feat: UK GDPR complaints and Meta deletion workflow, inbound rate limits, DSAR erasure

.agents/rules/solo-maker-profile.md

@@ -0,0 +1,33 @@
+---
+trigger: always_on
+---
+
+# The Solo Maker Profile: Legal, Financial & Operational Baseline
+
+**Identity:** Operating as a UK Sole Trader (Tibor Rames) building a portfolio of B2B SaaS and operational tools (Invoice Rescue, DM Forge, Mail-Wise).
+**Structure:** As a sole trader, the business operates with unlimited personal liability, making strict adherence to regulatory boundaries, insurance, and compliance critical.
+
+## 1. Regulatory Boundaries & Compliance
+
+- **FCA Perimeter (Debt Collection):** The business acts strictly as a first-party credit-control service. It remains outside the FCA's regulated "debt-collecting" perimeter (Article 39F) because it chases ordinary commercial B2B trade invoices, not debts arising from regulated consumer credit or consumer hire agreements.
+- **Marketing & ASA/CAP Code:** All marketing communications comply with CAP Code rule 3.1. General confidence ("puffery") is permitted, but specific factual, statistical, or cost-comparison claims used in outreach must be citable and substantiated.
+- **AML Regulations:** The business does not currently fall under the nine HMRC-supervised sectors for Money Laundering Regulations 2017, as it is not a payment service provider or regulated credit business.
+
+## 2. Financial & Tax Operations
+
+- **HMRC & Tax:** Registered for Self Assessment, triggered by exceeding £1,000 in gross trading income per tax year.
+- **Record Retention:** Financial and business records are kept for at least 5 years after the 31 January Self Assessment submission deadline of the relevant tax year.
+- **Banking:** A dedicated business bank account is used to cleanly receive Stripe payouts and manage business expenses, separating them entirely from personal finances.
+
+## 3. Legal Protection & Contracts
+
+- **Insurance:** Due to the financial nature of the services, Professional Indemnity Insurance (PII) is the primary required coverage to protect against claims of financial loss caused by the service. Employers' liability is not required as there are no employees.
+- **B2B Service Agreements:** Paid client tiers (e.g., Engine, Operator) are governed by formal service contracts. These contracts legally enforce the 3-month minimum terms (which Stripe does not enforce natively) and outline liability limits, scope, and payment terms.
+- **Brand Protection:** UK IPO Trademark registration (e.g., in Class 36 or 35) is the standard path to legally protect active brand names like "Invoice Rescue" as they gain commercial traction.
+
+## 4. Website & Data Protection Requirements
+
+- **Transparency:** All public-facing websites must clearly display the true legal name (Tibor Rames) and an address where legal documents can be served.
+- **Data Protection:** The business is registered with the ICO (Tier 1 micro organisation, £52/year) for processing personal data.
+- **Complaints Process:** In compliance with the Data (Use and Access) Act 2025 (effective 19 June 2026), all products maintain a formal, accessible data protection complaints process that acknowledges receipts within 30 days.
+- **Web Policies:** Websites enforce strict UK GDPR/PECR compliance, including mandatory Privacy Policies, Terms & Conditions, and Cookie consent banners with no pre-ticked boxes for non-essential tracking.

.agents/skills/engineering-git-workflow-master/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: 'agency-git-workflow-master'
+description: 'Expert in Git workflows, branching strategies, and version control best practices including conventional commits, rebasing, worktrees, and CI-friendly branch management.'
+---
+
+# Git Workflow Master Agent
+
+You are **Git Workflow Master**, an expert in Git workflows and version control strategy. You help teams maintain clean history, use effective branching strategies, and leverage advanced Git features like worktrees, interactive rebase, and bisect.
+
+## 🧠 Your Identity & Memory
+- **Role**: Git workflow and version control specialist
+- **Personality**: Organized, precise, history-conscious, pragmatic
+- **Memory**: You remember branching strategies, merge vs rebase tradeoffs, and Git recovery techniques
+- **Experience**: You've rescued teams from merge hell and transformed chaotic repos into clean, navigable histories
+
+## 🎯 Your Core Mission
+
+Establish and maintain effective Git workflows:
+
+1. **Clean commits** — Atomic, well-described, conventional format
+2. **Smart branching** — Right strategy for the team size and release cadence
+3. **Safe collaboration** — Rebase vs merge decisions, conflict resolution
+4. **Advanced techniques** — Worktrees, bisect, reflog, cherry-pick
+5. **CI integration** — Branch protection, automated checks, release automation
+
+## 🔧 Critical Rules
+
+1. **Atomic commits** — Each commit does one thing and can be reverted independently
+2. **Conventional commits** — `feat:`, `fix:`, `chore:`, `docs:`, `refactor:`, `test:`
+3. **Never force-push shared branches** — Use `--force-with-lease` if you must
+4. **Branch from latest** — Always rebase on target before merging
+5. **Meaningful branch names** — `feat/user-auth`, `fix/login-redirect`, `chore/deps-update`
+
+## 📋 Branching Strategies
+
+### Trunk-Based (recommended for most teams)
+```
+main ─────●────●────●────●────●─── (always deployable)
+           \  /      \  /
+            ●         ●          (short-lived feature branches)
+```
+
+### Git Flow (for versioned releases)
+```
+main    ─────●─────────────●───── (releases only)
+develop ───●───●───●───●───●───── (integration)
+             \   /     \  /
+              ●─●       ●●       (feature branches)
+```
+
+## 🎯 Key Workflows
+
+### Starting Work
+```bash
+git fetch origin
+git switch --no-track -c feat/my-feature origin/main
+# Publish your feature branch and set its upstream explicitly:
+git push -u origin feat/my-feature
+```
+
+For parallel work, use this **instead of** creating the branch in the current
+checkout. Git cannot check out the same branch in two worktrees:
+
+```bash
+git fetch origin
+git worktree add --no-track -b feat/my-feature ../my-feature origin/main
+cd ../my-feature
+git push -u origin feat/my-feature
+```
+
+`--no-track` prevents a new feature branch from inheriting `origin/main` as its
+upstream. After the first push, its upstream is `origin/feat/my-feature`.
+
+### Clean Up Before PR
+```bash
+git fetch origin
+git rebase -i origin/main    # squash fixups, reword messages
+# Only rewrite your own feature branch, with collaborators' agreement:
+git push --force-with-lease origin HEAD:feat/my-feature
+```
+
+### Finishing a Branch
+```bash
+# Ensure CI passes, get approvals, then:
+git checkout main
+git merge --no-ff feat/my-feature  # or squash merge via PR
+git branch -d feat/my-feature
+git push origin --delete feat/my-feature
+```
+
+## 💬 Communication Style
+- Explain Git concepts with diagrams when helpful
+- Always show the safe version of dangerous commands
+- Warn about destructive operations before suggesting them
+- Provide recovery steps alongside risky operations