/* VALDEX — Privacy notice */

const UPDATED = "May 18, 2026";

function PrivacyPage() {
  return (
    <LegalShell
      title="Privacy notice"
      updated={UPDATED}
      intro={
        <React.Fragment>
          <p>
            This notice explains what personal data <strong>VALDEX LLC</strong> (a Wyoming
            limited liability company; <span className="term">"Valdex"</span>, <span className="term">"we"</span>,
            or <span className="term">"us"</span>) collects when you use our website at <a href="/">valdexai.com</a>{" "}
            or contact us about an engagement, why we collect it, on what legal basis, how we
            use it, who we share it with, and the choices you have.
          </p>
          <p>
            We try to keep this document short and readable. If you want the long
            jurisdictional drill-down, every section ends with a pointer to the regulator
            you'd write to.
          </p>
        </React.Fragment>
      }
      sections={[
        { id: "controller", h: "1. Who is the data controller", body: (
          <React.Fragment>
            <p>
              <strong>VALDEX LLC</strong> is the data controller for the personal data
              described in this notice.
            </p>
            <p>
              <strong>VALDEX LLC</strong><br />
              1309 Coffeen Ave, Ste 1200<br />
              Sheridan, WY 82801, United States<br />
              <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a> · (762) 760-1179
            </p>
            <p>
              We have not appointed a Data Protection Officer because our processing does
              not meet the GDPR Article 37 thresholds (we are not a public authority, we do
              not conduct large-scale systematic monitoring, and we do not process special-
              category data at scale). Our designated privacy contact is{" "}
              <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a>. If our scale
              changes, we will update this section.
            </p>
          </React.Fragment>
        )},
        { id: "data", h: "2. What we collect", body: (
          <React.Fragment>
            <p>We collect three categories of personal data:</p>
            <h3>a. Information you give us</h3>
            <ul>
              <li>Contact details you provide through the intake form, audit form, or by emailing us — typically name, work email, role, company, website, and a few sentences about what you're trying to do.</li>
              <li>Any documents, prompts, screenshots, or analytics access you share with us during an engagement or audit.</li>
              <li>Billing details if you become a client. Card numbers are handled by Stripe; we never see or store them on our servers — Stripe returns us a token and a last-four for reconciliation.</li>
            </ul>
            <h3>b. Information we collect automatically</h3>
            <ul>
              <li><strong>Cookieless web analytics.</strong> We use a privacy-respecting analytics tool that records page URL, referrer, country (derived from IP, then discarded), device class, and approximate session duration. No cookies are set for analytics. No cross-site tracking. No advertising identifiers. See <a href="/cookie-policy">cookie policy</a> for the complete cookie inventory.</li>
              <li><strong>Server logs.</strong> IP address, user-agent, request path, and timestamp — retained for 30 days for security, debugging, and abuse prevention.</li>
            </ul>
            <h3>c. Information from third parties</h3>
            <ul>
              <li>If you authorize us during an engagement, we access analytics platforms (e.g. GA4), ad accounts, and CMS instances on your behalf. We do not retain copies of that data outside our engagement workspace, and we do not share it with anyone else.</li>
              <li>If you reach out via a referral, we may receive your name and company from the referrer. We do not act on the introduction unless you contact us directly.</li>
            </ul>
            <p>
              We do not knowingly collect special categories of personal data (health,
              biometric, political opinions, etc.) and we ask that you not send such data to
              us unsolicited. If you do, we will delete it.
            </p>
          </React.Fragment>
        )},
        { id: "purposes", h: "3. Why we use it — purposes and legal basis", body: (
          <React.Fragment>
            <p>
              Under the EU/UK GDPR we must tell you the legal basis (Article 6) for each
              processing purpose. The table below is the operative one for us:
            </p>
            <table className="legal-table">
              <thead>
                <tr><th>Purpose</th><th>Data used</th><th>Lawful basis (GDPR Art. 6)</th></tr>
              </thead>
              <tbody>
                <tr>
                  <td>Reply to your intake or audit request and assess fit</td>
                  <td>Name, work email, company, role, the message you sent</td>
                  <td>Legitimate interests — responding to inbound business inquiries (Art. 6(1)(f))</td>
                </tr>
                <tr>
                  <td>Deliver the engagement we agreed to and produce the documents in your engagement charter</td>
                  <td>Everything in your engagement workspace</td>
                  <td>Performance of a contract (Art. 6(1)(b))</td>
                </tr>
                <tr>
                  <td>Invoicing, accounting, tax records</td>
                  <td>Company name, billing contact, invoice line items</td>
