Privacy policy

Covers what customer data is collected (Stripe, Supabase, Resend) and how it's used. Required before Stripe checkout can legally go live.

Placeholder — no legal copy yet.