Skip to content
cccskills
FreePublished on GitHub

privacy-policy-stephane-boghossian

A zero-hallucination privacy-policy generator that takes anyone — non-lawyer founder to lawyer — from a guided intake to a publishable, jurisdiction-aware privacy policy. Jurisdiction-first: it detects which laws apply from where your users are, then drafts only the required clauses — GDPR/EU + UK, US (CCPA/CPRA, ~20 state laws, COPPA, sector overlays), and global/MENA (LGPD, Quebec Law 25, India DPDP, China PIPL, UAE/DIFC, Saudi PDPL), plus app-store, cookies, and AI/EU AI Act disclosures. Its rule: state only what you confirm; never invent a statute, citation, fine, or date — every claim is source-cited and QA-gated. Not legal advice.

The English summary is being prepared. Showing the original description.

Run score Not tested

See how to install

Files included (11)

  • SKILL.md8.6 KB
  • assets/template-privacy-policy.md6.6 KB
  • README.md652 B
  • references/edge-cases-failure-modes-qa.md9.2 KB
  • references/intake-questionnaire.md11.5 KB
  • references/jurisdictions-eu-uk.md15.2 KB
  • references/jurisdictions-global-mena.md11.2 KB
  • references/jurisdictions-us.md12.3 KB
  • references/platform-cookies-ai.md13.0 KB
  • references/sector-and-special-products.md10.0 KB
  • references/structure-clauses-and-craft.md10.9 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Privacy Policy Generator

Generate a bulletproof, jurisdiction-aware privacy policy for any business or product, usable by a non-lawyer founder and trusted by a lawyer. The whole point of this skill is correctness without hallucination: a fabricated statutory citation or a clause that doesn't match the user's real practices is worse than no policy at all.

⚖️ The prime directive (read this first, never break it)

  1. State ONLY what the user confirms they actually do. A privacy policy is a set of enforceable representations (FTC §5; see the OkCupid/Match 2026 and Gateway Learning cases in the reference pack). Saying more than is true is the #1 legal failure. Never default-in a flattering or risk-adding clause.
  2. Never invent law. Do not generate a statute/section number, a fine amount, an effective date, or a "the law requires X" claim unless it traces to the bundled reference pack (references/) or a live legal-data-hunter lookup. If you're unsure of a specific, name the law in plain terms ("California's CCPA/CPRA," "the EU GDPR") and describe the right functionally — or omit it. Uncertain → omit or mark [VERIFY], never guess.
  3. Confirm-don't-assume. A clause renders only if a confirming intake answer exists. Smart defaults are allowed ONLY for protective/negative clauses (no children, no selling, standard security framing, today's date, strictest-common-denominator). Anything unanswered → a visible [GAP — confirm before publishing] marker, never a guess.
  4. This is not legal advice. Always include the disclaimer; INSIST on a lawyer for high-risk cases (§ workflow step 6).

Workflow

Step 1 — Pick the mode

Ask (or infer): QUICK (non-lawyer: only the must-ask questions, batched, smart defaults pre-filled, ~10 answers) or EXPERT (lawyer/thorough: full questions, clause-level control, citations, full reconciliation). → Read references/intake-questionnaire.md for both flows.

Step 2 — Compute the applicable-law set FIRST (jurisdiction-first)

Ask intake Groups 0–2 (product type → business identity → where users are located). Location is the law-selector. If "international / unknown," apply the strictest-common-denominator (GDPR + CCPA + COPPA). This ordering is what prevents generic boilerplate.

Step 3 — Gather practices (only the questions the selected laws require)

Work Groups 3–17 of references/intake-questionnaire.md. Batch questions; offer the smart default so the user can accept with "yes." Flag every HARD-risk answer (children, health, biometric, AI-training, data broker, fintech) as you go.

