To cover: data controller ([legal entity]), what we collect (profile, assessment results, submissions), purposes and legal bases, hosting location, sub-processors (including Anthropic for AI features), retention, GDPR rights including anonymisation, cookies/analytics, contact.
Privacy policy
Draft placeholder — must be written and reviewed before launch.