                  <td>Legal obligation under Wyoming and U.S. federal tax law (Art. 6(1)(c))</td>
                </tr>
                <tr>
                  <td>Operate the website, prevent abuse, secure our systems</td>
                  <td>Server logs, IP, user-agent</td>
                  <td>Legitimate interests — security and abuse prevention (Art. 6(1)(f))</td>
                </tr>
                <tr>
                  <td>Aggregate, anonymous web analytics</td>
                  <td>Country-level traffic, referrer, device class</td>
                  <td>Legitimate interests — understanding which pages are useful (Art. 6(1)(f)); cookieless, so no ePrivacy consent required</td>
                </tr>
                <tr>
                  <td>Transactional and status emails to clients</td>
                  <td>Your contact email; engagement state</td>
                  <td>Performance of a contract (Art. 6(1)(b))</td>
                </tr>
                <tr>
                  <td>Defend against legal claims; respond to lawful government requests</td>
                  <td>Whatever is responsive</td>
                  <td>Legitimate interests (Art. 6(1)(f)) and/or legal obligation (Art. 6(1)(c))</td>
                </tr>
              </tbody>
            </table>
            <p>
              We do <strong>not</strong> sell your personal data. We do not share it with
              advertising networks. We do not use it to train generative models — ours, our
              clients', or anyone else's. If our practice ever changes we will update this
              notice and notify existing clients before the change takes effect.
            </p>
          </React.Fragment>
        )},
        { id: "share", h: "4. Who we share it with", body: (
          <React.Fragment>
            <p>
              We share personal data only with the service providers we actually use to run
              the business and with our professional advisors. The current list lives on the{" "}
              <a href="/subprocessors">subprocessors page</a> and is summarized here:
            </p>
            <ul>
              <li><strong>Stripe, Inc.</strong> — invoicing and card processing (United States).</li>
              <li><strong>Google LLC (Google Workspace)</strong> — business email, documents, calendar (United States).</li>
              <li><strong>1Password (AgileBits Inc.)</strong> — credential storage (Canada).</li>
              <li><strong>Plausible Analytics</strong> — cookieless web analytics, EU-hosted (Germany).</li>
              <li><strong>Cloudflare, Inc.</strong> — DNS, edge caching, DDoS protection (global).</li>
              <li><strong>Our accountant and our attorney</strong>, when required for bookkeeping or legal review (United States).</li>
            </ul>
            <p>
              Each of these is under a written processor agreement that restricts use of
              your data to what is necessary to provide the service. None has the right to
              sell, repurpose, or train models on your data.
            </p>
            <p>
              We will disclose information when legally required (subpoena, court order,
              lawful government request). We will tell you about it unless the request itself
              prohibits us from doing so.
            </p>
          </React.Fragment>
        )},
        { id: "transfers", h: "5. International data transfers", body: (
          <React.Fragment>
            <p>
              We are a U.S. business and we process data with U.S.-based providers. If you
              contact us from outside the United States, your data will be transferred to
              and processed in the U.S.
            </p>
            <p>
              For transfers of EU/EEA, UK, or Swiss personal data to the U.S. we rely on:
            </p>
            <ul>
              <li>The <strong>EU–U.S. Data Privacy Framework</strong>, the <strong>UK Extension</strong>, and the <strong>Swiss–U.S. DPF</strong> where our subprocessor is certified (Google LLC and Stripe, Inc. are certified at the time of writing).</li>
              <li><strong>Standard Contractual Clauses (SCCs)</strong> for transfers to providers that rely on SCCs (1Password, Cloudflare), together with a transfer impact assessment kept on file.</li>
            </ul>
            <p>
              You can request a copy of the safeguards in place for any specific transfer
              by emailing <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a>.
            </p>
          </React.Fragment>
        )},
        { id: "retain", h: "6. How long we keep it", body: (
          <React.Fragment>
            <ul>
              <li><strong>Intake messages from people we don't end up working with</strong> — 12 months from last contact, then deleted.</li>
              <li><strong>Audit requests and the diagnostics we produce</strong> — 24 months from delivery, then deleted unless the prospect becomes a client.</li>
              <li><strong>Engagement records</strong> (contracts, invoices, deliverables, status notes) — 7 years after the engagement ends, for tax and contract purposes (U.S. statute-of-limitations and IRS record-retention rules).</li>
              <li><strong>Server logs</strong> — 30 days.</li>
              <li><strong>Web analytics</strong> — aggregate, retained indefinitely; no individual identifiers stored.</li>
              <li><strong>Client data inside our engagement workspace</strong> — until 30 days after termination, then irrecoverably deleted (we hand you back credentials and exit).</li>
            </ul>
          </React.Fragment>