Step 4 — Ground the legal content (zero-hallucination layer)

For each jurisdiction/topic in scope, pull the requirements from the matching reference file — never from memory:

  • references/jurisdictions-eu-uk.md — GDPR Art 13/14 checklist, lawful bases, rights, transfers, cookies, UK/DUAA, children ages, enforcement.
  • references/jurisdictions-us.md — CCPA/CPRA contents + the two mandatory links + Notice at Collection, ~20 state laws, COPPA, GPC, ADMT, sector overlays, FTC §5.
  • references/jurisdictions-global-mena.md — Brazil, Canada/Quebec, Australia, India, China, Japan/Korea/SA/Switzerland + UAE/DIFC/ADGM/Saudi/Bahrain/Qatar/Egypt/Turkey + cross-jurisdiction synthesis.
  • references/platform-cookies-ai.md — when a policy is contractually forced; Apple/Google app-store rules; per-tool disclosures (GA, AdSense, Meta Pixel, Stripe, PayPal, Mailchimp, Cloudflare, session-recording, A/B); cookies/CMP/TCF/GPC/Consent-Mode; AI/LLM + EU AI Act Art 50 + ADM.
  • references/sector-and-special-products.md — HIPAA/HBNR/MHMDA, GLBA, FERPA/SOPIPA, BIPA/Texas CUBI, Chrome extensions, IoT SB-327, GDPR Art 32/33/34 security/breach + US breach laws.
  • Optional live grounding: if the legal-data-hunter MCP is connected (HAQQ's 230-jurisdiction tool), use it to verify or fetch a jurisdiction-specific requirement with an inline citation — especially for a jurisdiction not fully covered in the pack, or for the latest amendment. If it's not connected, rely on the pack and clearly mark anything you couldn't verify.

Step 5 — Assemble the policy

Use the section order + modular clause library in references/structure-clauses-and-craft.md and the fill-in backbone in assets/template-privacy-policy.md. Enforce the writing craft (≈8th-grade reading level unless EXPERT/formal, ~20 words/sentence, active voice, tables for data×purpose×basis×retention, layered TL;DR). Use the DO phrasing; never the banned phrasing. Render jurisdiction-specific sections (e.g., "Your California rights" with the Do-Not-Sell-or-Share + Limit-Use-of-Sensitive-PI links) only for selected laws.

Step 6 — Self-QA gate (do NOT skip)

Run the 12-point checklist in references/edge-cases-failure-modes-qa.md §3 on your own draft. In particular:

  • Citation firewall: scan for any statute number / fine amount / effective date; each must trace to the pack or a live lookup, else remove or genericize. Zero invented citations. If cite-guard is available, run it here.
  • Practice match: every clause traces to a confirmed answer; surface any remaining [GAP].
  • Mandatory links / disclaimer / lawyer-flag present as triggered. Do not present the policy as "ready" if any check fails — present it with the failures surfaced.

Step 7 — Deliver the package

Output: the policy (in the requested language(s), RTL-aware for Arabic per structure-clauses-and-craft.md §7) · a dated version header + "changes" clause · the conditional-links status · the practices-confirmed vs clauses-generated reconciliation (the key anti-deception artifact) · the [GAP] list · the risk-tier / "get a lawyer" banner. Default output format: Markdown (offer HTML on request). Recommend human review of any machine translation.

Hard rules (guardrails)

  • Never claim the user honors GPC / DNT, encrypts data, has a DPO, or retains data for N days unless the user confirmed it — these are enforceable and false ones are deceptive.
  • Never fold employee/HR data into a consumer policy — recommend a separate notice.
  • Never present this as legal advice. INSIST on a lawyer (HARD banner) for: under-13/children, health/PHI, biometric, fintech/payments beyond a standard processor, selling data / data broker, AI training on user data, large-scale/systematic monitoring, precise geolocation at scale, or simultaneous EU+UK+US+other coverage.
  • Keep the policy in sync with reality: never output "please check this page periodically for changes" as the only update mechanism — it is "insufficient and unfair" (WP260). Use a dated change log + active material-change notice.

Companion documents

A privacy policy is necessary but not sufficient. Where relevant, tell the user they may also need: a Cookie Policy + consent banner, a DPA (Art 28) for processors, a RoPA (Art 30), a HIPAA Notice of Privacy Practices (health), a GLBA notice (finance), and a separate employee privacy notice. This skill drafts the privacy policy (and an embedded cookie section / standalone cookie policy on request); it flags the others rather than silently omitting them.


