# Feature: Legal documents (platform)

## Purpose

Public Terms of Service and Privacy Policy for ServDiary, required at registration and linked from the marketing site. Jetstream renders markdown from `resources/markdown/` as HTML.

These pages are **platform**, not a removable product domain.

## Boundaries

- **Owns:** `resources/markdown/terms.md`, `resources/markdown/policy.md`, Inertia pages `TermsOfService` / `PrivacyPolicy`, `LegalDocumentLayout`
- **Does not own:** Product domains, invoice/quote footer HTML (team-configured), cookie consent UI (not required while only strictly necessary cookies are used), Stripe Checkout UI (see [Billing](billing.md))
- **Depends on (platform only):** Jetstream `Features::termsAndPrivacyPolicy()`, Fortify registration (`terms` accepted), marketing footer links
- **Depends on (other domains):** none

## Operator details

| Role | Details |
|------|---------|
| Controller / trading name | Mike Brown trading as ServDiary |
| Data Protection Officer | Mike Brown |
| Address | 38 Carleton Street, Morecambe, LA4 4NY |
| Email | dpo@2880.co.uk |
| Governing law | England and Wales |
| Supervisory authority | UK ICO |

Documents distinguish **controller** processing (ServDiary accounts, website, contact form, subscription billing via Stripe) from **processor** processing (team Customer Data). They describe current product behaviour: session cookies only, GPS check-in, Order Market postcode lookup, Stripe for the ServDiary subscription, ClickSend for service SMS, optional QuickBooks, no analytics cookies.

These texts are an operational starting point and should be reviewed by a solicitor before relying on them for compliance.

## Models

None.

## Routes

Jetstream registers these when the terms-and-privacy feature is enabled in `config/jetstream.php`.

### Web

| Method | URI | Name | Controller |
|--------|-----|------|------------|
| GET | `/terms-of-service` | `terms.show` | Jetstream TermsOfServiceController |
| GET | `/privacy-policy` | `policy.show` | Jetstream PrivacyPolicyController |

### API

None. Mobile apps should open the same public URLs (or in-app WebViews) when they need to show legal copy.

## Permissions

Public (no auth). Registration requires `terms` accepted (`CreateNewUser`).

## Tests

- Path: `laravel/tests/Feature/LegalDocumentsTest.php`
- Cover: both pages render; HTML includes DPO name, address, email, ICO
- Registration: `RegistrationTest` asserts the Jetstream flag on `/register` and that signup without `terms` fails; after signup users go to `/subscribe` (see [Billing](billing.md))

## Add / remove checklist

### Add

- [x] Markdown populated
- [x] `Features::termsAndPrivacyPolicy()` enabled
- [x] Marketing footer + auth footer links
- [x] This wiki page linked from `docs/README.md`
- [x] Feature tests

### Remove

- [ ] Disable the Jetstream feature (registration checkbox disappears)
- [ ] Revert markdown to placeholders
- [ ] Remove footer links and this page
- [ ] Delete `LegalDocumentsTest`