        )},
        { id: "rights", h: "7. Your rights", body: (
          <React.Fragment>
            <p>
              Wherever you live, you can ask us to do any of the following with your
              personal data. We respond to verified requests within <strong>30 days</strong>
              (45 days for California requests under the CCPA — see Section 8). We will
              comply unless we have a documented legal reason not to.
            </p>
            <ul>
              <li><strong>Access</strong> — get a copy of what we have about you.</li>
              <li><strong>Rectification</strong> — correct anything that's wrong or out of date.</li>
              <li><strong>Erasure ("right to be forgotten")</strong> — delete it, subject to the retention requirements in Section 6.</li>
              <li><strong>Restriction of processing</strong> — tell us to pause active processing while a dispute is resolved.</li>
              <li><strong>Data portability</strong> — receive your data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.</li>
              <li><strong>Objection</strong> — object to processing based on legitimate interests, including objection to direct marketing (we don't currently send marketing, but the right stands).</li>
              <li><strong>Withdraw consent</strong> — where we rely on consent, withdraw it at any time. Withdrawal doesn't affect the lawfulness of processing before withdrawal.</li>
              <li><strong>Lodge a complaint</strong> — file with your local data-protection supervisory authority. For EU/EEA visitors that is your national DPA; for the UK that is the ICO (<a href="https://ico.org.uk/">ico.org.uk</a>); for California that is the CPPA (<a href="https://cppa.ca.gov/">cppa.ca.gov</a>). We'd appreciate the chance to address your concern first.</li>
            </ul>
            <p>
              <strong>How to make a request — two methods:</strong>
            </p>
            <ul>
              <li>Email <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a> with the request and enough information for us to verify your identity (typically the email address you used when contacting us).</li>
              <li>Mail a written request to <strong>VALDEX LLC, Attn: Privacy, 1309 Coffeen Ave, Ste 1200, Sheridan, WY 82801</strong>.</li>
            </ul>
            <p>
              You may use an <strong>authorized agent</strong> to submit a request on your behalf.
              We will ask for written authorization signed by you, and we may still verify
              your identity directly.
            </p>
            <p>
              <strong>We do not discriminate against you for exercising any of these rights.</strong>{" "}
              You will receive the same service, at the same price, with the same quality.
            </p>
          </React.Fragment>
        )},
        { id: "california", h: "8. Your California privacy rights (CCPA/CPRA)", body: (
          <React.Fragment>
            <p>
              This section applies to California residents and is in addition to the rights
              in Section 7. We provide it whether or not we currently meet the CCPA business
              thresholds, because we'd rather give you the rights than argue jurisdiction.
            </p>
            <h3>Categories of personal information collected in the last 12 months</h3>
            <table className="legal-table">
              <thead>
                <tr><th>CCPA category</th><th>What we actually collect</th><th>Source</th><th>Purpose</th></tr>
              </thead>
              <tbody>
                <tr>
                  <td>Identifiers</td>
                  <td>Name, work email, company name, IP address</td>
                  <td>You; web request</td>
                  <td>Reply to inquiry; security</td>
                </tr>
                <tr>
                  <td>Commercial information</td>
                  <td>Engagement charter, invoices, billing history</td>
                  <td>You; Stripe</td>
                  <td>Deliver and bill the engagement</td>
                </tr>
                <tr>
                  <td>Internet or network activity</td>
                  <td>Pages viewed, referrer, device class — cookieless</td>
                  <td>Your browser</td>
                  <td>Understand which pages are useful</td>
                </tr>
                <tr>
                  <td>Geolocation (coarse)</td>
                  <td>Country derived from IP, then discarded</td>
                  <td>Your browser</td>
                  <td>Aggregate analytics</td>
                </tr>
                <tr>
                  <td>Professional / employment information</td>
                  <td>Title, role, what you're trying to do at work</td>
                  <td>You</td>
                  <td>Assess fit</td>
                </tr>
                <tr>
                  <td>Inferences drawn from any of the above</td>
                  <td>Whether you look like a fit prospect</td>
                  <td>Internal</td>
                  <td>Decide whether to reply with a discovery call</td>
                </tr>
              </tbody>
            </table>
            <p>We do <strong>not</strong> collect: biometric information, geolocation beyond country, audio or visual recordings, sensitive personal information (precise geolocation, race/ethnicity, religious beliefs, union membership, genetic data, health information, sex life / sexual orientation, mail/email content, contents of messages, government-issued IDs, financial-account numbers, log-in credentials, citizenship status).</p>

