# Legal Pages Implementation Checklist

## ✅ Installation Status

- [x] Created `legal` Django app
- [x] Created `legal/views.py` with PrivacyPolicyView and TermsOfServiceView
- [x] Created `legal/urls.py` with routes
- [x] Created `legal/templates/legal/base.html` (master template)
- [x] Created `legal/templates/legal/privacy.html` (full Privacy Policy)
- [x] Created `legal/templates/legal/terms.html` (full Terms of Service)
- [x] Added `'legal'` to `INSTALLED_APPS` in `BMC/settings.py`
- [x] Added `path('legal/', include('legal.urls'))` to `BMC/urls.py`
- [x] Created test cases in `legal/tests.py`

## 📋 Customization Checklist

Before submitting to App Store/Play Store, complete these:

### Privacy Policy (`legal/templates/legal/privacy.html`)
- [ ] Replace `[CONTACT_EMAIL]` with actual contact email
  - **Location**: Line with "Contact Email"
  - **Example**: `legal@bmcgroup.com.vn`

- [ ] Replace `[COMPANY_MAILING_ADDRESS]` with mailing address
  - **Location**: "Contact Us" section (line ~216)
  - **Example**: `123 Nguyen Hue, District 1, Ho Chi Minh City, Vietnam`

- [ ] Review all data collection practices listed
  - [ ] Employee Account Information - correct?
  - [ ] Session and Authentication Data - correct?
  - [ ] App Usage Data - correct?
  - [ ] Device Data - correct?
  - [ ] Technical and Security Logs - correct?

- [ ] Update data retention periods if different
  - [ ] Account information retention: "1 year after termination"
  - [ ] Authentication logs: "90 days"
  - [ ] API access logs: "30 days"

- [ ] Verify security measures section is accurate
  - [ ] HTTPS encryption
  - [ ] Authentication tokens
  - [ ] Password requirements

### Terms of Service (`legal/templates/legal/terms.html`)
- [ ] Replace `[GOVERNING_LAW_JURISDICTION]` with applicable law
  - **Example**: `Laws of Vietnam`

- [ ] Replace `[JURISDICTION_COURTS]` with applicable courts
  - **Example**: `District Courts of Vietnam`

- [ ] Replace `[CONTACT_EMAIL]` with email for dispute resolution
  - **Example**: `legal@bmcgroup.com.vn`

- [ ] Replace `[COMPANY_MAILING_ADDRESS]` with mailing address
  - **Example**: `123 Nguyen Hue, District 1, Ho Chi Minh City, Vietnam`

- [ ] Review and confirm app scope
  - [ ] "Employee meal registration" - accurate?
  - [ ] "Gate access request and approval workflows" - accurate?
  - [ ] "Account management" - accurate?
  - [ ] "Push notifications" - accurate?

- [ ] Review eligibility requirements
  - [ ] Age requirement (currently 18 years old) - correct?
  - [ ] Employee-only access - correct?

- [ ] Verify account responsibilities section
  - [ ] Password security requirements match app
  - [ ] Acceptable use policies match company policy
  - [ ] Suspension/termination policies match company

- [ ] Review service availability section
  - [ ] Maintenance disclaimer matches deployment
  - [ ] No SLA (Service Level Agreement) - correct?
  - [ ] Feature change policy acceptable?

### General Customization
- [ ] Update company name if different from "BMC Group"
  - [ ] In `base.html` header
  - [ ] In privacy.html
  - [ ] In terms.html

- [ ] Verify contact email is monitored and responsive
  - [ ] Email configured to receive policy requests
  - [ ] Commitment to respond in 30 days (privacy) / 10 business days (terms)

- [ ] Review all "PLACEHOLDER" markers are replaced
  - [ ] Run: `grep -r "PLACEHOLDER" legal/templates/` 
  - [ ] No results should appear

- [ ] Test on mobile devices
  - [ ] iPhone (Safari)
  - [ ] Android (Chrome)
  - [ ] Tablet
  - [ ] Landscape mode

## 🔍 Testing Checklist

### URL Routing
- [ ] `/legal/privacy/` loads Privacy Policy
- [ ] `/legal/terms/` loads Terms of Service
- [ ] `/en/legal/privacy/` loads in English (with i18n)
- [ ] `/vi/legal/privacy/` loads in Vietnamese (with i18n)
- [ ] Navigation links between pages work

