Epic: A2P 10DLC & GDPR Compliance Readiness (Legal & UX)

[kingdonb]

Overview

As Mecris transitions from a single-user prototype to a multi-tenant SaaS platform (v0.0.1 and beyond), we must satisfy two major legal and compliance frameworks:

1. Twilio A2P 10DLC Compliance: Required to maintain the $2/mo SMS/WhatsApp campaign and avoid message filtering.
2. GDPR (General Data Protection Regulation): Required for handling user data, providing data portability, and right-to-erasure.

We already have some technical foundations (e.g., delete_user_data and export_user_data MCP tools are implemented), but we lack the public-facing legal documents and explicit user-facing consent flows.

Requirements

1. Legal Documents (Hosted on mecris.urmanac.com or GitHub Pages)

• Privacy Policy: Must explicitly include the exact A2P anti-sharing clause: "No mobile information will be shared with third parties/affiliates for marketing/promotional purposes." Must also outline data retention and GDPR rights.
• Terms of Service: Must explain the service, the opt-out mechanism (STOP), customer support (HELP), and liability bounds.

2. Twilio A2P 10DLC Campaign

• Opt-In Flow: Design and document the explicit opt-in checkbox (cannot be pre-checked) that states: "By checking this box, you agree to receive SMS reminders from Mecris. Message frequency varies. Message and data rates may apply. Reply STOP to opt out."
• Campaign Submission: Submit the campaign to Twilio for manual review, linking directly to the new Privacy Policy and TOS.

3. GDPR & Data Privacy (Frontend/UX)

• Right to Erasure (UX): Expose the existing delete_user_data MCP tool as a "Delete Account" button in the Android App / Web interface.
• Data Portability (UX): Expose the existing export_user_data MCP tool as a "Download My Data" button in the Android App / Web interface.
• Cookie / Consent Banner: If we deploy a web interface, ensure a basic consent mechanism is in place.

Links / References

• docs/A2P_COMPLIANCE_GUIDE.md
• docs/DATA_ARCHITECTURE_AND_PRIVACY.md
• Issue Design and Scaffolding for Mecris Android App #50 (Android App Design - serves as the mobile hub for these consent flows)