export const metadata = {
  title: "Privacy Policy — Trackopia",
  description: "How Trackopia collects, uses, stores and deletes data for the Shopify affiliate marketing app.",
};

const UPDATED = "21 July 2026";
const SUPPORT_EMAIL = "support@trackopia.in";

function Section({ title, children }: { title: string; children: React.ReactNode }) {
  return (
    <section className="mt-10">
      <h2 className="text-lg font-semibold tracking-tight text-gray-900">{title}</h2>
      <div className="mt-3 space-y-3 text-[15px] leading-relaxed text-gray-600">{children}</div>
    </section>
  );
}

export default function PrivacyPage() {
  return (
    <main className="bg-white">
      <div className="mx-auto max-w-3xl px-6 py-16">
        <h1 className="text-3xl font-bold tracking-tight text-gray-900">Privacy Policy</h1>
        <p className="mt-2 text-sm text-gray-500">Last updated: {UPDATED}</p>

        <p className="mt-6 text-[15px] leading-relaxed text-gray-600">
          Trackopia (&ldquo;we&rdquo;, &ldquo;the app&rdquo;) is an affiliate and influencer marketing app for
          Shopify stores. This policy explains what data the app collects when a merchant installs it, why we
          collect it, how long we keep it, and the choices merchants and affiliates have.
        </p>

        <Section title="1. Data we collect from the store">
          <p>When a merchant installs Trackopia on their Shopify store, we receive and store:</p>
          <ul className="list-disc space-y-1 pl-5">
            <li><strong>Store details</strong> — shop domain, store name, currency and timezone.</li>
            <li><strong>Orders</strong> — order id, totals, discount codes used, and order status. We use these to attribute a sale to an affiliate and calculate commission.</li>
            <li><strong>Customer details tied to an attributed order</strong> — email address and whether the customer is new or returning. This is used only to attribute the order and, if the merchant enables customer&ndash;affiliate binding, to link that customer&rsquo;s future orders to the same affiliate.</li>
            <li><strong>Products</strong> — product and collection names, used so affiliates can generate product-specific referral links.</li>
            <li><strong>Discount codes</strong> — created by the app on the merchant&rsquo;s behalf as affiliate coupons.</li>
          </ul>
          <p>
            We request only the Shopify permissions the app needs to function:
            <code className="mx-1 rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">read_orders</code>,
            <code className="mx-1 rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">write_discounts</code>,
            <code className="mx-1 rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">read_products</code>,
            <code className="mx-1 rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">write_script_tags</code> and
            <code className="mx-1 rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">write_gift_cards</code>.
          </p>
        </Section>

        <Section title="2. Data we collect from affiliates">
          <p>
            People who sign up to a merchant&rsquo;s affiliate program through Trackopia provide their name, email
            address, password (stored only as a salted hash), and optionally a social handle, website, and payout
            details such as a UPI id, PayPal email or bank reference. Merchants may add their own custom signup
            fields; anything collected there is stored on the merchant&rsquo;s behalf.
          </p>
        </Section>

        <Section title="3. Data we collect from store visitors">
          <p>
            When a visitor arrives at the merchant&rsquo;s store through an affiliate referral link, the app stores a
            referral identifier in the browser (cookie or local storage) so that a later purchase can be credited to
            the correct affiliate. We also record the click, its timestamp and the IP address for fraud prevention.
            We do <strong>not</strong> build advertising profiles, sell data, or track visitors across unrelated
            websites.
          </p>
        </Section>

        <Section title="4. How we use data">
          <ul className="list-disc space-y-1 pl-5">
            <li>Attribute orders to the correct affiliate and calculate commission.</li>
            <li>Show merchants and affiliates their own reports, balances and payout history.</li>
            <li>Create discount codes, gift cards and referral links in the merchant&rsquo;s store.</li>
            <li>Send transactional email (signup approval, commission earned, payout processed).</li>
            <li>Detect fraud such as self-referrals and duplicate signups.</li>
          </ul>
          <p>We do not sell personal data, and we do not use it to train machine-learning models.</p>
        </Section>

        <Section title="5. Sub-processors and sharing">
          <p>Data is shared only with services required to run the app:</p>
          <ul className="list-disc space-y-1 pl-5">
            <li><strong>Shopify</strong> — the source of store, order and product data.</li>
            <li><strong>Marcadeo</strong> (partners.marcadeo.com) — our tracking backbone, which records clicks and conversions.</li>
            <li><strong>Our hosting provider</strong> — servers located in India that run the app and its database.</li>
            <li><strong>Email delivery provider</strong> — used only to send transactional email.</li>
            <li><strong>Google reCAPTCHA</strong> — only if the merchant enables it on their signup form.</li>
          </ul>
        </Section>

        <Section title="6. Retention and deletion">
          <p>
            We keep data for as long as the app is installed. When a merchant uninstalls Trackopia, we stop
            processing their data and delete the store&rsquo;s access token immediately. Remaining store data is
            deleted within 90 days of uninstall unless the merchant asks us to remove it sooner.
          </p>
          <p>
            We honour Shopify&rsquo;s mandatory privacy webhooks. On a{" "}
            <code className="rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">customers/redact</code> or{" "}
            <code className="rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">shop/redact</code> request we erase the
            relevant records, and on a{" "}
            <code className="rounded bg-gray-100 px-1.5 py-0.5 text-[13px]">customers/data_request</code> we return
            the data we hold for that customer.
          </p>
        </Section>

        <Section title="7. Your rights">
          <p>
            Merchants, affiliates and customers can ask us to access, correct, export or delete their personal data.
            Customers of a Shopify store should contact that store, which will forward the request to us; we respond
            within 30 days. Affiliates can request deletion of their account directly at the address below.
          </p>
        </Section>

        <Section title="8. Security">
          <p>
            All traffic is served over HTTPS. Passwords are stored as salted hashes and never in plain text. Access
            tokens are stored encrypted at rest, admin access requires a verified Shopify session token, and the
            affiliate portal is protected by signed session tokens. Access to production systems is limited to
            authorised personnel.
          </p>
        </Section>

        <Section title="9. Children">
          <p>The app is not intended for anyone under 16, and we do not knowingly collect their data.</p>
        </Section>

        <Section title="10. Changes to this policy">
          <p>
            If this policy changes materially, we will update the date at the top of this page and notify merchants
            inside the app.
          </p>
        </Section>

        <Section title="11. Contact">
          <p>
            Questions or requests about privacy:{" "}
            <a className="font-medium text-[#1a3c6e] underline" href={`mailto:${SUPPORT_EMAIL}`}>
              {SUPPORT_EMAIL}
            </a>
          </p>
        </Section>

        <footer className="mt-14 border-t border-gray-200 pt-6 text-sm text-gray-500">
          © {new Date().getFullYear()} Trackopia. All rights reserved.
        </footer>
      </div>
    </main>
  );
}