From 7c429057235c2209c8e4b379ac8505da231dedff Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Tue, 18 Aug 2026 21:08:49 +0200
Subject: [PATCH 1/8] fix: adopt the v3 legal texts for the account statements

The PR #38 seed carried placeholder digests that correspond to no document,
so a consent receipt could not be verified against a text (GDPR Art. 7(1)
demonstrability, flagged in review). Until the DPO delivers the v4 texts,
the live v3 documents are adopted provisionally:

- terms_and_conditions -> version 2024-10 (last updated October 2024 per
  the page), https://testing.nc3.lu/terms-conditions/, digest of the
  canonical snapshot committed at docs/legal/terms-of-service-2024-10.md.
  Corrected in place: the placeholder version named no real text and no
  production registration exists.
- privacy_policy -> NEW acceptance statement (the NFR requires explicit
  privacy consent at signup), version 2026-08-18 (page undated; snapshot
  date pins the text), https://testing.nc3.lu/privacy/, digest of
  docs/legal/privacy-statement-2026-08-18.md. Registration requires every
  active account-level acceptance, so it binds automatically.
- scan_target_permission keeps its placeholder: per-launch attestation,
  and nothing in the v4.0 catalog is intrusive.

The mock GET /statements mirrors the rows verbatim; the postgres suite
registers against both acceptances. DPO v4 texts land as new version rows.
---
 docs/legal/privacy-statement-2026-08-18.md    | 123 +++++++++++++
 docs/legal/terms-of-service-2024-10.md        | 170 ++++++++++++++++++
 ..._legal_texts_for_the_account_statements.py |  98 ++++++++++
 .../domains/statements/router.py              |  22 ++-
 tests/test_auth_postgres.py                   |   5 +-
 5 files changed, 412 insertions(+), 6 deletions(-)
 create mode 100644 docs/legal/privacy-statement-2026-08-18.md
 create mode 100644 docs/legal/terms-of-service-2024-10.md
 create mode 100644 migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py

