---
export const prerender = true;

import LegalLayout from "../../layouts/LegalLayout.astro";
---

<LegalLayout
  title="Privacy policy"
  description="Privacy policy and personal-data handling at Rubis sur l'ongle."
  eyebrow="Your data"
  h1={`Privacy <em>policy</em>`}
  lede="Rubis sur l'ongle is GDPR-compliant. Your invoices, your clients and your business data stay yours. Here is exactly what we collect, why, and what control you keep."
  lastUpdated="May 7, 2026"
>
  <div class="callout">
    <p>
      <strong>English summary.</strong> The official version of this policy is
      the French one at <a href="/confidentialite">/confidentialite</a>.
    </p>
  </div>

  <h2 id="controller">1. Data controller</h2>
  <p>
    <strong>Arthur Barré</strong>, sole trader (SIRET 952 196 442 00018),
    8 rue Euthymènes, 13001 Marseille, France. Contact:
    <a href="mailto:contact@rubis.pro">contact@rubis.pro</a>.
  </p>

  <h2 id="data">2. What we collect</h2>
  <ul>
    <li><strong>Account</strong> — email, hashed password, optional name and company.</li>
    <li><strong>Invoices and clients</strong> — invoice PDFs, amounts, due dates, client contact details you upload or enter.</li>
    <li><strong>Email tracking</strong> — open/click data on reminders sent through the service.</li>
    <li><strong>Usage</strong> — minimal anonymous product analytics (PostHog, EU-hosted).</li>
  </ul>

  <h2 id="purpose">3. Why we collect it</h2>
  <p>
    To operate the service: send reminders on your behalf, run OCR on uploaded
    documents, generate stats, bill paid plans (via Stripe), and provide
    support.
  </p>

  <h2 id="hosting">4. Where it lives</h2>
  <p>
    All data is stored encrypted in France on OVH infrastructure. We do not
    transfer personal data outside the EU.
  </p>

  <h2 id="retention">5. Retention</h2>
  <p>
    Data is kept while your account is active and for up to 12 months after
    account closure for legal-archive purposes (invoicing, accounting). You
    can request earlier deletion at any time.
  </p>

  <h2 id="rights">6. Your rights</h2>
  <p>
    Under GDPR, you can access, rectify, erase, restrict processing of, port,
    or object to processing of your personal data. Email
    <a href="mailto:contact@rubis.pro">contact@rubis.pro</a> to exercise any
    of these rights. You can also file a complaint with the French data
    protection authority (CNIL).
  </p>

  <h2 id="subprocessors">7. Sub-processors</h2>
  <ul>
    <li><strong>OVH</strong> — hosting (France).</li>
    <li><strong>Stripe</strong> — billing (Ireland, GDPR-compliant).</li>
    <li><strong>Resend</strong> — outbound email delivery.</li>
    <li><strong>PostHog</strong> — anonymous product analytics (EU region).</li>
    <li><strong>Powens</strong> — bank read-only connection (when you opt in to bank detection, AISP-licensed by the ACPR).</li>
  </ul>

  <h2 id="cookies">8. Cookies</h2>
  <p>
    The landing site sets no analytics or advertising cookies. The app sets
    only strictly necessary cookies for authentication and session management.
  </p>

  <h2 id="updates">9. Updates</h2>
  <p>
    This policy may evolve. The current version is dated at the top of this
    page. Material changes will be notified via email or in-app.
  </p>
</LegalLayout>