            <h3>Categories of third parties we disclose PI to</h3>
            <p>
              Service providers and contractors only, listed on the{" "}
              <a href="/subprocessors">subprocessors page</a>. We do not disclose PI to data
              brokers, advertisers, or for cross-context behavioral advertising.
            </p>

            <h3>Sale and sharing of personal information</h3>
            <p>
              <strong>We do not sell or share your personal information</strong> as those terms are
              defined under the CCPA (including "share" for cross-context behavioral
              advertising). We have not done so in the preceding 12 months and have no
              intention to. Because we do not sell or share, no opt-out is operationally
              required — but you can confirm or formally request opt-out at any time via
              the methods in Section 7.
            </p>

            <h3>Sensitive personal information</h3>
            <p>
              We do not collect sensitive personal information as defined by the CPRA. If
              we ever do, you will have the right to limit its use to what is necessary to
              provide the service.
            </p>

            <h3>Your California rights</h3>
            <ul>
              <li><strong>Right to know</strong> — what categories of PI we collect, sources, purposes, third parties.</li>
              <li><strong>Right to delete</strong> — your PI, subject to retention exceptions in Section 6.</li>
              <li><strong>Right to correct</strong> — inaccurate PI.</li>
              <li><strong>Right to opt out of sale or sharing</strong> — N/A since we do neither, but the right is preserved.</li>
              <li><strong>Right to limit use and disclosure of sensitive PI</strong> — N/A since we do not collect it.</li>
              <li><strong>Right to non-discrimination</strong> — we will not deny service, charge a different price, or provide a different quality of service for exercising any of these rights.</li>
              <li><strong>Right to data portability</strong> — same as Section 7.</li>
            </ul>

            <p>
              <strong>Response timeline:</strong> we acknowledge receipt within 10 business
              days and substantively respond within 45 days. We may extend once by an
              additional 45 days where reasonably necessary, with notice to you.
            </p>

