<?php
// privacy.php — Dabil Privacy Policy (public, no login required).
$effective = 'July 1, 2026';
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
<title>Privacy Policy — Dabil</title>
<link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap" rel="stylesheet">
<style>
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
:root{
  --primary:#225AE3;--primary-dark:#1a47b8;--primary-bg:#EEF3FD;
  --text:#0F172A;--text-muted:#475569;--text-light:#94A3B8;
  --bg:#F4F7FC;--border:#E7EDF6;
  --font:'Plus Jakarta Sans',-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;
}
html,body{font-family:var(--font);background:var(--bg);color:var(--text);-webkit-text-size-adjust:100%;line-height:1.65}
.doc-topbar{position:sticky;top:0;z-index:10;background:rgba(244,247,252,.9);backdrop-filter:blur(8px);border-bottom:1px solid var(--border);display:flex;align-items:center;gap:12px;padding:calc(env(safe-area-inset-top) + 12px) 16px 12px;max-width:760px;margin:0 auto}
.doc-back{width:44px;height:44px;flex-shrink:0;border-radius:12px;display:flex;align-items:center;justify-content:center;color:var(--primary);background:var(--primary-bg);text-decoration:none}
.doc-topbar h1{font-size:1.15rem;font-weight:800;letter-spacing:-.02em}
.doc{max-width:760px;margin:0 auto;padding:22px 20px calc(env(safe-area-inset-bottom) + 60px)}
.doc .eff{font-size:.82rem;color:var(--text-light);margin-bottom:22px}
.doc .lead{font-size:.98rem;color:var(--text-muted);margin-bottom:26px}
.doc h2{font-size:1.08rem;font-weight:800;letter-spacing:-.01em;margin:28px 0 10px;color:var(--text)}
.doc p{font-size:.92rem;color:var(--text-muted);margin-bottom:12px}
.doc ul{margin:0 0 14px 20px}
.doc li{font-size:.92rem;color:var(--text-muted);margin-bottom:7px}
.doc a{color:var(--primary);font-weight:600}
.doc strong{color:var(--text)}
.doc .note{background:#fff;border:1px solid var(--border);border-radius:14px;padding:14px 16px;font-size:.86rem;color:var(--text-muted);margin-top:26px}
</style>
</head>
<body>
<div class="doc-topbar">
  <a href="javascript:history.length>1?history.back():location.href='signin.php'" class="doc-back" aria-label="Back">
    <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><path d="M19 12H5m0 0l7 7M5 12l7-7"/></svg>
  </a>
  <h1>Privacy Policy</h1>
</div>

<div class="doc">
  <p class="eff">Effective date: <?php echo $effective; ?></p>
  <p class="lead">This Privacy Policy explains how <strong>Dabil</strong> ("Dabil", "we", "us") collects, uses, shares and protects your information when you use our cashless dining app, wallet and related services (the "Service"). We are committed to handling your data lawfully and transparently, in line with the Nigeria Data Protection Act, 2023 (NDPA) and other applicable laws.</p>

  <h2>1. Who we are</h2>
  <p>Dabil provides a QR-based ordering and payment platform that connects diners with restaurants and organisations. If you have questions about this policy or your data, contact us at <a href="mailto:support@dabil.com.ng">support@dabil.com.ng</a>.</p>

  <h2>2. Information we collect</h2>
  <ul>
    <li><strong>Account information</strong> — your name, email address, phone number and password (stored only as a secure hash).</li>
    <li><strong>Profile details</strong> — optional profile photo, and, for organisation staff, your employee ID and department.</li>
    <li><strong>Transaction data</strong> — wallet top-ups, orders, meal-ticket funding, payments, and withdrawal records.</li>
    <li><strong>Payment information</strong> — payments and payouts are processed by our payment partner, Paystack. We do not store your full card details; Paystack handles card data under its own security standards.</li>
    <li><strong>Device &amp; usage data</strong> — app interactions, approximate location of a scan, device type and log data used to keep the Service secure and reliable.</li>
    <li><strong>Security data</strong> — two-factor authentication settings, one-time codes and (if enabled) biometric unlock preferences stored on your device.</li>
  </ul>

  <h2>3. How we use your information</h2>
  <ul>
    <li>To create and manage your account and wallet.</li>
    <li>To process orders, payments, meal-ticket funding and withdrawals.</li>
    <li>To send transactional messages and notifications you have enabled (order updates, funding, security alerts).</li>
    <li>To verify your identity, enable two-factor authentication and prevent fraud.</li>
    <li>To provide customer support and respond to your requests.</li>
    <li>To improve, secure and troubleshoot the Service, and to comply with legal obligations.</li>
  </ul>

  <h2>4. Legal basis for processing</h2>
  <p>We process your data where it is necessary to perform our contract with you (providing the Service), to comply with a legal obligation, to protect your or others' vital interests (fraud prevention and security), with your consent (for example, marketing messages or biometric unlock), or for our legitimate interests in operating and improving Dabil.</p>

  <h2>5. Sharing your information</h2>
  <p>We do not sell your personal data. We share it only as needed to run the Service:</p>
  <ul>
    <li><strong>Restaurants</strong> you order from receive the order details necessary to prepare and serve your order.</li>
    <li><strong>Your organisation</strong> (if you are funded via a meal-ticket wallet) can see funding and usage records related to allowances it provides.</li>
    <li><strong>Service providers</strong> such as Paystack (payments) and our email provider (verification and notification emails).</li>
    <li><strong>Authorities</strong> where we are legally required to disclose information.</li>
  </ul>

  <h2>6. Data retention</h2>
  <p>We keep your information for as long as your account is active and as needed to provide the Service, then for any additional period required to meet legal, accounting or fraud-prevention obligations. You may request deletion of your account as described below.</p>

  <h2>7. Security</h2>
  <p>We protect your data using encryption in transit, hashed passwords, two-factor authentication and access controls. No system is perfectly secure, but we work continuously to safeguard your information and will notify you and the relevant authority of a data breach where required.</p>

  <h2>8. Your rights</h2>
  <p>Subject to applicable law, you may request to access, correct, update or delete your personal data, object to or restrict certain processing, withdraw consent, or request a copy of your data. You can manage much of this in the app under Settings, or contact us at <a href="mailto:support@dabil.com.ng">support@dabil.com.ng</a>. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).</p>

  <h2>9. Children</h2>
  <p>Dabil is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us so we can remove it.</p>

  <h2>10. Changes to this policy</h2>
  <p>We may update this policy from time to time. We will post the updated version here and revise the effective date above. Significant changes will be communicated in the app or by email.</p>

  <h2>11. Contact us</h2>
  <p>Questions or requests about this policy or your data can be sent to <a href="mailto:support@dabil.com.ng">support@dabil.com.ng</a> or by phone on +234 809 152 0709.</p>

  <div class="note">This document is provided for general information about how Dabil handles data and does not constitute legal advice. Dabil should have this policy reviewed by qualified legal counsel before relying on it.</div>
</div>
</body>
</html>
