🔴 Legal & compliance (India-first)

Tasks

• Terms of Service, Privacy Policy, Refund Policy (verify /refund-policy), Grievance Officer contact.
• DPDP Act 2023 — consent capture, retention policy, deletion/anonymization flow (wire schema anonymizedAt), processing records.
• Cookie consent banner.
• GST — registration, tax-inclusive pricing (done in code), GST invoices per order, creator/mentor payout tax (TDS).
• Marketplace terms: creator agreement, mentor contract, revenue-share terms.
• Content moderation & takedown / IP policy behind the admin moderation queues.

Acceptance

Legal pages live + linked; DPDP deletion works; GST invoices generated.

Scope update (2026-07-17 triage, see #42)

• Split into tiers: 🔴 beta-blocker subset = ToS/Privacy/Refund-policy/Contact pages + cookie banner (pages currently don't exist — footer stubs to /verify; Razorpay live activation requires them). 🟠 launch-window = DPDP deletion/anonymization + consent capture + retention (hard enforcement May 2027).
• GST scope upgraded by founder decision: not a basic invoice — the full invoice engine from #24 (CGST/SGST/IGST split by place of supply, SAC code, buyer GSTIN, InvoiceSeries gapless numbering, credit notes on refunds) ships pre-launch.

Start with the tiered scope update and issue #24, then inspect the footer stubs, the /refund-policy route, the anonymizedAt schema, and the admin moderation queues. Break the work into the beta-blocker legal pages and cookie banner, DPDP flows, and the GST invoice engine. Done means the legal pages are live and linked, DPDP deletion works, and GST invoices are generated.