Privacy Policy

TODO: replace with a real privacy policy before going live — required for Stripe and for UK/EU data protection law (UK GDPR).

This should cover: what data we collect (name, email, payment info handled by Stripe — we never see full card details), why we collect it (order fulfillment, download delivery, optional newsletter), how long we keep it, and how customers can request deletion. Consider using a generator or solicitor-reviewed template.