Replace the /privacy placeholder with the full GDPR-first policy (dated
10 Jun 2026). Beyond the reviewed draft: cover the waitlist end-to-end
(data row, consent basis, marketing section, retention), add a staged-
rollout clause so future-product processing is described honestly, make
the CCPA/GPC commitment conditional (no voluntary promise while nothing
is sold/shared), and fix the CCPA look-back wording.
Point of collection follows suit: the waitlist form microcopy links the
policy, and the confirmation email now offers reply-to-remove, promises
an unsubscribe link in every update, and links /privacy.
0b45d7ea54