nixpanel-website/views/privacy.php

<?php $pageTitle = 'Privacy Policy — NixPanel'; ?>

<div class="max-w-3xl mx-auto px-4 sm:px-6 lg:px-8 py-20">
    <h1 class="text-4xl font-bold text-white mb-2">Privacy Policy</h1>
    <p class="text-gray-500 text-sm mb-12">Last updated: April 25, 2025</p>

    <div class="space-y-10 text-gray-300 leading-relaxed">

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">1. Who We Are</h2>
            <p>NixPanel operates nixpanel.io and the NixPanel licensing service. When we say "NixPanel", "we", "us", or "our", we mean the NixPanel service. Contact: <a href="mailto:[email protected]" class="text-brand-400 hover:underline">[email protected]</a>.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">2. Information We Collect</h2>

            <h3 class="text-base font-medium text-gray-200 mb-2 mt-4">Account information</h3>
            <ul class="list-disc list-inside space-y-1 text-gray-400">
                <li>Full name and email address (provided at registration)</li>
                <li>Password (stored as an Argon2id hash — we never store plaintext passwords)</li>
            </ul>

            <h3 class="text-base font-medium text-gray-200 mb-2 mt-4">Billing information</h3>
            <ul class="list-disc list-inside space-y-1 text-gray-400">
                <li>Stripe customer ID and subscription ID</li>
                <li>Plan name, billing interval, and subscription status</li>
                <li>Card details are handled entirely by Stripe — we never see or store your card number, CVV, or expiry date</li>
            </ul>

            <h3 class="text-base font-medium text-gray-200 mb-2 mt-4">License information</h3>
            <ul class="list-disc list-inside space-y-1 text-gray-400">
                <li>Your server's public IP address (required for license binding)</li>
                <li>License activation and validation timestamps</li>
                <li>IP change history</li>
            </ul>

            <h3 class="text-base font-medium text-gray-200 mb-2 mt-4">Usage information</h3>
            <ul class="list-disc list-inside space-y-1 text-gray-400">
                <li>Standard Apache access logs (IP address, user agent, page visited, timestamp) — retained for 30 days</li>
                <li>License validation requests from your panel to our licensing server</li>
            </ul>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">3. How We Use Your Information</h2>
            <ul class="list-disc list-inside space-y-2 text-gray-400">
                <li>To create and manage your account</li>
                <li>To process payments and manage your subscription via Stripe</li>
                <li>To issue, validate, and manage your NixPanel license</li>
                <li>To send transactional emails (email verification, password reset, billing receipts)</li>
                <li>To respond to support requests</li>
                <li>To detect and prevent fraud and abuse</li>
                <li>To comply with legal obligations</li>
            </ul>
            <p class="mt-4">We do <strong class="text-white">not</strong> use your data for advertising, and we do <strong class="text-white">not</strong> sell your data to third parties.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">4. Third-Party Services</h2>

            <h3 class="text-base font-medium text-gray-200 mb-2 mt-4">Stripe</h3>
            <p class="text-gray-400">Payment processing is handled by <a href="https://stripe.com" target="_blank" rel="noreferrer" class="text-brand-400 hover:underline">Stripe</a>. When you subscribe, you interact directly with Stripe's systems. Stripe's <a href="https://stripe.com/privacy" target="_blank" rel="noreferrer" class="text-brand-400 hover:underline">Privacy Policy</a> governs how they handle your payment data.</p>

            <h3 class="text-base font-medium text-gray-200 mb-2 mt-4">Email delivery</h3>
            <p class="text-gray-400">Transactional emails (verification, password reset) are sent via an SMTP provider. Your email address is shared with the provider solely for delivery purposes.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">5. Data Retention</h2>
            <ul class="list-disc list-inside space-y-2 text-gray-400">
                <li>Account and subscription data is retained while your account is active and for 90 days after deletion</li>
                <li>Billing records are retained for 7 years as required by law</li>
                <li>Web server access logs are purged after 30 days</li>
                <li>License validation logs are retained for 90 days</li>
            </ul>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">6. Your Rights</h2>
            <p class="mb-3">Depending on your location, you may have the right to:</p>
            <ul class="list-disc list-inside space-y-1 text-gray-400">
                <li>Access the personal data we hold about you</li>
                <li>Correct inaccurate data</li>
                <li>Request deletion of your account and associated data</li>
                <li>Export your data in a portable format</li>
                <li>Object to or restrict certain processing</li>
            </ul>
            <p class="mt-4">To exercise any of these rights, email <a href="mailto:[email protected]" class="text-brand-400 hover:underline">[email protected]</a>. We will respond within 30 days.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">7. Security</h2>
            <p>We take security seriously. Passwords are hashed with Argon2id. All data in transit is encrypted via TLS. Access to production databases is restricted to internal systems only. We follow responsible disclosure for any vulnerabilities — see our <a href="https://github.com/NixReaper/nixpanel/blob/master/SECURITY.md" target="_blank" rel="noreferrer" class="text-brand-400 hover:underline">Security Policy</a>.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">8. Cookies</h2>
            <p>We use a single session cookie to keep you logged in. We do not use tracking, analytics, or advertising cookies. No third-party cookies are set by nixpanel.io.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">9. Children</h2>
            <p>NixPanel is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have done so in error, contact us immediately.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">10. Changes to This Policy</h2>
            <p>We may update this Privacy Policy from time to time. Material changes will be communicated via email. Continued use of NixPanel after changes are effective constitutes acceptance of the revised policy.</p>
        </section>

        <section>
            <h2 class="text-xl font-semibold text-white mb-3">11. Contact</h2>
            <p>Privacy questions or requests: <a href="mailto:[email protected]" class="text-brand-400 hover:underline">[email protected]</a></p>
        </section>

    </div>
</div>