FerroxLabs Policy Stack
Estimated time: 45-60 minutes
This workflow builds the full legal policy stack a product needs before launch: Terms of Service, Privacy Policy, Refund Policy and EULA, and Cookie / Acceptable Use policies. Every policy is aligned to the product type, the jurisdictions where users and customers are, the data collected, and the compliance regime (GDPR, CCPA, HIPAA, and similar).
The outputs are drafts. Counsel review is required before publication.
When to Use
- User wants the complete set of user-facing legal policies for a product
- User needs policies aligned to product type, jurisdictions, and compliance regime
- User is preparing a product for launch and needs ToS, Privacy, Refund, EULA, Cookie, AUP
- Do NOT use for a single policy in isolation when no stack is needed
- Do NOT use as a replacement for licensed legal advice
Steps
Step 1: Intake the Product Brief (uses: legal-tos)
Ask the user for the product type (SaaS, e-commerce, marketplace, digital download, service, or mobile app), the jurisdictions where users and customers are, the data collected, and any compliance requirements (GDPR, CCPA, HIPAA, etc.). Do not proceed until you have the product type, jurisdictions, and data-collection summary.
- Input: product type, jurisdictions, data collected, compliance requirements
- Output: captured product brief
- Key focus: capture jurisdictions and data collection because they drive every policy
Step 2: Determine the Required Policies (uses: legal-tos)
From the brief, infer which policies this product actually needs given its type and jurisdictions (e.g. GDPR triggers a data-processing and cookie-consent posture, a marketplace needs different terms than a digital download). State the required policy set, explain the reasoning, and let the user add or remove policies.
- Input: product brief from Step 1
- Output: confirmed list of required policies for this product and jurisdictions
- Key focus: scope the stack to what the product and its jurisdictions require
Step 3: Draft the Terms of Service (uses: legal-tos)
Draft the Terms of Service for this product, aligned to the product type and the required-policy set. Cover acceptable use, account terms, liability limits, dispute resolution and governing law, and termination. Surface the draft to the user.
- Input: product brief from Step 1, required policies from Step 2
- Output: Terms of Service draft
- Key focus: terms matched to the product archetype and governing law
Step 4: Draft the Privacy Policy (uses: legal-privacy)
Draft the Privacy Policy aligned to the data collected and the compliance regime. Cover what data is collected, why, legal basis, sharing and processors, retention, user rights (access, deletion, portability), and jurisdiction-specific disclosures (GDPR, CCPA). Surface the draft to the user.
- Input: product brief from Step 1, required policies from Step 2
- Output: Privacy Policy draft with compliance-specific disclosures
- Key focus: data practices and user rights mapped to the compliance regime
Step 5: Review ToS and Privacy with the User (uses: legal-tos)
Present the ToS and Privacy Policy together and ask whether to proceed to the remaining policies or refine these two. If the user wants changes, gather feedback, re-run the ToS draft incorporating it, and re-present (loop up to two times). When approved, proceed.
- Input: ToS from Step 3, Privacy from Step 4, user feedback
- Output: approved ToS and Privacy Policy
- Key focus: lock the two highest-stakes policies before drafting the rest
Step 6: Draft the Refund Policy and EULA (uses: legal-refund-policy)
Draft the Refund Policy and EULA aligned to the product type and required-policy set. Cover refund eligibility and windows, chargeback posture, license grant and restrictions, and warranty disclaimers appropriate to the product. Surface the draft to the user.
- Input: product brief from Step 1, required policies from Step 2
- Output: Refund Policy and EULA draft
- Key focus: refund windows and license terms matched to the product type
Step 7: Draft Cookie and Acceptable Use Policies (uses: legal-tos)
Draft the Cookie Policy and Acceptable Use Policy aligned to the product and jurisdictions. Cover cookie categories and consent (GDPR/ePrivacy where relevant), tracking disclosures, and prohibited-use terms. Surface the draft to the user.
- Input: product brief from Step 1, required policies from Step 2
- Output: Cookie Policy and Acceptable Use Policy draft
- Key focus: cookie consent posture matched to the jurisdictions
Step 8: Review Remaining and Assemble the Stack (uses: legal-tos)
Present the Refund, EULA, Cookie, and Acceptable Use drafts and ask whether to assemble the stack or refine them. If the user wants changes, gather feedback, re-run the cookie / acceptable-use step incorporating it, and re-present (loop up to two times). When approved, assemble the full Policy Stack: product brief, required policies, ToS, Privacy, Refund + EULA, and Cookie / Acceptable Use, marked DRAFTS requiring counsel review before publication.
- Input: remaining drafts from Steps 6-7, all prior outputs, user feedback
- Output: assembled Policy Stack marked DRAFTS pending counsel review
- Key focus: deliver one assembled stack with the counsel-review gate clearly stated