Add data policy for synthetic-only project data

Author: xiangtinghe616-blip

DATA_POLICY.md

@@ -0,0 +1,56 @@
+# Data Policy
+
+This repository is a portfolio-grade cash reconciliation automation prototype. It is designed to use synthetic, sample, or anonymized demonstration data only.
+
+## No Real Financial Data
+
+Do not commit any real bank statements, internal ledger extracts, client records, account numbers, transaction histories, vendor payment files, ERP exports, or personally identifiable information to this repository.
+
+This includes, but is not limited to:
+
+- Real bank transaction files
+- Real accounting or ERP ledger exports
+- Client, vendor, employee, or counterparty records
+- Account numbers, routing numbers, payment references, or settlement details
+- Screenshots or reports containing confidential financial information
+- API keys, credentials, tokens, or local model secrets
+
+## Approved Data Types
+
+The following data types are allowed in this repository:
+
+- Synthetic data generated by project scripts
+- Small sample files created only for demonstration purposes
+- Anonymized mock data with no link back to real individuals, companies, accounts, or transactions
+- Documentation explaining the data model, assumptions, and limitations
+
+## Output Files
+
+Generated reconciliation outputs should generally be treated as local artifacts unless they are intentionally included as synthetic demo outputs.
+
+Future generated outputs should be kept out of version control unless they are small, synthetic, and useful for explaining the project.
+
+## Local Development
+
+Use local folders such as the following for private or experimental files:
+
+- `local_data/`
+- `private_data/`
+- `raw_data/`
+- `real_data/`
+- `sensitive_data/`
+- `client_data/`
+
+These folders are ignored by Git and should not be committed.
+
+## AI and LLM Usage
+
+Any AI or LLM assistant used in this project should support analyst review only. It should not be treated as the source of final reconciliation decisions.
+
+The deterministic reconciliation engine remains the control layer. AI-generated explanations, notes, or recommendations should be reviewed by a human analyst before being used in any operational context.
+
+## Public Repository Notice
+
+This repository is public. All committed data should be safe for public viewing.
+
+When in doubt, do not commit the file.