Privacy Policy Drafter Skill
A privacy policy should tell users plainly what you collect, why, and what control they have — not hide it in legalese. This skill drafts a structured, regulation-aware policy from how the product actually handles data. Not legal advice — a qualified lawyer should review before you publish, and obligations vary by jurisdiction.
Working from a brief
Given a product description, draft the full policy anyway, inferring typical data flows and marking each inference (confirm — reflects assumed practice). Never leave "[company name]"-style gaps un-flagged, and never state a practice the founder didn't confirm as fact without labelling it an assumption.
Required Inputs
Ask for (if not already provided):
- Product / company and what it does
- Data collected (account info, usage/analytics, payment, location, cookies, etc.)
- Why it's collected and who it's shared with (processors, analytics, payment, ads)
- Jurisdictions / regulations in scope (GDPR, UK GDPR, CCPA/CPRA, others)
- Contact for privacy requests and whether there's a DPO
Output Format
A ready-to-review policy with these sections:
- Who we are & scope — controller identity, what the policy covers, effective date
- Information we collect — categorised (provided / automatic / from third parties), each with examples
- How and why we use it — purposes, with legal bases where GDPR applies (consent, contract, legitimate interest…)
- Cookies & tracking — types used and how to control them (link to a cookie notice if separate)
- Sharing & disclosure — processors and third parties, why, and cross-border transfer note
- Retention — how long, and the criteria for deciding
- Your rights — access, deletion, correction, portability, objection, opt-out of sale/sharing; how to exercise them
- Security — high-level measures (no false guarantees)
- Children — whether the service targets/permits minors
- Changes & contact — how updates are notified; the privacy contact / DPO
End with: ⚠️ Review checklist — the specific items counsel must confirm (legal bases, retention periods, transfer mechanism, sub-processor list).
Quality Checks
Anti-Patterns
- Generic boilerplate that doesn't match what the product does
- Claiming GDPR/CCPA compliance as a fact rather than reflecting practices
- Vague "we may share with third parties" with no categories or purpose
- Overpromising security ("your data is 100% safe")
1---2name: privacy-policy-drafter3description: Draft a clear, plain-language privacy policy tailored to what a product actually collects and does with data. Use when asked to write a privacy policy, draft a data-protection notice, or create a GDPR/CCPA-aware privacy statement. Produces a structured policy covering data collected, purposes, legal bases, sharing, retention, user rights, and contact — written to be readable, not boilerplate. Not legal advice; have counsel review before publishing.4---5
6# Privacy Policy Drafter Skill
7
8A privacy policy should tell users plainly what you collect, why, and what control they have — not hide it in legalese. This skill drafts a structured, regulation-aware policy from how the product actually handles data. **Not legal advice — a qualified lawyer should review before you publish, and obligations vary by jurisdiction.**
9
10## Working from a brief
11
12Given a product description, **draft the full policy anyway**, inferring typical data flows and marking each inference *(confirm — reflects assumed practice)*. Never leave "[company name]"-style gaps un-flagged, and never state a practice the founder didn't confirm as fact without labelling it an assumption.
13
14## Required Inputs
15
16Ask for (if not already provided):
17- **Product / company** and what it does
18- **Data collected** (account info, usage/analytics, payment, location, cookies, etc.)
19- **Why** it's collected and **who it's shared with** (processors, analytics, payment, ads)
20- **Jurisdictions / regulations** in scope (GDPR, UK GDPR, CCPA/CPRA, others)
21- **Contact** for privacy requests and whether there's a DPO
22
23## Output Format
24
25A ready-to-review policy with these sections:
261. **Who we are & scope** — controller identity, what the policy covers, effective date
272. **Information we collect** — categorised (provided / automatic / from third parties), each with examples
283. **How and why we use it** — purposes, with **legal bases** where GDPR applies (consent, contract, legitimate interest…)
294. **Cookies & tracking** — types used and how to control them (link to a cookie notice if separate)
305. **Sharing & disclosure** — processors and third parties, why, and cross-border transfer note
316. **Retention** — how long, and the criteria for deciding
327. **Your rights** — access, deletion, correction, portability, objection, opt-out of sale/sharing; how to exercise them
338. **Security** — high-level measures (no false guarantees)
349. **Children** — whether the service targets/permits minors
3510. **Changes & contact** — how updates are notified; the privacy contact / DPO
36
37End with: **⚠️ Review checklist** — the specific items counsel must confirm (legal bases, retention periods, transfer mechanism, sub-processor list).
38
39## Quality Checks
40
41- [ ] Each data category ties to a stated purpose (and legal basis where GDPR applies)
42- [ ] User rights and how to exercise them are explicit
43- [ ] Retention is addressed, not skipped
44- [ ] Plain language — readable by a non-lawyer
45- [ ] Assumptions flagged; "not legal advice — counsel must review" retained
46
47## Anti-Patterns
48
49- Generic boilerplate that doesn't match what the product does
50- Claiming GDPR/CCPA compliance as a fact rather than reflecting practices
51- Vague "we may share with third parties" with no categories or purpose
52- Overpromising security ("your data is 100% safe")
Mohit Aggarwal