Add terms of service and data privacy policy

[nonprofittechy]

@samglover @colarusso this might require input from GC, I guess? We could try just re-using our existing privacy policy that the GC already approved.