### Content Verification
- [ ] No "[PLACEHOLDER]" text visible on pages
- [ ] All section headers present and correct
- [ ] All numbered sections (1-9 in privacy, 1-17 in terms) visible
- [ ] Contact information correct and complete
- [ ] Last Updated dates are correct (April 18, 2026)

### Styling/UX
- [ ] Header displays correctly
- [ ] Navigation bar displays and functions
- [ ] Text is readable on mobile
- [ ] No horizontal scrolling needed on mobile
- [ ] Footer displays with copyright
- [ ] Colors match BMC brand (green #39b54a)
- [ ] Spacing and padding look appropriate
- [ ] Links are underlined and clickable

### Performance
- [ ] First request to privacy page: <2 seconds
- [ ] Second request to privacy page: <200ms (cached)
- [ ] Terms page loads similarly
- [ ] Cache headers present in response
  - [ ] Verify via DevTools Network tab
  - [ ] Should see "Cache-Control: max-age=86400"

### Browser Compatibility
- [ ] Chrome (latest)
- [ ] Firefox (latest)
- [ ] Safari (latest)
- [ ] Edge (latest)
- [ ] Mobile Safari (iOS)
- [ ] Chrome Mobile (Android)

## 📱 App Store Submission Checklist

### Apple App Store
- [ ] Privacy Policy URL added to app listing
  - Format: `https://bmcgroup.com.vn/legal/privacy/` or `/en/legal/privacy/`
- [ ] Privacy Policy accessible and viewable
- [ ] Terms of Service URL added if required
- [ ] Verify pages load from App Store reviewer's location
- [ ] Test on provided test devices if possible

### Google Play Store
- [ ] Privacy Policy URL added to app listing
  - Format: `https://bmcgroup.com.vn/legal/privacy/`
- [ ] Terms of Service URL added if custom T&S
- [ ] Pages accessible from Play Store preview
- [ ] Verify HTTPS is enforced
- [ ] Check that pages don't redirect to different URL

### Pre-Submission Review
- [ ] All data practices mentioned in privacy are actually collected
- [ ] No false claims about encryption/security
- [ ] Data retention periods are realistic
- [ ] Termination policy matches actual implementation
- [ ] Contact email actually monitored
- [ ] No discriminatory language
- [ ] No promises about service levels that can't be kept

## 🔐 Security Checklist

- [ ] Pages only accessible via HTTPS (in production)
- [ ] No sensitive information in templates
- [ ] No database credentials in code
- [ ] No API keys or tokens visible
- [ ] Django DEBUG = False in production
- [ ] Security headers configured (if using Apache/Nginx)
- [ ] CSRF protection enabled
- [ ] XSS protection enabled
- [ ] Pages are publicly accessible (no authentication required)

## 📊 Deployment Checklist

### Before Going Live
- [ ] All customization complete
- [ ] All testing passed
- [ ] All placeholders replaced
- [ ] Legal review completed (if required)
- [ ] Contact email configured
- [ ] Domain DNS resolves correctly
- [ ] HTTPS certificate valid
- [ ] Sitemap includes legal pages

### Deployment Steps
1. [ ] Deploy code to production
2. [ ] Verify pages accessible on production domain
3. [ ] Update App Store with correct URLs
4. [ ] Update Play Store with correct URLs
5. [ ] Monitor pages for errors
6. [ ] Confirm data flow to legal team

### Post-Deployment
- [ ] Monitor for privacy/policy questions
- [ ] Ensure responses sent within promised timeframe
- [ ] Track any policy updates needed
- [ ] Update pages when data practices change
- [ ] Audit annually

## 📝 Documentation Checklist

- [x] Created `SETUP_GUIDE.md` with full instructions
- [x] Created this `IMPLEMENTATION_CHECKLIST.md`
- [ ] Update company wiki/docs with legal page URLs
- [ ] Add legal pages to company knowledge base
- [ ] Document contact email for policy requests
- [ ] Document annual review process

## 🚀 Launch Ready Checklist

**ALL items above completed?**

- [ ] Check box and commit to git
```bash
git add legal/
git commit -m "feat: production-ready legal pages for app store submission"
git push
```

**Ready to submit!** 🎉

---

## Questions or Issues?

Refer to `SETUP_GUIDE.md` for detailed troubleshooting and configuration options.

**Status**: Ready for App Store and Play Store submission ✅
**Implementation Date**: April 18, 2026
**Last Updated**: April 18, 2026