# GateWise NG Policy Center

This folder contains user-facing policy drafts for GateWise NG, a product of Globulus Technology Limited. The language is written for estate administrators, residents, guards, visitors, sales partners, and other platform users.

These documents should not expose internal infrastructure, secret-management details, private endpoint paths, security playbooks, database design, hosting vendor configuration, or operational weaknesses. Keep those details in internal deployment and engineering documents only.

## Policies

- [Public Policy Links](public-policy-links.md)
- [Terms and Conditions](terms-and-conditions.md)
- [Privacy Policy](privacy-policy.md)
- [Data Protection Policy](data-protection-policy.md)
- [Data Retention and Deletion Policy](data-retention-and-deletion-policy.md)
- [Cookies and Cache Policy](cookies-and-cache-policy.md)
- [Data Processing Addendum](data-processing-addendum.md)
- [Security and Incident Response Policy](security-and-incident-response-policy.md)

## Publication Checklist

Before publishing these policies on `gatewise.ng`:

- Replace placeholder company, address, email, and phone details.
- Confirm the contracting entity and governing law with qualified counsel.
- Confirm whether GateWise acts as a controller, processor, or joint controller for each data flow.
- Confirm final retention periods, deletion workflow, and customer support contacts.
- Confirm the live payment, SMS, email, analytics, and support vendors before publishing any subprocessor page.
- Remove internal notes, implementation references, and deployment instructions from public pages.

## Safe Public Language

Public policy pages may describe:

- what personal data GateWise collects
- why the data is used

- who can access it
- user rights and request channels
- retention and anonymization commitments
- high-level security safeguards
- customer responsibilities

Public policy pages should not describe:

- exact hosting architecture or database setup
- secret names, environment variables, or admin-only setup steps
- private API routes, internal dashboards, or sandbox behavior
- detailed fraud, rate-limit, device-binding, or incident-response rules that could help abuse
- known unresolved vulnerabilities or operational gaps

## One-Update Publishing Workflow

The canonical editing source is this `docs/legal` folder. After updating a policy, run:

```powershell
npm.cmd run legal:sync
```

That command publishes the same markdown to the WebApp public `legal/` folder. The WebApp serves the public Policy Center, and the MobileApp links back to the same WebApp URLs instead of storing separate policy text.
