Session 9: api-football + FootApi + Tank01 adapters, grace period middleware, cookie consent, /pricing page, OOM fix documented (1240 tests)

web/src/app/privacy/page.tsx

@@ -18,7 +18,7 @@ const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
     body: [
       'Account data: email, password hash, age confirmation, signup timestamp.',
       'Usage data: reads you run (player, stat, line, sport, grade), parlays you build, page views.',
-      'Payment data: NexaPay processes all card data — we never see or store your card. We retain a NexaPay customer ID and your subscription status.',
+      'Payment data: Stripe processes all card data — we never see or store your card number, CVC, or any other payment instrument detail. We retain a Stripe customer ID, Stripe subscription ID, and your subscription status (active, canceled, grace period, expired) so we can gate paid features and respond to renewal/cancellation events from Stripe webhooks.',
       'Device data: IP address, browser type, basic device info (for fraud prevention and analytics).',
     ],
   },
@@ -54,6 +54,16 @@ const SECTIONS: { title: string; body: string[]; emphasized?: boolean }[] = [
       'Analytics: PostHog (anonymized IPs, no third-party trackers). You can opt out by setting your browser to "Do Not Track" or contacting us.',
     ],
   },
+  {
+    title: 'Sub-processors',
+    body: [
+      'We rely on a small set of third-party processors. They handle data on our behalf under their own privacy commitments; we do not give them permission to use your data for their own purposes.',
+      'Stripe — payment processing and subscription management. Receives: name (if you provide), email, billing address (if you provide), and the card details you enter on their hosted checkout page. We never see your card number.',
+      'Supabase — authentication, database, and file storage. Receives: everything in the "Data we collect" section above. Supabase is our primary backend.',
+      'PostHog — product analytics. Receives: anonymized event data (page views, button clicks). IPs are anonymized before storage.',
+      'Resend — transactional email (account confirmations, payment receipts, renewal reminders). Receives: your email address and the message contents.',
+    ],
+  },
   {
     title: 'Notifications',
     body: [