fix(web): align privacy and terms with the DPA-owns-the-register split

Privacy: "Sub-processors and Outbound Data Flows" becomes "External
Services". It still names who receives data, which is a controller's own
duty, but drops the Art. 28 vocabulary and the promise to announce new
sub-processors - that commitment lives in the data processing agreement.
Points at the renamed docs page and notes the DPA is available on
request.

Terms: the MSP clause now says a managing organization is responsible for
having the necessary data protection agreements with its customers,
instead of classifying it as a processor or sub-processor.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/Web/autopilot-monitor-web/app/privacy/page.tsx

@@ -2,7 +2,7 @@ import { PublicPageHeader } from "../../components/PublicPageHeader";
 
 const LAST_UPDATED = "21 July 2026";
 const DOCS_SECURITY_FAQ = "https://docs.autopilotmonitor.com/trust/security-faq";
-const DOCS_SUBPROCESSORS = "https://docs.autopilotmonitor.com/trust/subprocessors";
+const DOCS_DATA_FLOWS = "https://docs.autopilotmonitor.com/trust/data-flows";
 
 function DocsLink({ href, children }: { href: string; children: React.ReactNode }) {
   return (
@@ -119,19 +119,20 @@ export default function PrivacyPage() {
             isolation model is in the <DocsLink href={DOCS_SECURITY_FAQ}>Security &amp; Privacy FAQ</DocsLink>.
           </p>
 
-          <h2 className="text-xl font-semibold text-gray-900 mt-6">Sub-processors and Outbound Data Flows</h2>
+          <h2 className="text-xl font-semibold text-gray-900 mt-6">External Services</h2>
           <p className="text-gray-700">
-            <strong>Microsoft Azure is the only sub-processor that stores your data.</strong> Resend is used solely to
-            deliver the onboarding approval email when a tenant is activated — it receives an administrator&apos;s email
-            address and the tenant domain, never enrollment telemetry. Vulnerability reference data is pulled inbound from
-            NVD, the CISA KEV catalog, and MSRC; no customer data is sent to them.
+            <strong>Microsoft Azure is the only place your data is stored.</strong> Resend delivers the onboarding
+            approval email when a tenant is activated — it receives an administrator&apos;s email address and the tenant
+            domain, never enrollment telemetry. Vulnerability reference data is read inbound from NVD, the CISA KEV
+            catalog, and MSRC; nothing about your environment is sent to them.
           </p>
           <p className="text-gray-700">
-            Some data flows exist only because you configure them: your own Azure storage account for diagnostics,
+            Further connections exist only because you configure them: your own Azure storage account for diagnostics,
             notification channels such as Teams, Slack, or a generic webhook, and your own AI assistant if a user connects
-            one through the MCP integration. The platform itself makes no calls to any AI or LLM provider. The complete
-            list is published as <DocsLink href={DOCS_SUBPROCESSORS}>Sub-processors</DocsLink>, and new sub-processors are
-            announced there before they are introduced.
+            one through the MCP integration. The platform itself makes no calls to any AI or LLM provider.{" "}
+            <DocsLink href={DOCS_DATA_FLOWS}>Data Flows &amp; External Services</DocsLink> maps every outbound connection
+            and what it carries. The data processing agreement, available on request, is the authoritative document for
+            the parties engaged and the terms of their engagement.
           </p>
 
           <h2 className="text-xl font-semibold text-gray-900 mt-6">Diagnostics Uploads</h2>

src/Web/autopilot-monitor-web/app/terms/page.tsx

@@ -85,7 +85,7 @@ export default function TermsPage() {
             <li>Delegated access is <strong>read-only</strong> and limited to exactly the tenants in scope. Configuration secrets are redacted.</li>
             <li>A grant is either assigned by platform operators or delegated by the customer&apos;s own tenant admin; customer-initiated delegations require approval before they take effect.</li>
             <li>Every grant, revocation, and disablement is recorded in the <strong>managed customer tenant&apos;s</strong> audit log, so a customer can always determine who holds access to their data.</li>
-            <li>A managing organization acts as a processor or sub-processor of its customers and is responsible for having the necessary agreements in place with them.</li>
+            <li>A managing organization is responsible for having the necessary data protection agreements in place with the customers it manages.</li>
             <li>Access can be revoked at any time by the customer or by platform operators and takes effect within seconds.</li>
           </ul>
         </div>
@@ -127,7 +127,7 @@ export default function TermsPage() {
         <div className="bg-white rounded-lg shadow p-6 space-y-4">
           <h2 className="text-xl font-semibold text-gray-900">Security and Transparency</h2>
           <p className="text-gray-700">
-            The security architecture, data residency, sub-processors, retention and deletion behaviour, and an explicit
+            The security architecture, data residency, external services, retention and deletion behaviour, and an explicit
             statement of what the service does <em>not</em> do are published in the{" "}
             <a href={DOCS_SECURITY_FAQ} target="_blank" rel="noopener noreferrer" className="text-indigo-600 hover:text-indigo-800 underline">Security &amp; Privacy FAQ</a>.
             A signed data processing agreement is part of the Enterprise plan.