diff --git a/docs/legal/privacy-statement-2026-08-18.md b/docs/legal/privacy-statement-2026-08-18.md
new file mode 100644
index 0000000..d9520e3
--- /dev/null
+++ b/docs/legal/privacy-statement-2026-08-18.md
@@ -0,0 +1,123 @@
+<!-- Canonical snapshot of https://testing.nc3.lu/privacy/
+     (v3 Privacy Statement, undated on the page), retrieved
+     2026-08-18. Adopted provisionally for v4.0 statement
+     privacy_policy version 2026-08-18 until the DPO delivers the
+     v4 texts (Non-functional -> GDPR). statement.content_hash is the
+     SHA-256 of this file's bytes. Do not edit: a new text is a new
+     file and a new statement version row. -->
+
+# PRIVACY STATEMENT
+
+The Luxembourg House of Cybersecurity (hereinafter referred to as LHC)
+collects and processes personal data in accordance with the applicable data protection legislations such as, but
+not
+limited to, Regulation (EU) 2016/679 on the protection of natural persons with regards to the processing of
+their
+personal data and the free movement of such data (“GDPR”) and the national law adopting GDPR.
+
+It may occur that we change or amend our Privacy Policy in order to ensure that its content accurately reflects
+regulatory developments. Any such modification, if substantial, will be clearly communicated to you, either via
+the
+website or via other appropriate means. The latest applicable version will be available on our website.
+
+Should you have any questions or remarks regarding this Privacy Policy, do not hesitate to contact us at
+privacy@lhc.lu
+
+## PROCESSING OF PERSONAL DATA
+
+By “personal data” we understand any information that can identify you, both directly and indirectly.
+
+By “processing” we refer to anything we do with such personal data, including collection, recording,
+organization,
+structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
+dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
+
+By “data controller” we understand the person responsible for the processing of your personal data, this is the
+entity which determines the means and purpose of the processing activities.
+
+For our Testing Platform website and all related services, the data controller is:
+
+Luxembourg House of Cybersecurity g.i.e., 122 rue Adolphe Fischer, L-1521 Luxembourg
+
+Tel: (+352) 274 00 98 601
+
+Email: privacy@lhc.lu
+
+## WHAT PERSONAL DATA DO WE COLLECT ON OUR WEBSITE AND TO WHICH END?
+
+When you are surfing our Testing Platform website, we collect and process web server logs, including IP
+addresses,
+user-agents, URLs, date and time logs. We collect those logs for our legitimate interest as these logs enable
+the
+technical and functional management of our website.
+
+When you register to the Testing Platform, we process and collect certain personal data. The types of personal
+information that are collected from you include: name and family name of the contact person, username and
+password,
+email address as well as the company name and full.
+
+When you contact us by mail, we process your contact information and any other details you provide us. We will
+use
+these details, if provided, for further case management around the issue resolution.
+
+Your personal data is collected for registration, billing and troubleshooting purposes.
+
+We confirm that we process your personal data in a fair and lawful manner and only for the explicit and
+legitimate
+purposes as above-mentioned. At all times, we strive to ensure that your personal data is adequate, relevant and
+not
+excessive in relation to the purposes for which they are processed.
+
+In case you enter and use one of the websites that may be linked to this website, personal data will processed
+according to the privacy policies of these respective infrastructures.
+
+## HOW LONG DO WE RETAIN YOUR PERSONAL DATA?
+
+In no circumstances, we keep your personal data for a longer period than strictly necessary to fulfil the purpose
+for which it was collected. If you decide to delete your account, or LHC decides to delete your
+account after one year of inactivity on the Testing Platform, we inform you that your related personal data will
+be
+replaced in our Database with a string called "DELETED”. The data collected about servers that have been added
+by
+you as user will not be deleted as we might use them internally, however they will not be connected to you
+anymore,
+since your account gets anonymized.
+
+However, if requested by local and national law, certain personal data may be retained for a longer period. For
+instance, for accounting purposes, such as, but limited to, payment of the services fees, data will be retained
+for
+the time required by the national law and for no longer than ten years).
+
+## SHARING PERSONAL DATA
+
+We formally confirm that we will not sell, rent or otherwise commercially transfer to or share with a third party
+any personal data.
+
+The data submitted will only be made available to LHC personnel for the above mentioned
+purposes.
+
+As our web server is hosted and managed in Luxembourg, your personal data is in no circumstances transferred to
+third countries outside the EU.
+
+## SECURITY OF YOUR PERSONAL DATA
+
+We are striving to keep your personal data secure. To that end, we have adopted the appropriate legal,
+organizational and technical precautions to prevent any unauthorized access and use of your personal data. These
+measures include but are not limited to the encryption of all traffic between our website and your browser.
+YOUR RIGHTS AS A DATA SUBJECT
+
+At LHC we aim to be transparent, not only about how we process personal data about you, but also
+about
+your rights that are linked to such processing.
+
+In particular, you have the right to access your personal data, to obtain the updating, the adjustment and the
+erasure of the personal data and you can exercise the rights to restrict and to object the processing. You can
+exercise the rights provided by articles 15 and the following of the GDPR contacting the following email address
+privacy@lhc.lu .
+In order to avoid unlawful access to your personal data, we will request you to provide a proof of your
+identity. If
+you have any queries about this Privacy Notice or experiencing any other privacy issue, we are striving to
+promptly
+dealing with any privacy-related complaints.
+If you have a complaint related to the processing of your personal data by LHC, please contact
+us.
diff --git a/docs/legal/terms-of-service-2024-10.md b/docs/legal/terms-of-service-2024-10.md
new file mode 100644
index 0000000..35c34be
--- /dev/null
+++ b/docs/legal/terms-of-service-2024-10.md
@@ -0,0 +1,170 @@
+<!-- Canonical snapshot of https://testing.nc3.lu/terms-conditions/
+     (v3 Terms of Service, last updated October 2024 per the page),
+     retrieved 2026-08-18. Adopted provisionally for v4.0 statement
+     terms_and_conditions version 2024-10 until the DPO delivers the
+     v4 texts (Non-functional -> GDPR). statement.content_hash is the
+     SHA-256 of this file's bytes. Do not edit: a new text is a new
+     file and a new statement version row. -->
+
+# Terms of Service
+
+These terms govern use of the website https://testing.nc3.lu . To use the
+website, you must agree to these terms with
+Luxembourg House of Cybersecurity (hereinafter referred to as LHC) the company that runs the website.
+LHC may offer other products and services, under different terms. These terms apply only to use of
+the
+website.
+
+Skip to:
+
+- Your Permission to Use the Website
+
+- Conditions for Use of the Website
+
+- Acceptable Use
+
+- Content Standards
+
+- Your Account
+
+- Your Content
+
+- Termination
+
+- Disputes
+
+- Contact
+
+- Changes
+
+## Your Permission to Use the Website
+
+Subject to these terms, LHC gives you permission to use the website. You can't transfer it to
+anyone
+else. Others need to agree to these terms for themselves to use the website.
+
+## Conditions for Use of the Website
+Your permission to use the website is subject to the following conditions:
+
+- You must be at least thirteen years old.
+
+- You may no longer use the website if LHC contacts you directly to say that you may not.
+
+- You must use the website in accordance with Acceptable Use and Content Standards.
+
+## Acceptable Use
+
+- You may not break the law using the website.
+
+- You may not use or try to use another's account on the website without their specific permission.
+
+- You may not buy, sell, or otherwise trade in user names or other unique identifiers on the website.
+
+- You may not send advertisements, chain letters, or other solicitations through the website, or use the
+website to
+gather addresses for commercial mailing lists.
+
+- You may not automate access to the website, or monitor the website, such as with a web crawler, browser
+plug-in
+or add-on, or other computer program that is not a web browser. You may crawl the website to index it for a
+publicly
+available search engine.
+
+- You may not use the website to send e-mail to distribution lists, newsgroups, or group mail aliases.
+
+- You may not falsely imply that you're affiliated with or endorsed by LHC.
+
+- You may not hyperlink to images or other non-hypertext content on the website.
+
+- You may not remove any marks showing proprietary ownership from materials you download from the website.
+
+- You may not show any part of the website on other websites with
+<iframe>.
+
+- You may not disable, avoid, or circumvent any security or access restrictions of the website.
+
+- You may not strain infrastructure of the website with an unreasonable volume of requests, or requests
+designed to impose an unreasonable load on information systems underlying the website.
+
+- You may not encourage or help anyone in violation of these terms.
+
+- You may not impersonate others through the website.
+
+## Content Standards
+
+- You may not submit content to the website that is illegal, offensive, or otherwise harmful to others. This
+includes content that is harassing, inappropriate, or abusive.
+
+- You may not submit content to the website that violates the law, infringes anyone's intellectual property
+rights, violates anyone's privacy, or breaches agreements you have with others.
+
+- You may not submit content to the website containing malicious computer code, such as computer viruses or
+spyware.
+
+## Your Account
+
+You must create and log into an account to use some features of the website.
+
+For this purpose, you agree to:
+
+-Provide true, accurate, correct and complete information when required to register as a user of the Website
+(“Personal Information”; and notify immediately LHC of any change of Personal Information).
+
+You agree that you will not impersonate any other person or entity or use a false name or a name that you are
+not authorized to use, or disclose your password or username to any other person, or allow your password or user
+name to be used by any other person to access the Services. You will be responsible for use of the Website
+and/or Services via your username and so will be liable for breach by anyone to whom you provide the details. To
+create an account, you must provide some information about yourself. If you create an account, you agree to
+provide your first and last name, a valid e-mail address, your company or affiliation address.
+
+You may delete your account on the website at any time. The deletion means the permanent anonymization of all
+your account and personal data.
+Your personal data is processed according to Testing Platform Privacy Policy
+( https://testing.c3.lu/privacy )
+LHC reserves the right to decline any application from you to register as a user of the platform
+in their sole discretion.
+You agree to be responsible for all action taken using your account, whether authorized by you or not, until you
+either close your account or notify LHC that your account has been compromised. You agree to
+notify LHC immediately if you suspect your account has been compromised. You agree to select a
+secure password for your account, and keep it secret.
+LHC will at its own discretion decide to close your account on the website after one year on
+inactivity on the website. LHC will notify you immediately about this decision.
+
+## Your Content
+
+Nothing in these terms gives LHC any ownership rights in intellectual property that you share with
+the website, such as your account information or other content you submit to the website. Nothing in these terms
+gives you any ownership rights in LHC's intellectual property, either.
+Between you and LHC, you remain solely responsible for content you submit to the website. You
+agree not to wrongly imply that the content you submit to the website is sponsored or approved by the company.
+These terms do not obligate LHC to store, maintain, or provide copies of content you submit.
+The content you submit to the website belongs to you, and you decide what permission to give others for it.
+However, by submitting content to this website, you agree to grant to LHC a non-exclusive,
+non-transferable, royalty-free, license to use your content for statistical and analysis purposes.
+When the content you submit is removed from the website, whether by you or by LHC,
+LHC's special license ends when the last copy disappears from LHC's backups,
+caches, and other systems. Licenses related to statistical data you and is will continue/survive after your
+content is removed.
+
+## Termination
+
+Either you or LHC may end the agreement written out in these terms at any time. When our agreement
+ends, your permission to use the website also ends.
+The following provisions survive the end of our agreement: Your account, Your Content, Data Shared.
+
+## Disputes
+
+Luxembourg law will govern any dispute, including any legal proceedings, related to these terms or your use of
+the website.
+
+## Contact
+
+You may notify LHC these terms, and send questions at testing@nc3.lu. LHC may notify
+you under these terms using the e-mail address you provide for your account on the website, or by posting a
+message to the homepage of the website or your account page.
+
+## Changes
+
+LHC last updated these terms in October 2024, and may update these terms again. LHC
+will post all updates to the website.
+LHC may also announce updates with special messages or alerts on the website.
diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
new file mode 100644
index 0000000..e13b87c
--- /dev/null
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -0,0 +1,98 @@
+"""Adopt the v3 legal texts for the account statements.
+
+Revision: d7e3f1a2b4c6
+Revises: a9f2c4e6b8d0
+
+The a9f2c4e6b8d0 seed carried placeholder digests that correspond to no
+document, so a consent receipt could not be verified against a text (GDPR
+Art. 7(1) demonstrability — flagged in PR #38 review). Until the DPO delivers
+the v4 texts (Non-functional → GDPR), the live v3 documents are adopted
+provisionally (decision 2026-08-18):
+
+* `terms_and_conditions` → version `2024-10` ("last updated October 2024"
+  per the page), pointing at https://testing.nc3.lu/terms-conditions/ with
+  the SHA-256 of the canonical snapshot committed at
+  `docs/legal/terms-of-service-2024-10.md`. The placeholder row is corrected
+  in place rather than versioned: its 2026-01-15 "version" named no real
+  text, and no production registration exists to have attested to it.
+* `privacy_policy` → new acceptance statement (the NFR requires explicit
+  privacy consent at signup), version `2026-08-18` (the page is undated, so
+  the snapshot date pins the text), pointing at
+  https://testing.nc3.lu/privacy/ with the SHA-256 of
+  `docs/legal/privacy-statement-2026-08-18.md`. Registration requires every
+  active account-level acceptance, so the new row binds automatically.
+* `scan_target_permission` keeps its placeholder: it is a per-launch
+  attestation, and no test in the v4.0 executable catalog is classified
+  intrusive, so nothing can record a receipt against it yet.
+
+The DPO's v4 texts land later as NEW version rows (retiring these), never as
+edits. Same NO FORCE wrap as the seed (docs/database-migrations.md).
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "d7e3f1a2b4c6"
+down_revision: str | None = "a9f2c4e6b8d0"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_TERMS_ID = "019ee1a2-0011-7c22-8d33-4e55f6a77b88"
+_PRIVACY_ID = "019ee1a2-3344-7f55-b066-7b88c9aadbcc"
+
+_TERMS_HASH = (
+    "sha256:6d80fb1d091c6aaeeb406150fd635976fffde54ad314aac373e7601f60a2c21a"
+)
+_PRIVACY_HASH = (
+    "sha256:04c03ecda8de1e039eba8fa3e5f428a631308008166b87ddb5b7e4cbfe9d4b56"
+)
+
+# The seed's placeholder values, restored verbatim on downgrade.
+_SEED_TERMS_HASH = (
+    "sha256:2f8a1c9d4e7b0a3f6c5d8e1b4a7f0c3d6e9b2a5f8c1d4e7b0a3f6c5d8e1b4a7f"
+)
+
+
+def upgrade() -> None:
+    """Apply this revision."""
+    op.execute("ALTER TABLE statement NO FORCE ROW LEVEL SECURITY")
+    op.execute(
+        f"""
+        UPDATE statement
+        SET version = '2024-10',
+            content_hash = '{_TERMS_HASH}',
+            content_uri = 'https://testing.nc3.lu/terms-conditions/',
+            effective_at = '2024-10-01T00:00:00Z'
+        WHERE id = '{_TERMS_ID}'
+        """
+    )
+    op.execute(
+        f"""
+        INSERT INTO statement
+            (id, statement_key, version, response_kind, required_context_type,
+             content_hash, content_uri, effective_at, retired_at)
+        VALUES
+            ('{_PRIVACY_ID}', 'privacy_policy', '2026-08-18', 'acceptance',
+             NULL, '{_PRIVACY_HASH}', 'https://testing.nc3.lu/privacy/',
+             '2026-08-18T00:00:00Z', NULL)
+        """
+    )
+    op.execute("ALTER TABLE statement FORCE ROW LEVEL SECURITY")
+
+
+def downgrade() -> None:
+    """Revert this revision."""
+    op.execute("ALTER TABLE statement NO FORCE ROW LEVEL SECURITY")
+    op.execute(f"DELETE FROM statement WHERE id = '{_PRIVACY_ID}'")
+    op.execute(
+        f"""
+        UPDATE statement
+        SET version = '2026-01-15',
+            content_hash = '{_SEED_TERMS_HASH}',
+            content_uri = 'https://testing.nc3.lu/legal/terms/2026-01-15',
+            effective_at = '2026-01-15T00:00:00Z'
+        WHERE id = '{_TERMS_ID}'
+        """
+    )
+    op.execute("ALTER TABLE statement FORCE ROW LEVEL SECURITY")
diff --git a/src/nc3_testing_platform/domains/statements/router.py b/src/nc3_testing_platform/domains/statements/router.py
index 890333a..0f486d1 100644
--- a/src/nc3_testing_platform/domains/statements/router.py
+++ b/src/nc3_testing_platform/domains/statements/router.py
@@ -18,6 +18,7 @@
 
