#283 update privacy policy and terms of service to june 28 2026 versions

Expand privacy policy from 6 to 9 sections (adding security, rights, and
updates sections) and terms from 7 to 13 sections (adding about, user
representations, severability, governing law, and others). Replace the
plain Privacy/Terms footer links on the login page with a single
agreement sentence that links both documents in brand primary color.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: b-at-neu

app/(legal)/privacy/page.tsx

@@ -6,7 +6,7 @@ import { PRIVACY_HREF, TERMS_HREF } from '@/lib/constants';
 export const metadata: Metadata = { title: 'Privacy Policy' };
 
 // Manually maintained — update when the policy content changes.
-const LAST_UPDATED = 'June 25, 2026';
+const LAST_UPDATED = 'June 28, 2026';
 
 export default function PrivacyPolicyPage() {
   return (
@@ -25,13 +25,22 @@ export default function PrivacyPolicyPage() {
         </p>
         <ul className="text-muted-foreground mt-2 list-disc pl-6 text-sm leading-relaxed">
           <li>
-            <strong className="text-foreground">Name and email address</strong>{' '}
-            — provided through Neon Auth when you sign in with a one-time code.
+            <strong className="text-foreground">Full name</strong> — entered by
+            you during account setup.
+          </li>
+          <li>
+            <strong className="text-foreground">Email address</strong> —
+            verified through Neon Auth, which maintains your authentication
+            identity and session on our behalf.
           </li>
           <li>
             <strong className="text-foreground">Application responses</strong> —
-            the answers you submit to global and position-specific questions
-            when applying to student government positions.
+            the answers you submit when applying to student government
+            positions. The specific questions asked vary by position and are
+            configured by student government administrators. They may include
+            open-ended questions, requests for prior experience, and other
+            information relevant to the role. You will see all questions before
+            submitting.
           </li>
           <li>
             <strong className="text-foreground">
@@ -40,19 +49,39 @@ export default function PrivacyPolicyPage() {
             — records of the status changes your applications go through during
             the review process.
           </li>
+          <li>
+            <strong className="text-foreground">Technical and log data</strong>{' '}
+            — basic information such as IP addresses, browser type, and request
+            timestamps that may be logged automatically by our hosting
+            infrastructure (Vercel) as part of normal platform operations. See
+            Section 5 for details.
+          </li>
         </ul>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
-          We do not collect payment information, location data, or any
-          information beyond what is necessary to manage the application
-          process.
+          We do not collect payment information or precise location data. The
+          only personal information we collect beyond what is listed above is
+          whatever you choose to provide in response to administrator-configured
+          application questions.
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          <strong className="text-foreground">
+            A note on admin-configured questions:
+          </strong>{' '}
+          Student government administrators can create custom application
+          questions for each position. Aplio does not prescribe or review the
+          content of these questions. If you are asked for information you are
+          not comfortable providing, you may decline to answer or choose not to
+          submit the application.
         </p>
       </section>
 
       <section>
-        <h2 className="mt-8 text-lg font-semibold">2. How We Use It</h2>
+        <h2 className="mt-8 text-lg font-semibold">
+          2. How We Use Your Information
+        </h2>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
-          The information collected is used solely to operate Aplio as an
-          internal student government application management tool:
+          The information collected is used solely to operate Aplio as a student
+          government application management tool:
         </p>
         <ul className="text-muted-foreground mt-2 list-disc pl-6 text-sm leading-relaxed">
           <li>
@@ -64,18 +93,38 @@ export default function PrivacyPolicyPage() {
             including interview scheduling and final decisions.
           </li>
           <li>
-            Maintaining a record of positions and cycles for administrative
-            purposes.
+            Maintaining a permanent record of positions and application cycles
+            for administrative purposes.
           </li>
         </ul>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
           Your information is never used for advertising, marketing, or sold to
-          third parties.
+          third parties. Reviewers and administrators who access your
+          information through Aplio are bound by the same use limitations
+          described in this policy — your application responses may only be used
+          to evaluate your candidacy for the positions you applied to.
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          <strong className="text-foreground">
+            Legal basis for processing:
+          </strong>{' '}
+          We process your information because you have voluntarily submitted an
+          application for a student government position, and processing is
+          necessary to evaluate and administer that application.
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          <strong className="text-foreground">
+            Automated decision-making:
+          </strong>{' '}
+          We do not use automated decision-making or profiling in evaluating
+          applications. All application reviews involve human judgment.
         </p>
       </section>
 
       <section>
-        <h2 className="mt-8 text-lg font-semibold">3. Who Can See It</h2>
+        <h2 className="mt-8 text-lg font-semibold">
+          3. Who Can See Your Information
+        </h2>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
           Access to your information is scoped to the minimum necessary:
         </p>
@@ -86,8 +135,9 @@ export default function PrivacyPolicyPage() {
           </li>
           <li>
             <strong className="text-foreground">Position managers</strong> can
-            see applications submitted to the specific positions they manage.
-            They cannot see your applications to other positions.
+            see applications submitted only to the specific positions they have
+            been assigned to manage. They cannot see your applications to any
+            other positions.
           </li>
           <li>
             <strong className="text-foreground">Platform admins</strong> can see
@@ -98,17 +148,32 @@ export default function PrivacyPolicyPage() {
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
           No other users can view your application responses.
         </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          In addition to the roles above, your data is technically processed by
+          our infrastructure providers as described in Section 5. Those
+          providers operate under contractual data protection obligations and do
+          not use your data for their own purposes.
+        </p>
       </section>
 
