Terms and Privacy pages on sendlit.app are empty; add Terms, Privacy, Acceptable Use / anti-spam policy and DPA #65

Background

The legal pages on the marketing site are live URLs with no content:

• https://sendlit.app/terms returns 200 but renders only the site nav and footer (checked 19 Oct 2026; about 80 KB of HTML, no legal text: zero matches for "liability", "personal data" or "spam").
• https://sendlit.app/privacy is the same.
• https://sendlit.app/acceptable-use, https://sendlit.app/aup and https://sendlit.app/dpa return 404.

The footer links to "Terms of use" and "Privacy policy", so visitors land on blank pages. We are a hosted email-sending service. Senders and their ESPs (Amazon SES in particular) expect an anti-spam / acceptable use policy. EU senders need a DPA, because we process their subscribers' personal data.

This blocks inviting beehiiv switchers (and any public users) to app.sendlit.app.

Proposed fix

• Publish real content for Terms of Service and Privacy Policy on sendlit.app. Cover the hosted service, bring-your-own-ESP, the data we store (contacts, events, tracking) and retention.
• Add an Acceptable Use / Anti-Spam Policy:
  • consent required, no purchased or scraped lists
  • working unsubscribe and physical address (already enforced in apps/api/src/mail/render.ts)
  • bounce and complaint thresholds
  • suspension rights (teams already support sending_suspended, apps/api/src/db/schema.ts)
• Add a Data Processing Agreement (GDPR Art. 28) with a sub-processor list (hosting, Dodo Payments, PostHog, etc.).
• Link all four from the site footer and from the signup/login page.

Acceptance criteria

• /terms and /privacy show full, dated policy text
• /acceptable-use (or /aup) exists with an anti-spam policy, including suspension terms
• /dpa exists with a sub-processor list and a way to request a signed copy
• Footer links to all four pages; the login/signup page references the Terms and AUP
• Each page has a "last updated" date