 _T0 = datetime(2026, 1, 15, tzinfo=UTC)
 _STATEMENT_ID = UUID("019ee1a2-0011-7c22-8d33-4e55f6a77b88")
+_PRIVACY_ID = UUID("019ee1a2-3344-7f55-b066-7b88c9aadbcc")
 _RECEIPT_ID = UUID("019ee1a2-1122-7d33-9e44-5f66a7b88c99")
 
 
@@ -32,15 +33,28 @@ async def list_statements() -> list[Statement]:
     Unauthenticated: a visitor has to be able to read the terms before there is an
     account to attach an acceptance to.
     """
+    # Values mirror the statement rows the migrations seed (a9f2c4e6b8d0 +
+    # d7e3f1a2b4c6): the provisionally adopted v3 texts, whose digests are the
+    # SHA-256 of the canonical snapshots under docs/legal/. The DPO's v4
+    # texts arrive as new version rows (Non-functional → GDPR).
     return [
         Statement(
             id=_STATEMENT_ID,
             statement_key="terms_and_conditions",
-            version="2026-01-15",
+            version="2024-10",
             response_kind=StatementResponseKind.ACCEPTANCE,
-            content_hash="sha256:2f8a1c9d4e7b0a3f6c5d8e1b4a7f0c3d6e9b2a5f8c1d4e7b0a3f6c5d8e1b4a7f",
-            content_uri="https://testing.nc3.lu/legal/terms/2026-01-15",
-            effective_at=_T0,
+            content_hash="sha256:6d80fb1d091c6aaeeb406150fd635976fffde54ad314aac373e7601f60a2c21a",
+            content_uri="https://testing.nc3.lu/terms-conditions/",
+            effective_at=datetime(2024, 10, 1, tzinfo=UTC),
+        ),
+        Statement(
+            id=_PRIVACY_ID,
+            statement_key="privacy_policy",
+            version="2026-08-18",
+            response_kind=StatementResponseKind.ACCEPTANCE,
+            content_hash="sha256:04c03ecda8de1e039eba8fa3e5f428a631308008166b87ddb5b7e4cbfe9d4b56",
+            content_uri="https://testing.nc3.lu/privacy/",
+            effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(
             id=UUID("019ee1a2-2233-7e44-af55-6a77b899cdaa"),
diff --git a/tests/test_auth_postgres.py b/tests/test_auth_postgres.py
index 8f22271..7fe2d74 100644
--- a/tests/test_auth_postgres.py
+++ b/tests/test_auth_postgres.py
@@ -79,13 +79,14 @@ def client(monkeypatch: pytest.MonkeyPatch) -> Iterator[TestClient]:
 
 
 def _registration_body(email: str) -> dict[str, Any]:
-    """A valid registration payload accepting the seeded terms statement."""
+    """A valid registration payload accepting both seeded acceptance statements."""
     return {
         "email": email,
         "password": PASSWORD,
         "display_name": "Integration",
         "statement_responses": [
-            {"statement_key": "terms_and_conditions", "version": "2026-01-15"}
+            {"statement_key": "terms_and_conditions", "version": "2024-10"},
+            {"statement_key": "privacy_policy", "version": "2026-08-18"},
         ],
     }
 

From 8405e8fc4dc26e3529ba8cf6b49e155e965bf9cb Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Tue, 18 Aug 2026 21:23:49 +0200
Subject: [PATCH 2/8] fix: refuse statement downgrade while consent receipts
 exist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CodeRabbit round 1 on PR #39. The downgrade deleted the privacy statement
(which fails on its FK once a receipt exists) and rewrote the terms row
under any receipts referencing it, silently invalidating the text identity
recorded consent attests to. It now counts referencing receipts first —
with FORCE lifted on statement_response for the count, or a non-superuser
owner would see zero rows and the guard would silently pass — and refuses
with an actionable message pointing at the wipe rules. Proven both ways
against a live database: refused at 43 receipts, clean round trip after a
wipe.

