Privacy policy published

A missing privacy policy is not just an oversight — it is a legal violation under GDPR Article 13 (disclosure at point of collection), CCPA §1798.100 (right to know), and NIST 800-53 rev5 PT-1 (Privacy Policies, Agreements, and Processing). FedRAMP rev5 PT-1 requires agencies and their cloud providers to maintain and publish privacy notices. Users have no way to exercise data access, correction, or deletion rights without a published policy describing those rights. Regulators in California and the EU routinely issue fines for absent or incomplete policies even when no breach has occurred.

Publish a privacy policy at /privacy and link it from the footer on every page. At minimum cover the six sections required by GDPR Art. 13 and CCPA §1798.100.

# Privacy Policy

## What We Collect
- Account data: email, name, role
- Usage data: pages visited, actions performed, audit submissions
- Technical data: IP address (hashed), browser type, timestamps

## How We Use It
To operate the service, improve reliability, and comply with legal obligations.

## Who We Share It With
Subprocessors only (list them: Supabase, Vercel, Stripe) — no sale of data.

## Your Rights
Access, correction, deletion, and portability requests: privacy@yourcompany.com

## Retention
Account data retained while active; deleted within 30 days of account closure.
Audit logs retained 90 days.

## Contact
privacy@yourcompany.com

Have counsel review the final policy. Add a <link rel="privacy-policy" href="/privacy"> tag to your root layout's <head> for machine-discoverability.