# Policies settings tab wiring audit
The Policies tab is persisted through `SettingsHelper` in the `policies` group and rendered from `config/policy-document-settings.php`.
## Wired
- Terms, privacy, cancellation, refund, and cookie policy pages are available through public legal routes and linked navigation.
- Checkout displays and validates terms, cancellation policy, privacy/GDPR consent controls.
- Cancellation behavior is handled by venue cancellation policy records and `CancellationPolicyService`.
- Company-admin cancellation policies can be created, edited, assigned to rate plans, and applied to bookings.
- GDPR export/deletion flows and consent-related account controls exist in the application.
## Partial or configuration-only
- Policy URL/version/last-updated fields are stored but public legal pages use static translated content rather than company-specific URLs and versions.
- `require_signed_documents`, signature type, and document retention settings require the contract/document workflows and are not enforced at booking creation.
- Age verification settings are stored, but no universal booking gate checks the configured minimum age/method.
- Liability waiver settings are stored, but waiver acceptance is not consistently required for configured activities.
- `data_retention_days`, `document_retention_years`, and `essential_cookies_only` are not globally enforced by scheduled cleanup or cookie middleware.
- `refund_processing_days` is represented in refund logic in some paths, but legacy payment/refund endpoints do not all consult the company policy settings.
PHP syntax validation passed for the policy settings form and controller persistence path.