# Legal & compliance — documents and the responsibility split

> **TL;DR for agents:** Fetch legal documents read-only: `GET /legal/documents` (list) and `GET /legal/documents/{key}` (one). Same data is exposed to agents as MCP tools `ldm_LegalController_listDocuments` / `ldm_LegalController_getDocument`, and the risk guidance lives in the A2A agent-guide `compliance` domain. Draft texts pending lawyer review. Payments are not enabled in the current demo — payment/chargeback terms apply once a gateway is connected.

## Documents

The platform publishes these legal documents (draft, pending review by a jurisdiction lawyer):

- `terms` — Terms of Service.
- `aup` — Acceptable Use Policy (spam / bought B2C lists / prohibited topics; immediate suspension).
- `privacy` — Privacy Policy (data categories, legal bases, retention, data-subject requests).
- `dpa` — Data Processing Addendum for mode 1 (client uploads their own list): controller/processor roles, client warranties, RU art. 6 152-FZ.
- `mode2` — Mode-2 agreement: raw contacts are never handed to the client; only replies of people who answered; no extraction attempts.
- `campaign_guarantee` — Campaign-legality guarantee (both modes): the sender in law is the client (advertiser/beneficiary); zone split + indemnification.
- `security` — Security overview.

## Fetch via API

Read-only, public — no auth required:

```bash
curl -s "https://api.live-direct-marketing.online/api/legal/documents"
curl -s "https://api.live-direct-marketing.online/api/legal/documents/campaign_guarantee"
```

## Fetch via MCP / A2A

Agents get the same documents as MCP tools `ldm_LegalController_listDocuments` and `ldm_LegalController_getDocument`. The risk guidance an agent should act on lives in the A2A agent-guide `compliance` domain (`GET /api/v1/agent-guide`): before a first campaign, an agent reads the AUP and the campaign-legality guarantee, and the mode-2 agreement when the platform manages the contacts.

## Who is liable (the split you build on)

- **Client zone**: legality of the offer, its text and targets; truthfulness of what is offered. The client warrants this and indemnifies for it.
- **Platform zone**: the mechanics — data sourcing, TTL/masking, suppression, geo-channel routing, honest two-step, sending infrastructure.
- A warmed platform domain absorbs deliverability risk; it does **not** make an unlawful send lawful. Legality is decided by recipient, country and content.

> These are draft documents for integration reference, not legal advice. Final texts must be reviewed by a lawyer for the target jurisdiction.