// upprofiler — Legal pages
// Privacy Policy, Terms of Service, Cookie Policy.
// Australian governing law; covers GDPR + CCPA + Australian Privacy Principles.

const LEGAL_LAST_UPDATED = 'May 2026';
const LEGAL_CONTACT_EMAIL = 'info@vertial.com';

function LegalLayout({ id, title, kicker, children, onNavigate }) {
  return (
    <div>
      <header className="nav" style={{ borderBottom: 'none', background: 'transparent' }}>
        <a onClick={() => onNavigate('/')} style={{ cursor: 'pointer' }}><Logo /></a>
        <div className="nav-right">
          <ThemeToggle />
          <button className="btn btn-tertiary btn-sm" onClick={() => onNavigate('/')}>Back</button>
        </div>
      </header>
      <div className="page prose">
        <PageHeader id={id} name={title} sub={kicker} />
        <div className="legal-doc" style={{
          background: 'var(--surface)',
          border: '1px solid var(--line)',
          borderRadius: 12,
          padding: '48px 56px',
        }}>
          <div style={{ fontSize: 13, color: 'var(--mute)', fontFamily: 'var(--font-mono)', textTransform: 'uppercase', letterSpacing: 1.5, marginBottom: 24 }}>
            Last updated · {LEGAL_LAST_UPDATED}
          </div>
          {children}
          <div style={{ marginTop: 48, paddingTop: 24, borderTop: '1px solid var(--line)', display: 'flex', gap: 16, flexWrap: 'wrap', justifyContent: 'space-between', alignItems: 'center' }}>
            <div className="row gap-16" style={{ flexWrap: 'wrap' }}>
              <a onClick={() => onNavigate('/privacy')} className="muted" style={{ cursor: 'pointer', fontSize: 13 }}>Privacy</a>
              <a onClick={() => onNavigate('/terms')} className="muted" style={{ cursor: 'pointer', fontSize: 13 }}>Terms</a>
              <a onClick={() => onNavigate('/cookies')} className="muted" style={{ cursor: 'pointer', fontSize: 13 }}>Cookies</a>
            </div>
            <div className="label-mono" style={{ fontSize: 11 }}>
              Questions? <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>
            </div>
          </div>
        </div>
      </div>
      <Footer />
    </div>
  );
}

function H2({ children }) {
  return (
    <h2 style={{
      fontSize: 22, fontWeight: 800, letterSpacing: '-0.01em',
      marginTop: 36, marginBottom: 14, color: 'var(--ink)',
    }}>{children}</h2>
  );
}
function H3({ children }) {
  return (
    <h3 style={{
      fontSize: 16, fontWeight: 700, letterSpacing: '-0.01em',
      marginTop: 24, marginBottom: 10, color: 'var(--ink)',
    }}>{children}</h3>
  );
}
function P({ children }) {
  return (
    <p style={{
      fontSize: 15, lineHeight: 1.7, color: 'var(--ink-soft)',
      marginBottom: 14,
    }}>{children}</p>
  );
}
function UL({ children }) {
  return (
    <ul style={{
      listStyle: 'disc', paddingLeft: 22,
      fontSize: 15, lineHeight: 1.7, color: 'var(--ink-soft)',
      marginBottom: 14,
    }}>{children}</ul>
  );
}
function LI({ children }) {
  return <li style={{ marginBottom: 6 }}>{children}</li>;
}

// ───────────────────────────────────────── PRIVACY ─────
function PagePrivacy({ onNavigate }) {
  return (
    <LegalLayout
      id="/privacy"
      title="Privacy Policy"
      kicker="What we collect, what we do with it, and what's yours to control."
      onNavigate={onNavigate}
    >
      <P>
        upprofiler is a free tool that scores how convincingly a LinkedIn profile and its recent posts tell the same story. This policy explains what data the tool processes when you use it, how that data is handled, and the rights you have over it.
      </P>
      <P>
        We aim for plain language. If anything below is unclear, email us at{' '}
        <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>{' '}
        and we'll explain — or fix the wording.
      </P>

