Privacy policy

[To be drafted under GDPR: processing purposes, legal basis, retention duration, sub-processors (Stripe, Supabase, Resend, Vercel, Meta), data-subject rights, DPO contact if applicable, cookie information.]