Privacy Policy (draft)

Placeholder only. Counsel must approve categories of data, subprocessors (e.g. Vercel, Supabase, Stripe), retention, and regional rights. See docs/LEGAL_GOVERNANCE.md and docs/VENDOR_SECURITY.md.