      <H2>1. Who runs upprofiler</H2>
      <P>
        upprofiler is operated from Sydney, Australia, in partnership with Jasmin Alić (Bosnia & Herzegovina). Australian privacy law (the Privacy Act 1988 and the Australian Privacy Principles) is our home framework, and we also honour the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) for users in those jurisdictions.
      </P>

      <H2>2. What we collect</H2>

      <H3>2.1 Information you give us directly</H3>
      <UL>
        <LI><strong>LinkedIn profile URL.</strong> You paste a public LinkedIn profile URL into the scoring tool. We use that URL to fetch public profile data and to compute the conviction score.</LI>
        <LI><strong>Email address.</strong> If you submit your email to unlock the deeper report or to sign in via magic link, we store that email.</LI>
      </UL>

      <H3>2.2 Information we fetch on your behalf</H3>
      <P>
        When you submit a LinkedIn URL, we request publicly available data about that profile through the Harvest API. This typically includes: name, profile photo, headline, location, follower count, work history, top skills, and recent public posts. We do not access private or restricted LinkedIn data.
      </P>

      <H3>2.3 Information generated by the service</H3>
      <UL>
        <LI><strong>Your conviction score</strong> and the AI-generated analysis (themes, gaps, summary).</LI>
        <LI><strong>Score history.</strong> Each score is recorded so signed-in users can see their score timeline.</LI>
        <LI><strong>Session and authentication data.</strong> Session cookies, magic-link verification tokens, sign-in timestamps.</LI>
      </UL>

      <H3>2.4 Technical information</H3>
      <P>
        Our hosting provider (Vercel) logs basic request metadata for security and abuse prevention: IP address, user agent, request path, and timestamps. We do not run any analytics or advertising trackers.
      </P>

      <H2>3. How we use this data</H2>
      <UL>
        <LI><strong>To compute and deliver your score.</strong> Fetching the LinkedIn data, running the AI analysis, returning the result.</LI>
        <LI><strong>To send the welcome and monthly re-score emails</strong> you've opted in to.</LI>
        <LI><strong>To let you log in</strong> and see your score history.</LI>
        <LI><strong>To protect the service</strong> from abuse, fraud, and excessive usage.</LI>
        <LI><strong>To improve the product</strong> — in aggregate, never by reading individual records.</LI>
      </UL>
      <P>
        We do <strong>not</strong> sell your data, share it with advertisers, or use it to train AI models on your behalf.
      </P>

      <H2>4. Lawful basis (for EU/UK users under GDPR)</H2>
      <UL>
        <LI><strong>Consent</strong> — when you submit your email or paste a LinkedIn URL, you are actively choosing to use the tool. You can withdraw consent at any time.</LI>
        <LI><strong>Legitimate interest</strong> — running the service securely, preventing abuse, and improving the product.</LI>
        <LI><strong>Contractual necessity</strong> — sending you the score and the monthly re-score emails you signed up for.</LI>
      </UL>

      <H2>5. Third parties that process data on our behalf</H2>
      <P>
        We use the following sub-processors. Each is bound by their own privacy commitments and we only share the minimum data required:
      </P>
      <UL>
        <LI><strong>Harvest API</strong> (LinkedIn data retrieval) — receives the LinkedIn URL you submitted. <a href="https://docs.harvest-api.com" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>docs.harvest-api.com</a></LI>
        <LI><strong>OpenRouter / DeepSeek</strong> (AI analysis) — receives the profile and posts text we want analysed. The model we use (DeepSeek V4 Flash) is run with zero data retention through OpenRouter. <a href="https://openrouter.ai" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>openrouter.ai</a></LI>
        <LI><strong>Resend</strong> (email delivery) — receives your email address and the email content. <a href="https://resend.com/legal/privacy-policy" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>resend.com</a></LI>
        <LI><strong>Railway</strong> (database hosting) — stores subscriber records and score history. <a href="https://railway.com/legal/privacy" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>railway.com</a></LI>
        <LI><strong>Vercel</strong> (web hosting and serverless functions). <a href="https://vercel.com/legal/privacy-policy" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>vercel.com</a></LI>
      </UL>

