import type { Metadata } from 'next';
import { LegalShell } from '@/components/landing';

export const metadata: Metadata = { title: 'Privacy policy — Qtrial', description: 'How Qtrial collects, uses and protects personal data.' };

export default function PrivacyPage() {
  return (
    <LegalShell title="Privacy policy" updated="September 2026">
      <section aria-labelledby="pp-1"><h2 id="pp-1" className="font-semibold">1. Who we are</h2>
        <p className="hint">Qtrial is a SaaS compliance workspace by <strong>Soulitum Labs</strong> for pharmaceutical organisations. Contact: <a className="link" href="mailto:hello@qtrial.app">hello@qtrial.app</a>.</p></section>
      <section aria-labelledby="pp-2"><h2 id="pp-2" className="font-semibold">2. Data we collect</h2>
        <p className="hint">Account data (name, work email, role, department), deviation and testing content you create, uploaded evidence files, audit logs, and consultation requests (name, organisation, email, phone, message). Each customer organisation's data is strictly isolated.</p></section>
      <section aria-labelledby="pp-3"><h2 id="pp-3" className="font-semibold">3. How we use it</h2>
        <p className="hint">To provide the service (auth, notifications, reminders, escalations), respond to consultation requests within 2 business hours, maintain security, and meet legal obligations. We never sell personal data.</p></section>
      <section aria-labelledby="pp-4"><h2 id="pp-4" className="font-semibold">4. Storage & security</h2>
        <p className="hint">MySQL with tenant isolation, bcrypt-hashed passwords, HTTP-only session cookies, encrypted SMTP secrets, malware-scanned uploads, and audit logging on every mutation. Backups are encrypted at rest.</p></section>
      <section aria-labelledby="pp-5"><h2 id="pp-5" className="font-semibold">5. Retention</h2>
        <p className="hint">Operational data is kept while your organisation is active and per your retention needs; consultation requests are kept for 24 months. Deleted records are soft-deleted for audit integrity unless erasure is requested.</p></section>
      <section aria-labelledby="pp-6"><h2 id="pp-6" className="font-semibold">6. Your rights</h2>
        <p className="hint">Access, correction, export, and erasure — email <a className="link" href="mailto:hello@qtrial.app">hello@qtrial.app</a>. EU/UK users: see our <a className="link" href="/gdpr">GDPR compliance</a> page.</p></section>
      <section aria-labelledby="pp-7"><h2 id="pp-7" className="font-semibold">7. Cookies</h2>
        <p className="hint">One strictly-necessary session cookie (<span className="font-mono">pharma_session</span>) plus a theme preference in local storage. No advertising trackers.</p></section>
    </LegalShell>
  );
}