import type { Metadata } from "next";

export const metadata: Metadata = {
  title: "Privacy Policy",
  description:
    "AdultWorld privacy policy. Learn how we collect, use, and protect your personal information.",
};

export default function PrivacyPolicyPage() {
  return (
    <div className="max-w-3xl mx-auto space-y-6">
      <h1 className="text-2xl font-bold">Privacy Policy</h1>
      <p className="text-text-muted text-sm">Last updated: 26 March 2026</p>

      <div className="bg-surface rounded-lg p-6 space-y-4 text-text-muted">
        <h2 className="text-lg font-semibold text-gold">
          Data Controller Information
        </h2>
        <p>
          AdultWorld (&quot;we&quot;, &quot;us&quot;, or &quot;our&quot;)
          operates the platform at adultworld.ai and is the data controller
          responsible for your personal data. If you have any questions about
          this Privacy Policy or our data practices, you may contact our Data
          Protection Officer at{" "}
          <a
            href="mailto:hello@adultworld.ai"
            className="text-gold hover:underline"
          >
            hello@adultworld.ai
          </a>
          .
        </p>

        <h2 className="text-lg font-semibold text-gold">
          What Data We Collect
        </h2>
        <p>We collect the following categories of personal data:</p>
        <ul className="list-disc list-inside space-y-2 ml-2">
          <li>
            <strong className="text-text">Account information</strong> &mdash;
            Email address, username, and password hash. This data is required to
            create and secure your account.
          </li>
          <li>
            <strong className="text-text">Profile data</strong> &mdash; Photos,
            biography, services offered, rates, and location information that
            you voluntarily provide to build your public profile.
          </li>
          <li>
            <strong className="text-text">Usage data</strong> &mdash; IP
            address, device type, browser type and version, pages visited, and
            interaction patterns. This data is collected automatically when you
            use our platform.
          </li>
          <li>
            <strong className="text-text">Communication data</strong> &mdash;
            Messages sent and received through our platform messaging system.
          </li>
          <li>
            <strong className="text-text">Payment data</strong> &mdash;
            Transaction records processed via Stripe. We do not store your
            credit card numbers, CVV, or full payment card details on our
            servers. All payment information is handled directly by Stripe in
            accordance with PCI DSS standards.
          </li>
          <li>
            <strong className="text-text">Verification data</strong> &mdash;
            Age verification logs and results, including records of completed
            verification checks for regulatory compliance.
          </li>
        </ul>

        <h2 className="text-lg font-semibold text-gold">
          Why We Collect Your Data
        </h2>
        <p>We process your personal data for the following purposes:</p>
        <ul className="list-disc list-inside space-y-2 ml-2">
          <li>
            <strong className="text-text">Providing services</strong> &mdash;
            To operate the platform, manage your account, facilitate
            connections, and process payments.
          </li>
          <li>
            <strong className="text-text">Age verification</strong> &mdash; To
            comply with legal requirements, particularly under UK law, ensuring
            all users are at least 18 years of age.
          </li>
          <li>
            <strong className="text-text">Safety and security</strong> &mdash;
            To protect our users, detect fraud, prevent abuse, and maintain the
            integrity of the platform.
          </li>
          <li>
            <strong className="text-text">Analytics</strong> &mdash; To
            understand how users interact with our platform and to improve the
            user experience.
          </li>
          <li>
            <strong className="text-text">Communication</strong> &mdash; To
            send you service-related notifications, respond to your enquiries,
            and provide customer support.
          </li>
        </ul>

        <h2 className="text-lg font-semibold text-gold">
          Legal Basis for Processing (GDPR)
        </h2>
        <p>
          Under the General Data Protection Regulation (GDPR) and the UK Data
          Protection Act 2018, we rely on the following legal bases for
          processing your personal data:
        </p>
        <ul className="list-disc list-inside space-y-2 ml-2">
          <li>
            <strong className="text-text">Consent</strong> &mdash; Where you
            have given clear consent for us to process your personal data for a
            specific purpose, such as marketing communications or optional
            cookies.
          </li>
          <li>
            <strong className="text-text">Contract</strong> &mdash; Processing
            is necessary for the performance of a contract with you, including
            providing platform services, managing your account, and processing
            payments.
          </li>
          <li>
            <strong className="text-text">Legitimate interest</strong> &mdash;
            Processing is necessary for our legitimate interests (or those of a
            third party), such as fraud prevention, platform security, and
            service improvement, provided these interests are not overridden by
            your rights.
          </li>
          <li>
            <strong className="text-text">Legal obligation</strong> &mdash;
            Processing is necessary to comply with a legal obligation, such as
            age verification requirements and law enforcement requests.
          </li>
        </ul>

