Privacy

Draft placeholder. This is not a privacy notice. A UK GDPR-compliant privacy notice (controller identity, lawful bases, retention, rights, processors, international transfers) must be prepared with professional advice before any real personal data is collected. See docs/legal-and-operational-gates.md.