# Owner inputs required for L-03 — /terms and /privacy

Ahmed must supply the facts below before `/terms` or `/privacy` are edited. The agent will not invent any of them (checklist §9.7). Once provided, the pages get real text, an effective date, and go into the launch checklist evidence.

## Legal facts (checklist L-03 + §9)

1. **Legal entity** — registered company name and form, or an explicit statement that the site is operated as a sole proprietorship (and under what name).
2. **Governing law / jurisdiction** — the law that governs the terms and the courts or venue for disputes.
3. **Retention periods per data type** — accounts and hashed passwords, verification/reset tokens, comments, saved posts, launch-notification emails, server logs. Include "until account deletion" where that is the real answer.
4. **Full provider list** — as currently known: Cloudflare (DNS/proxy, Email Routing + Email Sending), VPS host for 147.79.102.201, Postgres (self-hosted on that VPS). Confirm or correct; note anything that processes personal data outside these.
5. **Data-deletion process** — how a user requests deletion (email address or in-app), what is deleted vs retained, and the timeframe.
6. **Contact channel** — the address that appears in the pages and must actually reach Ahmed (currently the footer `mailto:hello@anwarpy.ai`).
7. **Effective date** — the date the final terms/privacy go live (this becomes the published "آخر تحديث").

## Checklist §9 decisions (needed to finalize the same pages)

1. Which existing intended-VIP posts/assets are temporarily opened? (Recommended: approved published VIP materials only.)
2. Which launch tutorials remain permanently free? (Recommended: core introductory tutorials.)
3. What requires an account? (Recommended: guest reading; account only for save/comment.)
4. Is an email-update feature ready? (The notify list exists; confirm it may be advertised.)
5. Notice period before restricting temporary VIP early-access materials.
6. Who approves posts and launch switches (Ahmed until delegated)?
7. Actual retention periods, providers, legal entity and billing jurisdiction (see items 1–7 above).

## Operational blocker found 2026-10-10 (also affects the pages' email claims)

Cloudflare Email Sending is **disabled** on the account (API test returned `10203 email.sending_disabled`). Before any page or flow promises email delivery: enable Email Sending in the Cloudflare dashboard (Account → Email), then re-test the transport. The footer mailto link is unaffected (it opens the visitor's own mail client).