Privacy Policy

Privacy Policy

Draft a GDPR/CCPA-compliant privacy policy for "$ARGUMENTS". Generate a comprehensive privacy policy that satisfies major data protection regulations.

Note: AI-generated legal content does not constitute legal advice. Consult a qualified attorney.

Prerequisites

Check that .metapowers/legal/$ARGUMENTS/00-assess.md exists. If it does not exist, stop and tell the user:

"Run an Assess skill first (e.g. /legal:risk-assessment $ARGUMENTS) to generate the prerequisite assessment artifact."

If the user passes --skip-checks, bypass this check and log the skip to .metapowers/legal/$ARGUMENTS/skip-log.md with a timestamp and the reason "Prerequisite check skipped for privacy-policy".

Process

1. Read inputs:

   • Read .metapowers/legal/$ARGUMENTS/00-assess.md for risk, jurisdiction, and data practice context

2. Identify data practices:

   • What personal data is collected (categories and specific examples)
   • How data is collected (directly from users, automatically, from third parties)
   • Purposes for processing each data category
   • Lawful basis for processing under GDPR (consent, contract, legitimate interest, legal obligation, vital interest, public task)
   • Data sharing relationships with third parties
   • Data retention timelines per category
   • International data transfer mechanisms

3. Draft GDPR Article 13/14 compliant sections:

   • Data Controller Identity and Contact — legal name, address, contact details, EU representative (if applicable)
   • Data Collected — categories with specific examples (identifiers, contact info, financial data, usage data, device data, location data, etc.)
   • Purposes and Lawful Basis — per-category breakdown of why data is processed and the legal basis for each
   • Data Sharing with Third Parties — who receives data, why, and in what capacity (processor vs. controller)
   • Data Retention Periods — per-category retention periods with rationale
   • User Rights — access, rectification, erasure, restriction, portability, objection, and how to exercise each right
   • Automated Decision-Making and Profiling — whether used, logic involved, significance and consequences, right to opt out
   • Cookie Usage — summary with link to full cookie policy
   • International Data Transfers — transfer mechanisms (SCCs, adequacy decisions, BCRs) and safeguards
   • Children's Privacy — age restrictions, COPPA compliance (if applicable), parental consent mechanisms
   • Policy Updates Procedure — how changes are communicated, effective date handling
   • DPO / Contact Information — Data Protection Officer details (if appointed), supervisory authority contact, complaint procedures

4. Add CCPA-specific provisions (if applicable):

   • Categories of personal information collected (CCPA categories)
   • Right to know, right to delete, right to opt out of sale/sharing
   • "Do Not Sell or Share My Personal Information" link requirement
   • Financial incentive disclosures (if any)
   • Authorized agent procedures
   • Non-discrimination statement

5. Write the artifact to .metapowers/legal/$ARGUMENTS/01-draft.md with frontmatter:

   ---
   description: Privacy policy draft for $ARGUMENTS
   ---
   

Output

The privacy policy draft written to .metapowers/legal/$ARGUMENTS/01-draft.md. Present a summary to the user highlighting:

• Regulations addressed (GDPR, CCPA, others)
• Number of data categories documented
• Third-party data sharing relationships identified
• User rights enumerated
• Areas flagged for attorney review (especially lawful basis determinations and transfer mechanisms)