The three legal-text findings are verbatim source-page defects (truncated
sentence, testing.c3.lu link, malformed survival clause) — recorded in the
revision docstring and routed to the site owner/DPO; the snapshots stay
faithful and the digests stand.
---
 ..._legal_texts_for_the_account_statements.py | 41 ++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
index e13b87c..6001694 100644
--- a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -27,6 +27,19 @@
 
 The DPO's v4 texts land later as NEW version rows (retiring these), never as
 edits. Same NO FORCE wrap as the seed (docs/database-migrations.md).
+
+The snapshots are verbatim, defects included: the live pages carry a
+truncated sentence ("…the company name and full."), a mistyped
+privacy-policy link (testing.c3.lu), and a malformed survival clause — all
+routed to the site owner/DPO. Fixing them here would make receipts attest to
+a text nobody was shown; the fixed pages arrive as new snapshots and new
+version rows.
+
+Downgrade refuses while any consent receipt references these statements:
+deleting the privacy row would fail on its FK anyway, and rewriting the
+terms row would silently invalidate the text identity recorded consent
+attests to. A development database in that state is wiped, not downgraded
+(docs/database-migrations.md wipe rules).
 """
 
 from collections.abc import Sequence
@@ -82,7 +95,33 @@ def upgrade() -> None:
 
 
 def downgrade() -> None:
-    """Revert this revision."""
+    """Revert this revision; refused while consent receipts exist."""
+    # The count must run with FORCE lifted: on a non-superuser owner the
+    # receipts table's policies would otherwise hide every row and the guard
+    # would silently pass (docs/database-migrations.md). A raised exception
+    # aborts the transaction, so the lift never outlives a refusal.
+    op.execute("ALTER TABLE statement_response NO FORCE ROW LEVEL SECURITY")
+    op.execute(
+        f"""
+        DO $$
+        DECLARE
+            receipts bigint;
+        BEGIN
+            SELECT count(*) INTO receipts
+            FROM statement_response
+            WHERE statement_id IN ('{_TERMS_ID}', '{_PRIVACY_ID}');
+            IF receipts > 0 THEN
+                RAISE EXCEPTION 'refusing downgrade: % consent receipt(s) '
+                    'attest to these statement versions — deleting or '
+                    'rewriting them would invalidate recorded consent. Wipe '
+                    'the development database instead '
+                    '(docs/database-migrations.md wipe rules)', receipts;
+            END IF;
+        END
+        $$;
+        """
+    )
+    op.execute("ALTER TABLE statement_response FORCE ROW LEVEL SECURITY")
     op.execute("ALTER TABLE statement NO FORCE ROW LEVEL SECURITY")
     op.execute(f"DELETE FROM statement WHERE id = '{_PRIVACY_ID}'")
     op.execute(

From 6eda0d3db776a7c248cb37b5d7e78229ea3e6ab8 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Tue, 18 Aug 2026 22:03:31 +0200
Subject: [PATCH 3/8] =?UTF-8?q?fix:=20correct=20the=20adapted=20legal=20te?=
 =?UTF-8?q?xts=20per=20review=20=E2=80=94=20the=20texts,=20not=20just=20th?=
 =?UTF-8?q?e=20digests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The v3 source pages carry real defects that must not ship as the platform's
statement texts (CodeRabbit round 1, confirmed against the source HTML). The
snapshots are therefore adapted documents now, corrections listed in each
file header:

- terms: mistyped privacy link (testing.c3.lu -> testing.nc3.lu/privacy/),
  malformed survival clause repaired, undefined 'Data Shared' removed from
  the survival list; renamed to terms-of-service-2026-08-18.md.
- privacy: truncated collected-data sentence completed; the approved
  retention figures added (12-month scan results with notify/extend/confirm
  and 30-day grace, 24-month audit records, erasure within 30 days of
  account deletion — the DPO-accepted specification numbers, nothing
  invented).

Both statements move to version 2026-08-18 (adoption date of the adapted
texts) and content_uri now points at the canonical file on the public
repository — the live v3 pages no longer match the adapted text, and a
receipt must reference the exact document shown. Hashes recomputed;
migration, mock router, and the postgres suite updated together. Round trip
re-proven (guard refusal with receipts, clean after wipe).
---
 docs/legal/privacy-statement-2026-08-18.md    | 32 +++++++++----
 ...4-10.md => terms-of-service-2026-08-18.md} | 29 +++++++-----
 ..._legal_texts_for_the_account_statements.py | 45 +++++++++----------
 .../domains/statements/router.py              | 18 ++++----
 tests/test_auth_postgres.py                   |  2 +-
 5 files changed, 74 insertions(+), 52 deletions(-)
 rename docs/legal/{terms-of-service-2024-10.md => terms-of-service-2026-08-18.md} (86%)

diff --git a/docs/legal/privacy-statement-2026-08-18.md b/docs/legal/privacy-statement-2026-08-18.md
index d9520e3..bd0a6ea 100644
--- a/docs/legal/privacy-statement-2026-08-18.md
+++ b/docs/legal/privacy-statement-2026-08-18.md
@@ -1,10 +1,18 @@
-<!-- Canonical snapshot of https://testing.nc3.lu/privacy/
-     (v3 Privacy Statement, undated on the page), retrieved
-     2026-08-18. Adopted provisionally for v4.0 statement
-     privacy_policy version 2026-08-18 until the DPO delivers the
-     v4 texts (Non-functional -> GDPR). statement.content_hash is the
-     SHA-256 of this file's bytes. Do not edit: a new text is a new
-     file and a new statement version row. -->
+<!-- Platform Privacy Statement, version 2026-08-18. Adapted from
+     https://testing.nc3.lu/privacy/ (v3 text, undated on the page;
+     retrieved 2026-08-18), adopted provisionally until the DPO
+     delivers the v4 texts (Non-functional -> GDPR). Corrections
+     applied to the source (PR #39 review):
+     1. Completed the truncated collected-data sentence ('...company
+        name and full.' -> '...company name and full address.').
+     2. Added the platform's retention periods for user data (12-month
+        scan results with notify/extend/confirm and a 30-day grace
+        period; 24-month audit records; erasure within 30 days of
+        account deletion) - the approved specification figures.
+     statement.content_hash is the SHA-256 of this file's bytes;
+     statement.content_uri points at this file on the public repository.
+     Do not edit: a new text is a new file and a new statement version
+     row. -->
 
 # PRIVACY STATEMENT
 
@@ -54,7 +62,7 @@ technical and functional management of our website.
 When you register to the Testing Platform, we process and collect certain personal data. The types of personal
 information that are collected from you include: name and family name of the contact person, username and
 password,
-email address as well as the company name and full.
+email address as well as the company name and full address.
 
 When you contact us by mail, we process your contact information and any other details you provide us. We will
 use
@@ -83,6 +91,14 @@ you as user will not be deleted as we might use them internally, however they wi
 anymore,
 since your account gets anonymized.
 