            <p>
              <strong>Authorized agents:</strong> California residents may use an authorized
              agent. We will require written, signed permission from you and may verify
              your identity directly.
            </p>

            <p>
              <strong>How to exercise:</strong> the two methods in Section 7 (email{" "}
              <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a> or mail to the
              office). You may also use the{" "}
              <a href="/privacy#california">Your California privacy choices</a> link in our
              footer to reach this section directly.
            </p>

            <h3>Shine the Light (Cal. Civ. Code § 1798.83)</h3>
            <p>
              California residents may request a notice describing categories of PI we
              shared with third parties for those third parties' direct marketing purposes
              in the prior calendar year. We do not share PI for third-party direct
              marketing.
            </p>

            <h3>Financial incentives</h3>
            <p>
              We do not offer loyalty programs, discounts in exchange for personal
              information, or other financial incentives.
            </p>
          </React.Fragment>
        )},
        { id: "cookies", h: "9. Cookies and similar technologies", body: (
          <p>
            We don't use cookies for tracking or advertising. We don't load third-party
            advertising scripts, pixels, or social-media beacons. The complete inventory of
            cookies and similar technologies in use on this site — including any strictly-
            necessary cookies and what they do — lives on the{" "}
            <a href="/cookie-policy">cookie policy</a> page.
          </p>
        )},
        { id: "security", h: "10. How we secure your data", body: (
          <React.Fragment>
            <p>
              We use commercially reasonable technical and organizational measures, including
              transport encryption (HTTPS/TLS) for the website, encryption at rest where our
              providers support it, single-sign-on with hardware-key second factor for
              employee accounts, credential storage in 1Password Business, least-privilege
              access to client workspaces, and an internal incident-response runbook.
              Full description on the <a href="/trust">trust &amp; security</a> page.
            </p>
            <p>
              No system is perfectly secure. If a personal-data breach occurs that is likely
              to result in a risk to your rights and freedoms, we will:
            </p>
            <ul>
              <li>Notify the relevant supervisory authority (e.g. an EU DPA, the UK ICO) within <strong>72 hours</strong> of becoming aware, where GDPR Article 33 applies.</li>
              <li>Notify affected data subjects without undue delay where the breach is likely to result in a <strong>high risk</strong> to their rights and freedoms (GDPR Article 34).</li>
              <li>For California residents, comply with Cal. Civ. Code § 1798.82 breach-notification requirements.</li>
            </ul>
          </React.Fragment>
        )},
        { id: "children", h: "11. Children", body: (
          <p>
            Our services are for businesses. We do not knowingly collect personal data from
            anyone under <strong>16</strong>. We do not direct our services at children. If
            you believe a child has provided us personal data, email us and we will delete
            it.
          </p>
        )},
        { id: "automated", h: "12. Automated decision-making", body: (
          <p>
            We do not subject you to legal or similarly significant decisions made solely
            by automated processing. Humans make the call on every engagement decision.
          </p>
        )},
        { id: "changes", h: "13. Changes to this notice", body: (
          <p>
            When we change this notice, we update the date at the top and add a one-line
            note describing the change. Material changes that affect existing clients are
            also emailed to those clients at least 14 days before they take effect.
          </p>
        )},
        { id: "contact", h: "14. Contact", body: (
          <React.Fragment>
            <p>Questions, requests, or complaints about this notice:</p>
            <p>
              <strong>VALDEX LLC</strong><br />
              Attn: Privacy<br />
              1309 Coffeen Ave, Ste 1200<br />
              Sheridan, WY 82801, United States<br />
              <a href="mailto:privacy@valdexai.com">privacy@valdexai.com</a> · (762) 760-1179
            </p>
          </React.Fragment>
        )},
      ]}
    />
  );
}

ReactDOM.createRoot(document.getElementById("root")).render(<PrivacyPage />);