craft2prints/src/app/privacy/page.tsx

import Link from 'next/link';
import LegalPage from '@/components/LegalPage';

export const metadata = { title: 'Privacy Policy — Craft2Prints' };

export default function PrivacyPage() {
  return (
    <LegalPage tag="Legal" title="Privacy Policy" lastUpdated="13 July 2026">
      <h2>Who we are</h2>
      <p>
        Craft2Prints is a UK-based sole trader business selling personalised and ready-made printed
        products at craft2prints.co.uk. For anything in this policy, you can reach us at{' '}
        <a href="mailto:sales@craft2prints.co.uk">sales@craft2prints.co.uk</a> or by post at
        [BUSINESS ADDRESS]. We are the &quot;data controller&quot; for the personal information
        described below, and we handle it in line with UK data protection law (the UK GDPR and the
        Data Protection Act 2018).
      </p>

      <h2>What we collect, and why</h2>
      <ul>
        <li>
          <strong>Orders</strong> — the items you buy, any design you created or uploaded (including
          photos), your email address, and the delivery address you give at checkout. We need these
          to make and ship your order (legal basis: performing our contract with you).
        </li>
        <li>
          <strong>Accounts</strong> — your name, email address, and password if you create an
          account. Passwords are stored only in securely hashed form — we never store or see the
          actual password (legal basis: contract).
        </li>
        <li>
          <strong>Custom photo requests</strong> — your name, email, the photo you send us, an
          optional phone number, and any notes, so we can create your design and reply (legal
          basis: taking steps at your request before a contract).
        </li>
        <li>
          <strong>Messages</strong> — messages you send through our contact form (emailed to us,
          not stored on the website) and design-approval chat messages (legal basis: legitimate
          interest in answering you and keeping a record of design approvals).
        </li>
        <li>
          <strong>Mailing list</strong> — your email (and name, if we have it) if you sign up for
          the newsletter, make an account, or place an order. Every mailing includes context on why
          you&apos;re receiving it, and you can be removed at any time by contacting us (legal
          basis: legitimate interest / consent for newsletter sign-ups).
        </li>
        <li>
          <strong>Security logs</strong> — your IP address is briefly recorded when you log in or
          check out, purely to block automated attacks. These records are automatically deleted
          within 24 hours (legal basis: legitimate interest in keeping the site secure).
        </li>
      </ul>

      <h2>What we never collect</h2>
      <p>
        Your card details never touch our servers. Payment is handled entirely by Stripe, a
        regulated payment processor — we only receive confirmation that payment succeeded, plus the
        email and delivery address you enter on Stripe&apos;s checkout page. We also run no
        advertising or analytics tracking of any kind.
      </p>

      <h2>Who we share data with</h2>
      <p>We never sell your data. It is shared only with the services that make the shop work:</p>
      <ul>
        <li>
          <strong>Stripe</strong> — processes payments (see{' '}
          <a href="https://stripe.com/gb/privacy" target="_blank" rel="noopener noreferrer">
            Stripe&apos;s privacy policy
          </a>
          ).
        </li>
        <li>
          <strong>Cloudflare</strong> — provides the bot-protection check (Turnstile) on our public
          forms.
        </li>
        <li>
          <strong>Our email provider</strong> ([EMAIL PROVIDER]) — delivers order and account
          emails to you.
        </li>
        <li>
          <strong>Our hosting provider</strong> ([HOSTING PROVIDER]) — runs the website and stores
          its database.
        </li>
      </ul>

      <h2>How long we keep it</h2>
      <ul>
        <li>Order records — kept for 6 years, as required for UK tax and accounting purposes.</li>
        <li>Account details — kept while your account exists; deleted on request.</li>
        <li>Custom-request photos and design chats — kept while we work on your request and for a
          reasonable period afterwards in case you return to order.</li>
        <li>Mailing list entries — kept until you ask to be removed.</li>
        <li>Security logs (IP addresses) — deleted automatically within 24 hours.</li>
      </ul>

      <h2>Your rights</h2>
      <p>Under UK GDPR you have the right to:</p>
      <ul>
        <li>Ask for a copy of the personal data we hold about you (access)</li>
        <li>Have inaccurate data corrected (rectification)</li>
        <li>Have your data deleted where we no longer need it (erasure)</li>
        <li>Receive your data in a portable format (portability)</li>
        <li>Object to or restrict certain uses of your data</li>
        <li>Withdraw consent at any time, where consent is the basis we rely on</li>
      </ul>
      <p>
        To exercise any of these, email{' '}
        <a href="mailto:sales@craft2prints.co.uk">sales@craft2prints.co.uk</a> or use the{' '}
        <Link href="/contact">contact form</Link> — we&apos;ll respond within one month. If
        you&apos;re unhappy with how we handle your data, you can complain to the Information
        Commissioner&apos;s Office at{' '}
        <a href="https://ico.org.uk" target="_blank" rel="noopener noreferrer">
          ico.org.uk
        </a>
        .
      </p>

      <h2>How we protect your data</h2>
      <p>
        The site is served over HTTPS, passwords are stored only as secure hashes, login sessions
        use signed, HTTP-only cookies, and login and checkout endpoints are rate-limited to block
        automated attacks. Access to customer data is limited to the shop owner.
      </p>

      <h2>Changes to this policy</h2>
      <p>
        If we change how we handle your data — for example, by adding analytics — we&apos;ll update
        this page and the date at the top before the change takes effect.
      </p>
    </LegalPage>
  );
}