      <H2>6. Data on third-party profiles</H2>
      <P>
        You can paste anyone's public LinkedIn URL into the tool. When you do, we process that person's public profile data on your behalf — the same data LinkedIn shows publicly. If you are the subject of a score you didn't initiate and want it deleted, email us at{' '}
        <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>{' '}
        and we'll erase the records associated with that URL within 30 days.
      </P>

      <H2>7. How long we keep your data</H2>
      <UL>
        <LI><strong>Subscriber email + LinkedIn URL:</strong> kept until you unsubscribe or request deletion.</LI>
        <LI><strong>Score history:</strong> kept for signed-in users as long as your account is active. Anonymous scores are kept for 12 months then purged.</LI>
        <LI><strong>Magic-link verification tokens:</strong> 5 minutes (then auto-expire).</LI>
        <LI><strong>Session cookies:</strong> up to 30 days, or until you sign out.</LI>
        <LI><strong>Vercel request logs:</strong> Vercel's standard retention (typically 24 hours to 30 days depending on plan).</LI>
      </UL>

      <H2>8. Your rights</H2>
      <P>
        Whatever jurisdiction you're in, you can request to:
      </P>
      <UL>
        <LI><strong>Access</strong> the personal data we hold about you.</LI>
        <LI><strong>Correct</strong> anything that's wrong.</LI>
        <LI><strong>Delete</strong> your account, your subscriber record, or your score history.</LI>
        <LI><strong>Export</strong> your data in a machine-readable format.</LI>
        <LI><strong>Unsubscribe</strong> from monthly re-score emails with one click.</LI>
        <LI><strong>Object</strong> to specific uses of your data.</LI>
      </UL>
      <P>
        Email{' '}
        <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>{' '}
        with any of these requests. We aim to respond within 14 days; we're legally required to respond within 30 days (GDPR) or 45 days (CCPA).
      </P>
      <P>
        If you're not satisfied, you can complain to your local data protection authority — in Australia that's the OAIC (Office of the Australian Information Commissioner), in the EU your national DPA, and in California the Attorney General's office.
      </P>

      <H2>9. Cookies and local storage</H2>
      <P>
        We use only what's necessary to make the tool work. Details are in our <a onClick={() => onNavigate('/cookies')} style={{ cursor: 'pointer', color: 'var(--pink)' }}>Cookie Policy</a>.
      </P>

      <H2>10. International data transfers</H2>
      <P>
        Our infrastructure providers (Vercel, Railway, Resend, OpenRouter) operate globally. Your data may be processed in countries outside your own — including the United States. Where required by law, transfers are protected by Standard Contractual Clauses or equivalent safeguards.
      </P>

      <H2>11. Security</H2>
      <P>
        We use industry-standard practices: TLS in transit, encryption at rest with our infrastructure providers, principle-of-least-access for internal database queries, and short-lived authentication tokens. No system is 100% secure; if we discover a breach affecting your data, we will notify you and the relevant authorities as required by law.
      </P>

      <H2>12. Children's privacy</H2>
      <P>
        upprofiler is intended for adults using LinkedIn for professional purposes. We do not knowingly collect data from anyone under 16. If you believe a minor has submitted data, email us and we'll delete it.
      </P>

      <H2>13. Changes to this policy</H2>
      <P>
        We may update this policy as the product evolves. We'll change the "Last updated" date at the top, and for material changes (e.g. new categories of data, new sub-processors) we'll email signed-in users in advance.
      </P>

      <H2>14. Contact</H2>
      <P>
        Email{' '}
        <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>{' '}
        for anything privacy-related. A human reads every message.
      </P>
    </LegalLayout>
  );
}

// ───────────────────────────────────────── TERMS ─────
function PageTerms({ onNavigate }) {
  return (
    <LegalLayout
      id="/terms"
      title="Terms of Service"
      kicker="The fine print, written like a person wrote it."
      onNavigate={onNavigate}
    >
      <P>
        By using upprofiler (the "Service") you agree to these Terms. If you don't agree, don't use the Service. That's it. Beyond this point everything below is the usual fine print, in plain English.
      </P>