+On the Testing Platform specifically, scan results are retained for
+twelve (12) months by default; you are notified before this period
+lapses and may extend it, export the data, or confirm deletion, after
+which the data is permanently deleted following a thirty (30) day grace
+period. Audit records are retained for twenty-four (24) months on their
+own legal basis. If you delete your account, all personal data
+associated with it is permanently removed within thirty (30) days.
+
 However, if requested by local and national law, certain personal data may be retained for a longer period. For
 instance, for accounting purposes, such as, but limited to, payment of the services fees, data will be retained
 for
diff --git a/docs/legal/terms-of-service-2024-10.md b/docs/legal/terms-of-service-2026-08-18.md
similarity index 86%
rename from docs/legal/terms-of-service-2024-10.md
rename to docs/legal/terms-of-service-2026-08-18.md
index 35c34be..4339ce3 100644
--- a/docs/legal/terms-of-service-2024-10.md
+++ b/docs/legal/terms-of-service-2026-08-18.md
@@ -1,10 +1,19 @@
-<!-- Canonical snapshot of https://testing.nc3.lu/terms-conditions/
-     (v3 Terms of Service, last updated October 2024 per the page),
-     retrieved 2026-08-18. Adopted provisionally for v4.0 statement
-     terms_and_conditions version 2024-10 until the DPO delivers the
-     v4 texts (Non-functional -> GDPR). statement.content_hash is the
-     SHA-256 of this file's bytes. Do not edit: a new text is a new
-     file and a new statement version row. -->
+<!-- Platform Terms of Service, version 2026-08-18. Adapted from
+     https://testing.nc3.lu/terms-conditions/ (v3 text, last updated
+     October 2024 per the page; retrieved 2026-08-18), adopted
+     provisionally until the DPO delivers the v4 texts (Non-functional
+     -> GDPR). Corrections applied to the source (PR #39 review):
+     1. Your Account: privacy-policy link fixed from the mistyped
+        https://testing.c3.lu/privacy to https://testing.nc3.lu/privacy/.
+     2. Your Content: malformed sentence repaired to 'Licenses related
+        to statistical data derived from your content will continue
+        after your content is removed.'
+     3. Termination: undefined 'Data Shared' removed from the survival
+        list; capitalization aligned to the section names.
+     statement.content_hash is the SHA-256 of this file's bytes;
+     statement.content_uri points at this file on the public repository.
+     Do not edit: a new text is a new file and a new statement version
+     row. -->
 
 # Terms of Service
 
@@ -120,7 +129,7 @@ provide your first and last name, a valid e-mail address, your company or affili
 You may delete your account on the website at any time. The deletion means the permanent anonymization of all
 your account and personal data.
 Your personal data is processed according to Testing Platform Privacy Policy
-( https://testing.c3.lu/privacy )
+( https://testing.nc3.lu/privacy/ )
 LHC reserves the right to decline any application from you to register as a user of the platform
 in their sole discretion.
 You agree to be responsible for all action taken using your account, whether authorized by you or not, until you
@@ -143,14 +152,14 @@ However, by submitting content to this website, you agree to grant to LHC a non-
 non-transferable, royalty-free, license to use your content for statistical and analysis purposes.
 When the content you submit is removed from the website, whether by you or by LHC,
 LHC's special license ends when the last copy disappears from LHC's backups,
-caches, and other systems. Licenses related to statistical data you and is will continue/survive after your
+caches, and other systems. Licenses related to statistical data derived from your content will continue after your
 content is removed.
 
 ## Termination
 
 Either you or LHC may end the agreement written out in these terms at any time. When our agreement
 ends, your permission to use the website also ends.
-The following provisions survive the end of our agreement: Your account, Your Content, Data Shared.
+The following provisions survive the end of our agreement: Your Account, Your Content.
 
 ## Disputes
 
diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
index 6001694..c990718 100644
--- a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -9,18 +9,22 @@
 the v4 texts (Non-functional → GDPR), the live v3 documents are adopted
 provisionally (decision 2026-08-18):
 
-* `terms_and_conditions` → version `2024-10` ("last updated October 2024"
-  per the page), pointing at https://testing.nc3.lu/terms-conditions/ with
-  the SHA-256 of the canonical snapshot committed at
-  `docs/legal/terms-of-service-2024-10.md`. The placeholder row is corrected
-  in place rather than versioned: its 2026-01-15 "version" named no real
-  text, and no production registration exists to have attested to it.
+* `terms_and_conditions` → version `2026-08-18`: the platform's adapted
+  Terms of Service, committed at `docs/legal/terms-of-service-2026-08-18.md`
+  (adapted from the v3 page with three corrections found in the PR #39
+  review — mistyped privacy link, malformed survival clause, undefined
+  "Data Shared"; the file header lists them). The placeholder row is
+  corrected in place rather than versioned: its 2026-01-15 "version" named
+  no real text, and no production registration exists to have attested to it.
 * `privacy_policy` → new acceptance statement (the NFR requires explicit
-  privacy consent at signup), version `2026-08-18` (the page is undated, so
-  the snapshot date pins the text), pointing at
-  https://testing.nc3.lu/privacy/ with the SHA-256 of
-  `docs/legal/privacy-statement-2026-08-18.md`. Registration requires every
-  active account-level acceptance, so the new row binds automatically.
+  privacy consent at signup), version `2026-08-18`: the platform's adapted
+  Privacy Statement at `docs/legal/privacy-statement-2026-08-18.md`
+  (truncated sentence completed; the approved retention figures added).
+  Registration requires every active account-level acceptance, so the new
+  row binds automatically.
+* `content_hash` is the SHA-256 of the committed file; `content_uri` points
+  at the file on the public repository — the live v3 pages no longer match
+  the adapted text, so a receipt must reference the exact document shown.
 * `scan_target_permission` keeps its placeholder: it is a per-launch
   attestation, and no test in the v4.0 executable catalog is classified
   intrusive, so nothing can record a receipt against it yet.
@@ -28,13 +32,6 @@
 The DPO's v4 texts land later as NEW version rows (retiring these), never as
 edits. Same NO FORCE wrap as the seed (docs/database-migrations.md).
 
-The snapshots are verbatim, defects included: the live pages carry a
-truncated sentence ("…the company name and full."), a mistyped
-privacy-policy link (testing.c3.lu), and a malformed survival clause — all
-routed to the site owner/DPO. Fixing them here would make receipts attest to
-a text nobody was shown; the fixed pages arrive as new snapshots and new
-version rows.
-
 Downgrade refuses while any consent receipt references these statements:
 deleting the privacy row would fail on its FK anyway, and rewriting the
 terms row would silently invalidate the text identity recorded consent
@@ -55,10 +52,10 @@
 _PRIVACY_ID = "019ee1a2-3344-7f55-b066-7b88c9aadbcc"
 
 _TERMS_HASH = (
-    "sha256:6d80fb1d091c6aaeeb406150fd635976fffde54ad314aac373e7601f60a2c21a"
+    "sha256:3cbaf4702d67aab5b7d57e9f77cd9e3087df9a4a69714fd23ce041abcb075b74"
 )
 _PRIVACY_HASH = (
-    "sha256:04c03ecda8de1e039eba8fa3e5f428a631308008166b87ddb5b7e4cbfe9d4b56"
+    "sha256:003dde7b97929d32fd428460f6dd651409b9bfe58bbb43349dee0667e067a1e0"
 )
 