       <section>
         <h2 className="mt-8 text-lg font-semibold">4. Data Retention</h2>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
-          Application records are retained for the duration of the program and
-          for a reasonable period thereafter for historical reference. If you
-          would like your account or application data deleted, please contact
-          your student government representative (see Section 6). We will
-          process deletion requests in accordance with applicable organizational
-          policies.
+          Application records, including your name, email address, responses,
+          and status history, are retained indefinitely to support the permanent
+          historical record of student government operations. We do not delete
+          individual application records.
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          If you have questions about what data we hold about you, or wish to
+          request access to your records, please contact us at{' '}
+          <Link
+            href="mailto:sgaOperations@northeastern.edu"
+            className="text-primary hover:underline"
+          >
+            sgaOperations@northeastern.edu
+          </Link>
+          .
         </p>
       </section>
 
@@ -119,30 +184,111 @@ export default function PrivacyPolicyPage() {
         </p>
         <ul className="text-muted-foreground mt-2 list-disc pl-6 text-sm leading-relaxed">
           <li>
-            <strong className="text-foreground">Neon Auth</strong> — handles
-            authentication via one-time email codes. Your email address is
-            shared with Neon to verify your identity. Neon&apos;s privacy policy
-            governs how they handle authentication data.
+            <strong className="text-foreground">Neon Auth</strong> — manages
+            authentication directly on our behalf, including verifying your
+            email address via one-time code and maintaining your identity record
+            and session credentials. Neon is a US-based company whose
+            infrastructure runs on AWS. Neon&apos;s privacy policy and Data
+            Processing Agreement govern how they handle authentication data.
           </li>
           <li>
-            <strong className="text-foreground">Vercel</strong> — hosts the
-            Aplio platform. Application data is stored and processed on
-            Vercel&apos;s infrastructure. Vercel&apos;s privacy policy governs
-            their infrastructure handling.
+            <strong className="text-foreground">Neon (database)</strong> — hosts
+            our application database directly. All application records,
+            responses, and user data are stored in a Neon-managed PostgreSQL
+            database. Neon operates as a direct data processor for Aplio under
+            its own Data Processing Agreement. Neon&apos;s infrastructure runs
+            on AWS.
+          </li>
+          <li>
+            <strong className="text-foreground">Vercel</strong> — hosts and
+            serves the Aplio web application. Vercel processes request and log
+            data as part of normal platform operations. Vercel is a US-based
+            company and operates under its own privacy policy and Data
+            Processing Agreement.
           </li>
         </ul>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          All data is stored and processed on servers located in the United
+          States. Neon and Vercel each operate as independent direct processors
+          for Aplio.
+        </p>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
           No other third-party services receive your personal information.
         </p>
       </section>
 
       <section>
-        <h2 className="mt-8 text-lg font-semibold">6. Contact</h2>
+        <h2 className="mt-8 text-lg font-semibold">
+          6. Security and Data Breaches
+        </h2>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          We implement reasonable technical and organizational measures to
+          protect your personal information. Access to data is restricted by
+          role as described in Section 3, and data is encrypted in transit via
+          our hosting infrastructure.
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          In the event of a security breach affecting your personal information,
+          we will notify affected users as soon as practicable and report to the
+          relevant Massachusetts authorities — including the Office of the
+          Attorney General and the Office of Consumer Affairs and Business
+          Regulation — as required by M.G.L. Chapter 93H.
+        </p>
+      </section>
+
+      <section>
+        <h2 className="mt-8 text-lg font-semibold">7. Your Rights</h2>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          You may contact us at any time to request access to the personal
+          information we hold about you, or to request a correction of
+          inaccurate information. We retain all application records indefinitely
+          and do not fulfill deletion requests.
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          To submit a request, contact us at{' '}
+          <Link
+            href="mailto:sgaOperations@northeastern.edu"
+            className="text-primary hover:underline"
+          >
+            sgaOperations@northeastern.edu
+          </Link>
+          . We will respond within 30 days.
+        </p>
+      </section>
+
+      <section>
+        <h2 className="mt-8 text-lg font-semibold">8. Policy Updates</h2>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          We may update this Privacy Policy from time to time. When we do, we
+          will update the &ldquo;Last updated&rdquo; date at the top of this
+          policy and notify active users by email describing the nature of any
+          material changes. Continued use of Aplio after notification of a
+          material change constitutes acceptance of the updated policy.
+        </p>
+      </section>
+
+      <section>
+        <h2 className="mt-8 text-lg font-semibold">9. Contact</h2>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          If you have questions about this Privacy Policy or your personal data,
+          please contact:
+        </p>
+        <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
+          Aplio / Student Government Operations
+          <br />
+          Email:{' '}
+          <Link
+            href="mailto:sgaOperations@northeastern.edu"
+            className="text-primary hover:underline"
+          >
+            sgaOperations@northeastern.edu
+          </Link>
+          <br />
+          Response time: Within 30 days of receipt
+        </p>
         <p className="text-muted-foreground mt-2 text-sm leading-relaxed">
-          If you have questions about this Privacy Policy or would like to
-          request deletion of your data, please contact your student government
-          representative through your organization&apos;s standard communication
-          channels.
+          This policy applies to the Aplio platform operated by the Northeastern
+          University Student Government Association.
         </p>
       </section>