Built from primary-source research (regulator texts, statutes, and official platform terms) verified 2026-06. Sources are cited inside each references/ file. AGPL-3.0. Informational template — not legal advice.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Public-safe preliminary screen for challenges to the impartiality of an AI evaluator, LLM-as-a-judge, decision-support agent, or adjudicative system based on prior outputs, suspected bias, unstable reasoning, or self-reinforcing memory. Use when asked whether an AI should be recused, disqualified, replaced, audited, or escalated. Does not decide real cases or claim that human judicial-recusal doctrine automatically applies.

The English summary is being prepared. Showing the original description.

lawve-ai/awesome-legal-skills896Updated Oct 20, 2026

Creates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allowed to do, who delegated authority to it, what actions are permitted or prohibited, when human approval is required, what evidence must be preserved, and how the agent can be suspended, revoked, or escalated.

The English summary is being prepared. Showing the original description.

lawve-ai/awesome-legal-skills896Updated Oct 20, 2026

EU AI Act Knowledge Engine — authoritative regulatory Q&A grounded in 70 official EU source documents (including the 2026 Commission draft guidelines on Art. 6 high-risk classification — general principles, Annex I, Annex III). Answers any question about the AI Act with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, incident templates, and sector-specific guidance. This skill should be used when the user asks about the "EU AI Act", "AI Act regulation", "Regulation 2024/1689", "KI-Verordnung", asks to "explain an AI Act article", "what does Article X say", "AI Act requirements", "AI Act penalties", "AI Act timeline", "GPAI obligations", "high-risk AI", "prohibited AI practices", "AI Act and GDPR", "fundamental rights impact assessment", "AI Act standards", "AI Act national implementation", "AI literacy", "serious incident reporting", "Digital Omnibus", "AI regulatory sandbox", or any question about EU artificial intelligence regulation. Also triggers on German terms: "KI-Gesetz", "KI-Verordnung", "Hochrisiko-KI", "KI-Kompetenz", "Grundrechte-Folgenabschaetzung", "GPAI-Verhaltenskodex". For assessment workflows that produce a classification decision rather than a knowledge answer, offer to run a structured risk-tier classification in-session.

The English summary is being prepared. Showing the original description.

lawve-ai/awesome-legal-skills896Updated Oct 20, 2026

This skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output was verified, and what was ultimately relied upon. It documents the workflow for supervision and later review without ruling on privilege or disclosure, so the record stays accurate rather than self-serving.

The English summary is being prepared. Showing the original description.

lawve-ai/awesome-legal-skills896Updated Oct 20, 2026

Use this skill when the user wants an AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk review of an internal AI use case, an AI product feature, an LLM workflow, or a third-party AI vendor. The skill asks intake and clarifying questions first when facts or evidence are missing, identifies required documentation and missing evidence, maps the use case to AI governance frameworks and applicable legal domains, and produces a preliminary or final governance review with scorecards, findings, owners, remediation actions, and follow-up questions.

The English summary is being prepared. Showing the original description.

lawve-ai/awesome-legal-skills896Updated Oct 20, 2026

Turn an interpretive-ambiguity audit of a legal text — contract, statute, regulation, or judicial opinion — into a polished deliverable. Produces a multi-page website (default), a single-page interactive site, a Microsoft Word document, a PowerPoint deck, or a LaTeX/PDF. Use whenever a user has a stress-test result, ambiguity audit, or "where will this be litigated" scenarios and wants to publish, present, or share them. Triggers on "publish the audit," "make a report from this," "turn this into a website / deck / brief / Word doc," "make a Netlify site," "build slides of these ambiguities," "render the scenarios," "package this stress test," "produce a LaTeX version," and similar. Pairs with the ambiguity-stress-test skill (the underlying analysis) but works on any structured or semi-structured ambiguity analysis. Visual design is opinionated but the user can override colors, fonts, and brand label. Most formats need Python and a writable filesystem; single-file HTML works where the host has neither.

The English summary is being prepared. Showing the original description.

lawve-ai/awesome-legal-skills896Updated Oct 20, 2026

See all skills by lawve-ai

Report a problem with this skill