      <H2>1. What the Service does</H2>
      <P>
        upprofiler is a free tool that, given a public LinkedIn profile URL, retrieves public profile information and recent posts, runs an AI analysis, and returns a "conviction score" — a 0-to-100 measure of how closely your profile claims and your recent content align.
      </P>
      <P>
        Optional features include emailing you the report, a monthly automatic re-score, and a magic-link sign-in to view your score history.
      </P>

      <H2>2. Who can use it</H2>
      <P>
        You must be at least 16 years old to use upprofiler. You're responsible for ensuring your use is allowed under the laws of the country you're using it from.
      </P>

      <H2>3. Acceptable use</H2>
      <P>You agree not to:</P>
      <UL>
        <LI>Use the Service to scrape, redistribute, or commercially resell the LinkedIn data we surface.</LI>
        <LI>Submit fake URLs, attempt to bypass rate limits, or otherwise abuse the service.</LI>
        <LI>Use the Service to harass, stalk, or surveil people. Use it for professional self-improvement and friendly diagnostics, not adversarial targeting.</LI>
        <LI>Reverse-engineer the AI scoring or attempt to extract the prompts.</LI>
        <LI>Use automated tools to score profiles in bulk without explicit written permission from us.</LI>
      </UL>

      <H2>4. Accounts and sign-in</H2>
      <P>
        Sign-in uses magic links. You are responsible for keeping access to your email address secure — anyone who can read your inbox can sign in as you.
      </P>

      <H2>5. The AI score is informational, not authoritative</H2>
      <P>
        The conviction score is generated by an AI model interpreting publicly available information. It is intended as a useful diagnostic, not a definitive judgment. Treat it as a coaching prompt, not a verdict. We make no warranty about its accuracy for any particular purpose, and decisions you make based on it are your own.
      </P>

      <H2>6. Intellectual property</H2>
      <P>
        upprofiler, including the score model, the user interface, and the upprofiler brand, are owned by us and our partners. You may freely share screenshots of your own score (including the OG image) for personal or promotional use. You may not copy or redistribute the tool itself, the source code, or branded assets without permission.
      </P>
      <P>
        Public LinkedIn profile data we surface remains the property and responsibility of its owner and of LinkedIn under their terms.
      </P>

      <H2>7. LinkedIn relationship</H2>
      <P>
        upprofiler is not affiliated with, endorsed by, or sponsored by LinkedIn Corporation. We access only the public profile data that LinkedIn already makes available without authentication, via a third-party API.
      </P>

      <H2>8. The Link Up community</H2>
      <P>
        Some links in the Service direct to{' '}
        <a href="https://whop.com/linkupbyjasmin" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>Jasmin Alić's Link Up community on Whop</a>.
        We may receive an affiliate commission when someone joins via these links. This does not change the price for you and we only ever link to communities and services we genuinely endorse.
      </P>

      <H2>9. Emails we send</H2>
      <P>You may receive:</P>
      <UL>
        <LI>A welcome email immediately after submitting your address.</LI>
        <LI>A monthly re-score email if you stay subscribed.</LI>
        <LI>Magic-link sign-in emails when you request one.</LI>
        <LI>Material policy-change notifications (rare).</LI>
      </UL>
      <P>
        Every email contains an unsubscribe link. We do not send marketing email to people who haven't opted in.
      </P>

      <H2>10. Service availability and changes</H2>
      <P>
        We aim for high uptime but make no SLA guarantees. We may modify, suspend, or discontinue parts of the Service at any time. For material changes, we'll give signed-in users reasonable notice.
      </P>

      <H2>11. Disclaimers</H2>
      <P>
        The Service is provided "as is" and "as available" without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Service will be error-free, uninterrupted, or accurate.
      </P>

      <H2>12. Limitation of liability</H2>
      <P>
        To the maximum extent permitted by law, our total liability for any claim arising out of or relating to the Service shall not exceed AUD $100, or the amount you paid us in the 12 months preceding the claim — whichever is greater. We are not liable for indirect, incidental, special, consequential, or punitive damages.
      </P>
      <P>
        Nothing in these Terms excludes liability that cannot be excluded by law — for Australian users that includes the consumer guarantees under the Australian Consumer Law.
      </P>

