HQ-required legal content

Privacy status—not final legal policy.

The V1 form follows data-minimization and demo-mode safeguards, but the legal business identity, controller details, retention schedule, rights process, and jurisdictional text still require qualified approval.

Implemented safely in V1

Only planning data genuinely needed by the intake flow
Explicit consent before submission
No PII in analytics events
No form contents in client logs
No secret keys in browser code
Demo mode does not claim delivery

Required before production

Legal business name, public contact, data controller, processors, lawful basis, retention, user rights, international transfer language, cookie position, and approved policy text.