 # The seed's placeholder values, restored verbatim on downgrade.
@@ -73,10 +70,10 @@ def upgrade() -> None:
     op.execute(
         f"""
         UPDATE statement
-        SET version = '2024-10',
+        SET version = '2026-08-18',
             content_hash = '{_TERMS_HASH}',
-            content_uri = 'https://testing.nc3.lu/terms-conditions/',
-            effective_at = '2024-10-01T00:00:00Z'
+            content_uri = 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/terms-of-service-2026-08-18.md',
+            effective_at = '2026-08-18T00:00:00Z'
         WHERE id = '{_TERMS_ID}'
         """
     )
@@ -87,7 +84,7 @@ def upgrade() -> None:
              content_hash, content_uri, effective_at, retired_at)
         VALUES
             ('{_PRIVACY_ID}', 'privacy_policy', '2026-08-18', 'acceptance',
-             NULL, '{_PRIVACY_HASH}', 'https://testing.nc3.lu/privacy/',
+             NULL, '{_PRIVACY_HASH}', 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/privacy-statement-2026-08-18.md',
              '2026-08-18T00:00:00Z', NULL)
         """
     )
diff --git a/src/nc3_testing_platform/domains/statements/router.py b/src/nc3_testing_platform/domains/statements/router.py
index 0f486d1..98aa4a2 100644
--- a/src/nc3_testing_platform/domains/statements/router.py
+++ b/src/nc3_testing_platform/domains/statements/router.py
@@ -34,26 +34,26 @@ async def list_statements() -> list[Statement]:
     account to attach an acceptance to.
     """
     # Values mirror the statement rows the migrations seed (a9f2c4e6b8d0 +
-    # d7e3f1a2b4c6): the provisionally adopted v3 texts, whose digests are the
-    # SHA-256 of the canonical snapshots under docs/legal/. The DPO's v4
-    # texts arrive as new version rows (Non-functional → GDPR).
+    # d7e3f1a2b4c6): the platform's adapted v3 texts, whose digests are the
+    # SHA-256 of the canonical files under docs/legal/ (content_uri points
+    # there). The DPO's v4 texts arrive as new version rows.
     return [
         Statement(
             id=_STATEMENT_ID,
             statement_key="terms_and_conditions",
-            version="2024-10",
+            version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
-            content_hash="sha256:6d80fb1d091c6aaeeb406150fd635976fffde54ad314aac373e7601f60a2c21a",
-            content_uri="https://testing.nc3.lu/terms-conditions/",
-            effective_at=datetime(2024, 10, 1, tzinfo=UTC),
+            content_hash="sha256:3cbaf4702d67aab5b7d57e9f77cd9e3087df9a4a69714fd23ce041abcb075b74",
+            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/terms-of-service-2026-08-18.md",
+            effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(
             id=_PRIVACY_ID,
             statement_key="privacy_policy",
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
-            content_hash="sha256:04c03ecda8de1e039eba8fa3e5f428a631308008166b87ddb5b7e4cbfe9d4b56",
-            content_uri="https://testing.nc3.lu/privacy/",
+            content_hash="sha256:003dde7b97929d32fd428460f6dd651409b9bfe58bbb43349dee0667e067a1e0",
+            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/privacy-statement-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(
diff --git a/tests/test_auth_postgres.py b/tests/test_auth_postgres.py
index 7fe2d74..cebec80 100644
--- a/tests/test_auth_postgres.py
+++ b/tests/test_auth_postgres.py
@@ -85,7 +85,7 @@ def _registration_body(email: str) -> dict[str, Any]:
         "password": PASSWORD,
         "display_name": "Integration",
         "statement_responses": [
-            {"statement_key": "terms_and_conditions", "version": "2024-10"},
+            {"statement_key": "terms_and_conditions", "version": "2026-08-18"},
             {"statement_key": "privacy_policy", "version": "2026-08-18"},
         ],
     }

From fd0926985b6343c040a92a91c00ef3e63d804518 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Tue, 18 Aug 2026 22:06:36 +0200
Subject: [PATCH 4/8] fix: privacy collected-data sentence states what v4
 actually collects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per Alexis: the platform collects neither the company name and full
address nor the name and family name of a contact person — the v3 sentence
described the old site's collection. The registration paragraph now lists
exactly what POST /auth/register takes: email address, password, optional
display name. Correction note in the file header updated, hash recomputed,
migration and mock router aligned, revision re-applied and suites green.
---
 docs/legal/privacy-statement-2026-08-18.md         | 14 ++++++++------
 ...pt_v3_legal_texts_for_the_account_statements.py |  2 +-
 .../domains/statements/router.py                   |  2 +-
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/docs/legal/privacy-statement-2026-08-18.md b/docs/legal/privacy-statement-2026-08-18.md
index bd0a6ea..7d4a507 100644
--- a/docs/legal/privacy-statement-2026-08-18.md
+++ b/docs/legal/privacy-statement-2026-08-18.md
@@ -3,8 +3,11 @@
      retrieved 2026-08-18), adopted provisionally until the DPO
      delivers the v4 texts (Non-functional -> GDPR). Corrections
      applied to the source (PR #39 review):
-     1. Completed the truncated collected-data sentence ('...company
-        name and full.' -> '...company name and full address.').
+     1. Collected-data sentence aligned with what the platform actually
+        collects at registration (email address, password, optional
+        display name) - the source sentence was truncated and described
+        the v3 site's collection (contact person, username, company
+        name), none of which v4 collects.
      2. Added the platform's retention periods for user data (12-month
         scan results with notify/extend/confirm and a 30-day grace
         period; 24-month audit records; erasure within 30 days of
@@ -59,10 +62,9 @@ user-agents, URLs, date and time logs. We collect those logs for our legitimate
 the
 technical and functional management of our website.
 
-When you register to the Testing Platform, we process and collect certain personal data. The types of personal
-information that are collected from you include: name and family name of the contact person, username and
-password,
-email address as well as the company name and full address.
+When you register to the Testing Platform, we process and collect certain personal data. The personal
+information collected from you at registration is: your email address, a password, and an optional display
+name.
 
 When you contact us by mail, we process your contact information and any other details you provide us. We will
 use
diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
index c990718..ae47845 100644
--- a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -55,7 +55,7 @@
     "sha256:3cbaf4702d67aab5b7d57e9f77cd9e3087df9a4a69714fd23ce041abcb075b74"
 )
 _PRIVACY_HASH = (
-    "sha256:003dde7b97929d32fd428460f6dd651409b9bfe58bbb43349dee0667e067a1e0"
+    "sha256:0560cefecd67a08c81784b68f7644e36c5d897d36c559691ecaf9a5e6de5a0c0"
 )
 
 # The seed's placeholder values, restored verbatim on downgrade.
diff --git a/src/nc3_testing_platform/domains/statements/router.py b/src/nc3_testing_platform/domains/statements/router.py
index 98aa4a2..d0cb441 100644
--- a/src/nc3_testing_platform/domains/statements/router.py
+++ b/src/nc3_testing_platform/domains/statements/router.py
@@ -52,7 +52,7 @@ async def list_statements() -> list[Statement]:
             statement_key="privacy_policy",
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
-            content_hash="sha256:003dde7b97929d32fd428460f6dd651409b9bfe58bbb43349dee0667e067a1e0",
+            content_hash="sha256:0560cefecd67a08c81784b68f7644e36c5d897d36c559691ecaf9a5e6de5a0c0",
             content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/privacy-statement-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),