      <H2>13. Indemnity</H2>
      <P>
        You agree to indemnify us against claims, damages, or losses arising from your misuse of the Service, your breach of these Terms, or your violation of someone else's rights through your use of the Service.
      </P>

      <H2>14. Governing law and jurisdiction</H2>
      <P>
        These Terms are governed by the laws of New South Wales, Australia. Any dispute will be resolved exclusively in the courts of New South Wales.
      </P>

      <H2>15. Changes to these Terms</H2>
      <P>
        We may update these Terms from time to time. The "Last updated" date at the top reflects the current version. Continued use of the Service after changes means you accept the updated Terms.
      </P>

      <H2>16. Contact</H2>
      <P>
        Email{' '}
        <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>.
      </P>
    </LegalLayout>
  );
}

// ───────────────────────────────────────── COOKIES ─────
function PageCookies({ onNavigate }) {
  return (
    <LegalLayout
      id="/cookies"
      title="Cookie Policy"
      kicker="What we store on your device, why, and how to clear it."
      onNavigate={onNavigate}
    >
      <P>
        upprofiler uses only essential cookies and local storage. No analytics, no ad tracking, no third-party marketing pixels. The list below is everything.
      </P>

      <H2>1. Session cookie</H2>
      <UL>
        <LI><strong>What:</strong> A signed authentication cookie set by BetterAuth when you sign in via magic link.</LI>
        <LI><strong>Why:</strong> Keeps you signed in across page loads so you can see your score history.</LI>
        <LI><strong>How long:</strong> Up to 30 days, or until you sign out.</LI>
        <LI><strong>How to remove:</strong> Click "Sign out" on the /account page, or clear cookies for upprofiler.com in your browser settings.</LI>
      </UL>

      <H2>2. Local storage (functional)</H2>
      <P>We use the browser's <strong>localStorage</strong> for two small things:</P>
      <UL>
        <LI><strong>upprofiler-theme</strong> — remembers whether you've chosen light or dark mode. Defaults to your system preference.</LI>
        <LI><strong>upprofiler-unlocked:&lt;url&gt;</strong> — remembers that you've already submitted your email to unlock the deep report for a given profile, so we don't ask twice on the same browser.</LI>
        <LI><strong>upprofiler-cookie-ack</strong> — remembers that you've acknowledged this cookie notice.</LI>
      </UL>
      <P>
        These are first-party only and used solely to make the Service work the way you'd expect. Clearing site data in your browser will reset them.
      </P>

      <H2>3. No tracking</H2>
      <P>We do not use:</P>
      <UL>
        <LI>Google Analytics, Facebook Pixel, LinkedIn Insight Tag, or any other marketing/analytics scripts.</LI>
        <LI>Third-party advertising cookies.</LI>
        <LI>Fingerprinting techniques.</LI>
        <LI>Cross-site tracking of any kind.</LI>
      </UL>

      <H2>4. Cookies set by sub-processors</H2>
      <P>
        When you click an outbound link to a third-party service (e.g. our partner community at{' '}
        <a href="https://whop.com/linkupbyjasmin" target="_blank" rel="noopener" style={{ color: 'var(--pink)' }}>whop.com/linkupbyjasmin</a>), that service may set its own cookies under its own policy. We have no control over those.
      </P>

      <H2>5. Why no cookie banner?</H2>
      <P>
        Under the EU ePrivacy Directive and the GDPR, consent banners are only required for cookies that are not strictly necessary for the service. Because we only use cookies and storage you'd reasonably expect ("am I signed in?", "what theme did they pick?"), a banner isn't strictly required. We surface a small one-line notice on first visit anyway, so you know the score.
      </P>

      <H2>6. Contact</H2>
      <P>
        Questions about cookies or storage? Email{' '}
        <a href={`mailto:${LEGAL_CONTACT_EMAIL}`} style={{ color: 'var(--pink)' }}>{LEGAL_CONTACT_EMAIL}</a>.
      </P>
    </LegalLayout>
  );
}

window.PagePrivacy = PagePrivacy;
window.PageTerms = PageTerms;
window.PageCookies = PageCookies;