to protect your data,
        including encryption in transit, encrypted storage of YouTube OAuth tokens at rest, hashed
        API keys, access controls, and isolated processing environments. No method of transmission
        or storage is 100% secure.
      </p>

      <h2>12. International transfers</h2>
      <p>
        If data is transferred outside your country, we ensure appropriate safeguards such as
        standard contractual clauses or equivalent mechanisms where required by law. Google, Stripe,
        Microsoft, and infrastructure providers may process data in other countries as described in
        their policies. Webhook destinations you configure may also receive data in other countries
        under your control.
      </p>

      <h2>13. Children</h2>
      <p>
        Songs2VID is not directed at children under 16. We do not knowingly collect personal data
        from children. If you believe a child has provided us data, please contact us.
      </p>

      <h2>14. Changes to this policy</h2>
      <p>
        We may update this Privacy Policy from time to time. Material changes will be posted on
        this page with an updated effective date. If we change how we use Google user data, we will
        update this policy and, where required, notify you or obtain renewed consent.
      </p>

      <h2>15. Contact</h2>
      <p>
        Questions about this Privacy Policy or our privacy practices:{" "}
        <a href={`mailto:${LEGAL_OPERATOR.email}`}>{LEGAL_OPERATOR.email}</a>
      </p>
    </LegalPageLayout>
  );
}