Privacy policy

Placeholder privacy copy. Before production launch, describe phone OTP, order and payment records, notification destinations (SMS/email/WhatsApp), and per-tenant host isolation.