datewise/app/routes/terms.tsx
metatroncubeswdev 1d2d943d54 feat(security): encrypt customer personal data at rest
- Prisma extension seals booking name/email/phone/address and waitlist contacts with
  AES-256-GCM on write and opens them on read (incl. nested reads)
- keyed-hash columns for exact email/phone lookups (privacy webhooks, booking search,
  waitlist de-duplication); migration 0002
- tests prove only ciphertext is stored; privacy/terms/SECURITY.md updated to match

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 18:56:05 -04:00

61 lines
3.6 KiB
TypeScript

// Public terms of service with data processing terms (the merchant agreement Shopify's protected customer
// data requirements ask for): https://<app domain>/terms
import type { MetaFunction } from "react-router";
export const meta: MetaFunction = () => [{ title: "Terms of service · Datewise" }];
const CONTACT = "info@metatroncubesolutions.com";
export default function Terms() {
return (
<main style={{ maxWidth: 720, margin: "48px auto", padding: "0 20px", font: "16px/1.6 Inter, 'Segoe UI', system-ui, sans-serif", color: "#1f2937" }}>
<p><a href="/">Datewise</a></p>
<h1>Terms of service</h1>
<p>
Last updated: October 14, 2026. These terms apply when a merchant installs Datewise (provided by Metatroncube Software
Solutions, “we”) on a Shopify store. By installing the app you agree to them. Our <a href="/privacy">privacy policy</a> forms
part of these terms.
</p>
<h2>The service</h2>
<p>
Datewise lets your customers choose store pickup, local delivery or shipping and a date and time, records those bookings,
and helps you run them. Plans and prices are shown and billed through Shopify. You can change plans or uninstall at any time.
</p>
<h2>Your responsibilities</h2>
<p>
You set your hours, capacity, cutoffs, fees and delivery zones, and you're responsible for fulfilling orders at the times
your customers choose. Check your settings before busy periods. Messages sent through your own Twilio or WhatsApp accounts
are subject to those providers' terms and charges.
</p>
<h2>Data processing terms</h2>
<p>For personal data about your customers, you are the controller and we act as your processor. We:</p>
<ul>
<li>process customer data (name, email, phone, delivery address, order and booking details) only to provide the app's features and on your instructions given through the app;</li>
<li>do not sell or share personal data, and do not use it for advertising, profiling, automated decisions or training AI models;</li>
<li>encrypt data in transit (HTTPS), encrypt customer contact details and messaging credentials at rest (AES-256-GCM, keyed hashing), and encrypt backups;</li>
<li>limit access to our systems to authorised staff bound by confidentiality;</li>
<li>use these sub-processors: our hosting provider, Resend (email) and Google Maps (delivery distances); Twilio and Meta only when you connect your own accounts. We will tell you before adding others;</li>
<li>notify you without undue delay, and within 72 hours, after becoming aware of a breach affecting your data;</li>
<li>help you respond to customer requests (access, deletion) received through Shopify's privacy webhooks;</li>
<li>delete all data about your store 48 hours after you uninstall the app.</li>
</ul>
<p>
You are responsible for telling your customers how their data is used in your own store's privacy notice, for having a
lawful basis for the processing, and for having consent to send SMS or WhatsApp reminders where the law requires it.
</p>
<h2>Liability</h2>
<p>
The app is provided as is. We work to keep it available and accurate, but we can't guarantee uninterrupted service. To the
extent allowed by law, our total liability is limited to the fees you paid for the app in the 12 months before the claim.
</p>
<h2>Changes and contact</h2>
<p>We may update these terms and will notify you in the app or by email for material changes. Questions: <a href={`mailto:${CONTACT}`}>{CONTACT}</a></p>
</main>
);
}