From 6c2367c11d0bae5ffa044289bc1398bde72cb4e1 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Tue, 18 Aug 2026 22:12:25 +0200
Subject: [PATCH 5/8] fix: pin statement content_uri to the commit SHA carrying
 the texts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ECC review finding (MEDIUM, the only one): blob/main is a moving ref — a
future docs/ reorganization would 404 the URI stored in every consent
receipt while the hash stayed valid, undermining the Art. 15 retrievability
this migration claims. Both URIs now pin fd09269, the immutable commit
whose bytes the digests attest. Review artifact at
.claude/reviews/pr-39-review.md.
---
 ...1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py | 4 ++--
 src/nc3_testing_platform/domains/statements/router.py         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
index ae47845..f6bb1ff 100644
--- a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -72,7 +72,7 @@ def upgrade() -> None:
         UPDATE statement
         SET version = '2026-08-18',
             content_hash = '{_TERMS_HASH}',
-            content_uri = 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/terms-of-service-2026-08-18.md',
+            content_uri = 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/terms-of-service-2026-08-18.md',
             effective_at = '2026-08-18T00:00:00Z'
         WHERE id = '{_TERMS_ID}'
         """
@@ -84,7 +84,7 @@ def upgrade() -> None:
              content_hash, content_uri, effective_at, retired_at)
         VALUES
             ('{_PRIVACY_ID}', 'privacy_policy', '2026-08-18', 'acceptance',
-             NULL, '{_PRIVACY_HASH}', 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/privacy-statement-2026-08-18.md',
+             NULL, '{_PRIVACY_HASH}', 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/privacy-statement-2026-08-18.md',
              '2026-08-18T00:00:00Z', NULL)
         """
     )
diff --git a/src/nc3_testing_platform/domains/statements/router.py b/src/nc3_testing_platform/domains/statements/router.py
index d0cb441..24070a8 100644
--- a/src/nc3_testing_platform/domains/statements/router.py
+++ b/src/nc3_testing_platform/domains/statements/router.py
@@ -44,7 +44,7 @@ async def list_statements() -> list[Statement]:
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
             content_hash="sha256:3cbaf4702d67aab5b7d57e9f77cd9e3087df9a4a69714fd23ce041abcb075b74",
-            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/terms-of-service-2026-08-18.md",
+            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/terms-of-service-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(
@@ -53,7 +53,7 @@ async def list_statements() -> list[Statement]:
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
             content_hash="sha256:0560cefecd67a08c81784b68f7644e36c5d897d36c559691ecaf9a5e6de5a0c0",
-            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/main/docs/legal/privacy-statement-2026-08-18.md",
+            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/privacy-statement-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(

From 2a4656a6036ac1806cc28d60ba251fbec4a69000 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 19 Aug 2026 10:52:20 +0200
Subject: [PATCH 6/8] test: prove each required acceptance is individually
 enforced at registration

---
 tests/test_auth_postgres.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/tests/test_auth_postgres.py b/tests/test_auth_postgres.py
index cebec80..ca139ff 100644
--- a/tests/test_auth_postgres.py
+++ b/tests/test_auth_postgres.py
@@ -152,6 +152,20 @@ def test_registration_without_consent_answers_422(client: TestClient) -> None:
     assert "terms_and_conditions" in response.text
 
 
+@pytest.mark.parametrize("missing_key", ["terms_and_conditions", "privacy_policy"])
+def test_registration_missing_one_acceptance_answers_422(
+    client: TestClient, missing_key: str
+) -> None:
+    """Each seeded statement is individually required; the other cannot stand in."""
+    body = _registration_body(_fresh_email())
+    body["statement_responses"] = [
+        r for r in body["statement_responses"] if r["statement_key"] != missing_key
+    ]
+    response = client.post("/api/v1/auth/register", json=body)
+    assert response.status_code == 422
+    assert missing_key in response.text
+
+
 def test_lockout_after_repeated_failures(
     client: TestClient, monkeypatch: pytest.MonkeyPatch
 ) -> None:

From ee0d2e072df274de45aaa076c327c2c91663e7c3 Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 19 Aug 2026 11:01:58 +0200
Subject: [PATCH 7/8] fix: align the terms account-data list with registration
 and reconcile the retention section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 3 of the PR #39 review:
- Terms 'Your Account': the source required first and last name and a
  company or affiliation address; registration collects e-mail, password
  and an optional display name — the text now says so (header bullet 4).
- Privacy retention: user-added server data gets an explicit criterion
  (kept while the account exists, anonymized with it), and audit records
  are carved out of the 30-day erasure explicitly (anonymized in the
  same pass, retained anonymized for the rest of their 24 months).
- Digests recomputed in the revision and the mock roster.
---
 docs/legal/privacy-statement-2026-08-18.md    | 21 ++++++++++++++-----
 docs/legal/terms-of-service-2026-08-18.md     |  7 ++++++-
 ..._legal_texts_for_the_account_statements.py | 12 ++++++-----
 .../domains/statements/router.py              |  4 ++--
 4 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/docs/legal/privacy-statement-2026-08-18.md b/docs/legal/privacy-statement-2026-08-18.md
index 7d4a507..b1f85b9 100644
--- a/docs/legal/privacy-statement-2026-08-18.md
+++ b/docs/legal/privacy-statement-2026-08-18.md
@@ -12,6 +12,11 @@
         scan results with notify/extend/confirm and a 30-day grace
         period; 24-month audit records; erasure within 30 days of
         account deletion) - the approved specification figures.
+     3. Retention section reconciled: an explicit retention criterion
+        for user-added server data (kept while the account exists,
+        anonymized with it on deletion) and the audit-record carve-out
+        from the 30-day erasure (anonymized in the same pass, retained
+        anonymized for the remainder of their 24 months).
      statement.content_hash is the SHA-256 of this file's bytes;
      statement.content_uri points at this file on the public repository.
      Do not edit: a new text is a new file and a new statement version
@@ -89,17 +94,23 @@ account after one year of inactivity on the Testing Platform, we inform you that
 be
 replaced in our Database with a string called "DELETED”. The data collected about servers that have been added
 by
-you as user will not be deleted as we might use them internally, however they will not be connected to you
-anymore,
-since your account gets anonymized.
+you as user is retained for as long as your account exists; upon deletion of your account it is anonymized in
+the
+same pass, so it is no longer connected to you, and only the anonymized technical records may be kept for
+internal purposes.
 
 On the Testing Platform specifically, scan results are retained for
 twelve (12) months by default; you are notified before this period
 lapses and may extend it, export the data, or confirm deletion, after
 which the data is permanently deleted following a thirty (30) day grace
 period. Audit records are retained for twenty-four (24) months on their
-own legal basis. If you delete your account, all personal data
-associated with it is permanently removed within thirty (30) days.
+own legal basis (security monitoring and abuse investigation). If you
+delete your account, all personal data associated with it is permanently
+removed or irreversibly anonymized as described above within thirty (30)
+days; audit records are not exempt from that anonymization — the
+identifiers connecting them to you are replaced in the same pass — but
+the anonymized records remain for the rest of their twenty-four (24)
+months.
 
