Draft a detailed privacy policy covering data types, jurisdiction, GDPR and compliance considerations, and clauses needing legal review. Use when creating a privacy policy, updating data protection documentation, or preparing for compliance.
A guided generator for drafting a comprehensive, plain-language privacy policy for a digital product or service, framed from the role of an experienced data privacy and compliance specialist. The resulting policy covers the types of data handled, the applicable jurisdiction, GDPR and other compliance considerations, and clearly marks clauses that require professional legal review. A prominent disclaimer stresses that the output is informational only, does not constitute legal advice, and should always be reviewed by a qualified data-privacy attorney before publication.
Input arguments include the product name and URL, company name and address, a privacy contact email, the types of information collected, and the applicable jurisdiction. The process runs through defined steps: optionally researching the product website to identify collected data and third-party integrations; clarifying data collection across direct, automatic, third-party, and special-category data; identifying applicable laws such as GDPR, CCPA/CPRA, other US state laws, and industry-specific regimes like HIPAA, GLBA, and FERPA; structuring the document; writing in plain language; flagging sections that need legal review with a marked notice; and providing context on why each section matters.
The template structure spans a preamble plus numbered sections covering information collected, how it is collected and used, the legal basis for processing (important for GDPR), data sharing and third parties, international data transfer, retention, user rights (access, deletion, correction, restriction, portability, opt-out, and lodging complaints), cookies and tracking, security, children's privacy, contact and rights, policy changes, and additional provisions such as no-sale-of-data statements and governing law. Throughout, jurisdiction-specific and sensitive clauses are tagged as requiring legal review, and the content guidelines emphasize being specific rather than vague.
No. It states clearly that the output is for informational purposes only and is not legal advice, and that a qualified data-privacy attorney should review the final policy before publication.
It takes the product name and optional URL, the company legal name and address, a privacy contact email, the types of information collected, and the applicable jurisdiction such as the United States, EU (GDPR), or California (CCPA).
It accounts for GDPR, CCPA/CPRA, other emerging US state laws, and industry-specific laws including HIPAA for health, GLBA for finance, and FERPA for education, and it flags whether the product serves international users.
It marks sections with a LEGAL REVIEW REQUIRED notice wherever jurisdiction-specific language, specific data rights, or particular legal clauses are needed, such as legal basis for processing, international transfers, retention, and children's privacy.
It follows a template with a preamble and numbered sections covering information collected, collection methods, uses, legal basis, data sharing, international transfer, retention, user rights, cookies, security, children's privacy, contact, policy changes, and additional provisions.
Quick Setup:
.claude/skills/Repository
phuryn/pm-skills