        <h2 className="text-lg font-semibold text-gold">Data Sharing</h2>
        <p>
          We do not sell your personal data. We share data only with the
          following trusted third-party service providers, each of which is
          bound by data processing agreements:
        </p>
        <ul className="list-disc list-inside space-y-2 ml-2">
          <li>
            <strong className="text-text">Supabase</strong> &mdash; Database
            hosting and backend infrastructure. Data is stored in secure,
            managed cloud environments.
          </li>
          <li>
            <strong className="text-text">Stripe</strong> &mdash; Payment
            processing. Stripe handles all payment card information directly and
            is PCI DSS Level 1 certified.
          </li>
          <li>
            <strong className="text-text">Email provider</strong> &mdash;
            Transactional email delivery for account notifications, password
            resets, and service communications.
          </li>
          <li>
            <strong className="text-text">Cloudflare</strong> &mdash; Content
            delivery, DDoS protection, and bot mitigation through Cloudflare
            Turnstile.
          </li>
          <li>
            <strong className="text-text">Yoti</strong> &mdash; Age
            verification provider for UK users, ensuring compliance with the UK
            Online Safety Act 2023.
          </li>
        </ul>
        <p>
          We may also disclose your data where required to do so by law, in
          response to valid legal process, or to protect the rights, property,
          or safety of AdultWorld, our users, or the public.
        </p>

        <h2 className="text-lg font-semibold text-gold">Data Retention</h2>
        <ul className="list-disc list-inside space-y-2 ml-2">
          <li>
            <strong className="text-text">Account data</strong> is retained for
            as long as your account remains active.
          </li>
          <li>
            <strong className="text-text">Deleted accounts</strong> &mdash;
            When you delete your account, your personal data is permanently
            removed within 30 days. Certain anonymised records may be retained
            for legal compliance.
          </li>
          <li>
            <strong className="text-text">Verification documents</strong> are
            deleted within 30 days of successful verification. Only the
            verification result (pass/fail) is retained.
          </li>
          <li>
            <strong className="text-text">Transaction records</strong> may be
            retained for up to 7 years as required by financial regulations.
          </li>
        </ul>

        <h2 className="text-lg font-semibold text-gold">
          Your Rights (GDPR Articles 13&ndash;22)
        </h2>
        <p>
          Under the GDPR and UK data protection law, you have the following
          rights regarding your personal data:
        </p>
        <ul className="list-disc list-inside space-y-2 ml-2">
          <li>
            <strong className="text-text">Right of access</strong> &mdash; You
            can request a copy of all personal data we hold about you.
          </li>
          <li>
            <strong className="text-text">Right to rectification</strong>{" "}
            &mdash; You can request correction of inaccurate or incomplete data.
          </li>
          <li>
            <strong className="text-text">Right to erasure</strong> &mdash; You
            can request deletion of your personal data (&quot;right to be
            forgotten&quot;).
          </li>
          <li>
            <strong className="text-text">Right to restriction</strong> &mdash;
            You can request that we limit the processing of your data in certain
            circumstances.
          </li>
          <li>
            <strong className="text-text">Right to data portability</strong>{" "}
            &mdash; You can request your data in a structured, commonly used,
            machine-readable format.
          </li>
          <li>
            <strong className="text-text">Right to object</strong> &mdash; You
            can object to processing based on legitimate interests or direct
            marketing.
          </li>
        </ul>
        <p>
          To exercise any of these rights, please contact us at{" "}
          <a
            href="mailto:hello@adultworld.ai"
            className="text-gold hover:underline"
          >
            hello@adultworld.ai
          </a>
          . We will respond to your request within 30 days. You also have the
          right to lodge a complaint with your local data protection authority
          (in the UK, the Information Commissioner&apos;s Office).
        </p>

        <h2 className="text-lg font-semibold text-gold">
          Children&apos;s Privacy
        </h2>
        <p>
          AdultWorld is strictly for adults aged 18 and over. We do not
          knowingly collect personal data from anyone under the age of 18. If we
          become aware that we have inadvertently collected data from a minor,
          we will take immediate steps to delete that data and terminate the
          associated account.
        </p>

        <h2 className="text-lg font-semibold text-gold">
          International Data Transfers
        </h2>
        <p>
          Your data may be transferred to and processed in countries outside the
          UK and European Economic Area (EEA). Where such transfers occur, we
          ensure that appropriate safeguards are in place, including Standard
          Contractual Clauses (SCCs) approved by the European Commission and the
          UK Information Commissioner&apos;s Office, to protect your data in
          accordance with GDPR requirements.
        </p>

        <h2 className="text-lg font-semibold text-gold">Security Measures</h2>
        <p>
          We implement appropriate technical and organisational measures to
          protect your personal data against unauthorised access, alteration,
          disclosure, or destruction. These measures include encryption of data
          in transit and at rest, secure authentication mechanisms, regular
          security audits, and access controls limiting data access to
          authorised personnel only. No system is completely secure, however, and
          we cannot guarantee absolute security.
        </p>

        <h2 className="text-lg font-semibold text-gold">
          Updates to This Policy
        </h2>
        <p>
          We may update this Privacy Policy from time to time. Material changes
          will be communicated via a notice on our platform or by email. We
          encourage you to review this policy periodically. The &quot;Last
          updated&quot; date at the top indicates when this policy was most
          recently revised.
        </p>

        <h2 className="text-lg font-semibold text-gold">Contact Us</h2>
        <p>
          For any questions or concerns about this Privacy Policy or our data
          practices, please contact our Data Protection Officer at{" "}
          <a
            href="mailto:hello@adultworld.ai"
            className="text-gold hover:underline"
          >
            hello@adultworld.ai
          </a>
          .
        </p>
      </div>
    </div>
  );
}