 However, if requested by local and national law, certain personal data may be retained for a longer period. For
 instance, for accounting purposes, such as, but limited to, payment of the services fees, data will be retained
diff --git a/docs/legal/terms-of-service-2026-08-18.md b/docs/legal/terms-of-service-2026-08-18.md
index 4339ce3..9adc136 100644
--- a/docs/legal/terms-of-service-2026-08-18.md
+++ b/docs/legal/terms-of-service-2026-08-18.md
@@ -10,6 +10,11 @@
         after your content is removed.'
      3. Termination: undefined 'Data Shared' removed from the survival
         list; capitalization aligned to the section names.
+     4. Your Account: the account-creation data list aligned with what
+        registration actually collects (a valid e-mail address and a
+        password, with an optional display name) - the source required
+        first and last name and a company or affiliation address, none
+        of which v4 collects.
      statement.content_hash is the SHA-256 of this file's bytes;
      statement.content_uri points at this file on the public repository.
      Do not edit: a new text is a new file and a new statement version
@@ -124,7 +129,7 @@ not authorized to use, or disclose your password or username to any other person
 name to be used by any other person to access the Services. You will be responsible for use of the Website
 and/or Services via your username and so will be liable for breach by anyone to whom you provide the details. To
 create an account, you must provide some information about yourself. If you create an account, you agree to
-provide your first and last name, a valid e-mail address, your company or affiliation address.
+provide a valid e-mail address and to choose a password; you may additionally provide an optional display name.
 
 You may delete your account on the website at any time. The deletion means the permanent anonymization of all
 your account and personal data.
diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
index f6bb1ff..c28c711 100644
--- a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -11,15 +11,17 @@
 
 * `terms_and_conditions` → version `2026-08-18`: the platform's adapted
   Terms of Service, committed at `docs/legal/terms-of-service-2026-08-18.md`
-  (adapted from the v3 page with three corrections found in the PR #39
+  (adapted from the v3 page with four corrections found in the PR #39
   review — mistyped privacy link, malformed survival clause, undefined
-  "Data Shared"; the file header lists them). The placeholder row is
+  "Data Shared", account-creation data list aligned with what
+  registration collects; the file header lists them). The placeholder row is
   corrected in place rather than versioned: its 2026-01-15 "version" named
   no real text, and no production registration exists to have attested to it.
 * `privacy_policy` → new acceptance statement (the NFR requires explicit
   privacy consent at signup), version `2026-08-18`: the platform's adapted
   Privacy Statement at `docs/legal/privacy-statement-2026-08-18.md`
-  (truncated sentence completed; the approved retention figures added).
+  (truncated sentence completed; the approved retention figures added
+  and reconciled with the anonymizing deletion workflow).
   Registration requires every active account-level acceptance, so the new
   row binds automatically.
 * `content_hash` is the SHA-256 of the committed file; `content_uri` points
@@ -52,10 +54,10 @@
 _PRIVACY_ID = "019ee1a2-3344-7f55-b066-7b88c9aadbcc"
 
 _TERMS_HASH = (
-    "sha256:3cbaf4702d67aab5b7d57e9f77cd9e3087df9a4a69714fd23ce041abcb075b74"
+    "sha256:5849ebd2b3c3eb22985f1507483fa21e9a364ddd72e72a7a6f00034438fb1515"
 )
 _PRIVACY_HASH = (
-    "sha256:0560cefecd67a08c81784b68f7644e36c5d897d36c559691ecaf9a5e6de5a0c0"
+    "sha256:4035948413e80ebea43cae2a53f956ea26939838f3ec0c2064a554cf9c0d28b9"
 )
 
 # The seed's placeholder values, restored verbatim on downgrade.
diff --git a/src/nc3_testing_platform/domains/statements/router.py b/src/nc3_testing_platform/domains/statements/router.py
index 24070a8..98927a1 100644
--- a/src/nc3_testing_platform/domains/statements/router.py
+++ b/src/nc3_testing_platform/domains/statements/router.py
@@ -43,7 +43,7 @@ async def list_statements() -> list[Statement]:
             statement_key="terms_and_conditions",
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
-            content_hash="sha256:3cbaf4702d67aab5b7d57e9f77cd9e3087df9a4a69714fd23ce041abcb075b74",
+            content_hash="sha256:5849ebd2b3c3eb22985f1507483fa21e9a364ddd72e72a7a6f00034438fb1515",
             content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/terms-of-service-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
@@ -52,7 +52,7 @@ async def list_statements() -> list[Statement]:
             statement_key="privacy_policy",
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
-            content_hash="sha256:0560cefecd67a08c81784b68f7644e36c5d897d36c559691ecaf9a5e6de5a0c0",
+            content_hash="sha256:4035948413e80ebea43cae2a53f956ea26939838f3ec0c2064a554cf9c0d28b9",
             content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/privacy-statement-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),

From 10a2195258fa13142f38e264c6b4031d01e7d88a Mon Sep 17 00:00:00 2001
From: t0kubetsu <alexis.danjon@nc3.lu>
Date: Wed, 19 Aug 2026 11:02:23 +0200
Subject: [PATCH 8/8] fix: pin statement content_uri to the commit SHA carrying
 the corrected texts

---
 ...1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py | 4 ++--
 src/nc3_testing_platform/domains/statements/router.py         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
index c28c711..8b7eadf 100644
--- a/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
+++ b/migrations/versions/2026_08_18_d7e3f1a2b4c6_adopt_v3_legal_texts_for_the_account_statements.py
@@ -74,7 +74,7 @@ def upgrade() -> None:
         UPDATE statement
         SET version = '2026-08-18',
             content_hash = '{_TERMS_HASH}',
-            content_uri = 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/terms-of-service-2026-08-18.md',
+            content_uri = 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/ee0d2e072df274de45aaa076c327c2c91663e7c3/docs/legal/terms-of-service-2026-08-18.md',
             effective_at = '2026-08-18T00:00:00Z'
         WHERE id = '{_TERMS_ID}'
         """
@@ -86,7 +86,7 @@ def upgrade() -> None:
              content_hash, content_uri, effective_at, retired_at)
         VALUES
             ('{_PRIVACY_ID}', 'privacy_policy', '2026-08-18', 'acceptance',
-             NULL, '{_PRIVACY_HASH}', 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/privacy-statement-2026-08-18.md',
+             NULL, '{_PRIVACY_HASH}', 'https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/ee0d2e072df274de45aaa076c327c2c91663e7c3/docs/legal/privacy-statement-2026-08-18.md',
              '2026-08-18T00:00:00Z', NULL)
         """
     )
diff --git a/src/nc3_testing_platform/domains/statements/router.py b/src/nc3_testing_platform/domains/statements/router.py
index 98927a1..7f9fe28 100644
--- a/src/nc3_testing_platform/domains/statements/router.py
+++ b/src/nc3_testing_platform/domains/statements/router.py
@@ -44,7 +44,7 @@ async def list_statements() -> list[Statement]:
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
             content_hash="sha256:5849ebd2b3c3eb22985f1507483fa21e9a364ddd72e72a7a6f00034438fb1515",
-            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/terms-of-service-2026-08-18.md",
+            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/ee0d2e072df274de45aaa076c327c2c91663e7c3/docs/legal/terms-of-service-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(
@@ -53,7 +53,7 @@ async def list_statements() -> list[Statement]:
             version="2026-08-18",
             response_kind=StatementResponseKind.ACCEPTANCE,
             content_hash="sha256:4035948413e80ebea43cae2a53f956ea26939838f3ec0c2064a554cf9c0d28b9",
-            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/fd0926985b6343c040a92a91c00ef3e63d804518/docs/legal/privacy-statement-2026-08-18.md",
+            content_uri="https://github.com/NC3-TestingPlatform/testing-platform-backend/blob/ee0d2e072df274de45aaa076c327c2c91663e7c3/docs/legal/privacy-statement-2026-08-18.md",
             effective_at=datetime(2026, 8, 18, tzinfo=UTC),
         ),
         Statement(