# Legal Pages > Scaffolds production-ready legal page templates for a website: Privacy Policy, Terms of Service, Cookie Policy, Cookie Consent banner, Refund Policy, Contact / Imprint. Templates are clearly marked as a starting point — the user must customize and have a lawyer review before going live. - Skill: `viknesh20-20/legal-pages` (Agent Skill) - Install (CLI): `npx skillmds@latest add viknesh20-20/legal-pages` - Raw SKILL.md: https://api.skillmd.com/api/skills/viknesh20-20/legal-pages/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: viknesh20-20 (https://skillmd.com/u/viknesh20-20) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/viknesh20-20/legal-pages --- # /legal-pages Scaffolds the legal pages a public website needs. Output is a **starting template** — clearly marked at the top of each file: "This is a template. Have a lawyer review before going live." ## Why this exists Almost every public website needs at least: a Privacy Policy, Terms of Service, and (for EU/UK visitors or any tracking) a Cookie Policy plus consent banner. Without these: - You expose yourself to GDPR / CCPA / PIPEDA / LGPD fines. - You can't legally collect any user data, including IP/cookies/analytics. - App stores reject mobile apps. - Payment processors reject your account. - Search engines (and your users) treat you as low-trust. This skill produces baseline templates so you can launch — but they're **templates, not legal advice**. You always need a lawyer to review for your jurisdiction and business model. ## When to use - Starting a new website project. - An existing site has no legal pages. - Adding a new feature that changes data handling (analytics, payments, user accounts, cookies). - After a `/web-launch-check` flagged missing legal pages. ## What it produces ### 1. Privacy Policy (`/privacy` or `/privacy-policy`) Sections every privacy policy needs: - **Who we are** — legal entity name, address, contact email. - **What data we collect** — categorized: - Information you give us (name, email, payment, content uploaded). - Information we collect automatically (IP, browser, device, cookies, usage). - Information from third parties (OAuth providers, analytics, advertisers). - **Why we collect it** — legitimate interest, contract performance, consent, legal obligation. Be specific. - **Who we share it with** — sub-processors (hosting, analytics, email, payment, support). List by category if not by name. - **How long we keep it** — retention periods. - **Your rights** — access, correction, deletion, portability, objection, withdraw consent. - **How to exercise rights** — email address or DSAR endpoint, response within 30 days. - **International transfers** — if servers are in another country, name the safeguards (SCCs, adequacy). - **Children's privacy** — if not for under 13/16, say so explicitly. - **Cookie policy** — link to the dedicated page or include a section. - **Changes** — how you'll notify users of changes. - **Contact** — DPO if you have one, or general contact. - **Effective date** — last updated date at the top. ### 2. Terms of Service (`/terms` or `/terms-of-service`) - **Acceptance** — by using the site, you accept these terms. - **Eligibility** — minimum age, geographic restrictions. - **Account** — registration, security, termination. - **Acceptable use** — what users may and may not do (no harassment, no scraping, no IP infringement). - **User content** — who owns it, what license you take, content moderation. - **Payments** — pricing, billing, refunds, taxes. - **Intellectual property** — your IP, trademarks, copyright. - **Disclaimers** — service "as is," limitations of liability, indemnification. - **Termination** — when you can suspend or terminate accounts. - **Governing law** — which jurisdiction's law applies, dispute resolution (arbitration clauses are tricky — consult a lawyer). - **Changes** — how you'll notify users. - **Contact** — for legal notices. ### 3. Cookie Policy (`/cookies`) and consent banner - **What cookies we use** — categorized: - Strictly necessary (always on, no consent needed). - Functional (preferences, language). - Analytics (Plausible/GA/etc.). - Marketing (Meta Pixel, Google Ads, etc.). - **Per-cookie table** — name, purpose, expiry, first-party / third-party. - **How to manage** — link to settings UI, browser settings. Banner pattern: ``` ┌─────────────────────────────────────────────────────────────┐ │ We use cookies to make this site work. │ │ Optional: analytics + marketing cookies (only with consent).│ │ │ │ [Accept all] [Reject all] [Customize] │ └─────────────────────────────────────────────────────────────┘ ``` Rules the banner must follow: - "Reject all" must be as easy as "Accept all" (no hidden behind clicks). - No tracking/analytics scripts load until consent is given. - Choice persisted (cookie or localStorage) so the user isn't asked again. - Settings page lets the user change their mind. ### 4. Refund / Cancellation Policy (`/refunds`) For any e-commerce or paid product: - **Refund window** — typical 14–30 days, longer is friendlier. - **What's refundable** — and what's not (digital goods consumed? services rendered?). - **How to request** — link or email. - **Processing time** — when the user gets their money back. - **Cancellation** — for subscriptions, how to cancel and when it takes effect. EU-specific: 14-day cooling-off period for distance contracts (Consumer Rights Directive). ### 5. Contact / Imprint (`/contact` or `/imprint`) - **Legal entity name** (e.g., "Acme Inc.", "Acme GmbH"). - **Registered address.** - **Email** — at least one human-monitored. - **Phone** — required in some jurisdictions. - **Tax / company registration number** — required in EU (Impressum), UK (Companies House number). - **VAT number** — if EU/UK. - **Responsible person** — director / managing partner — required in some EU countries. ### 6. (Recommended) Accessibility Statement (`/accessibility`) - WCAG conformance level (AA target). - Known issues being worked on. - Contact for accessibility complaints. Required by the European Accessibility Act for many sites in the EU. Strongly encouraged elsewhere. ### 7. (Recommended) Security disclosure (`/.well-known/security.txt`) ``` Contact: mailto:security@example.com Expires: 2027-01-01T00:00:00.000Z Preferred-Languages: en Canonical: https://example.com/.well-known/security.txt Acknowledgments: https://example.com/security-thanks ``` ## Operating method 1. **Detect the framework** — Next.js, Astro, plain HTML, etc. 2. **Detect what exists** — don't overwrite an existing privacy policy. 3. **Ask the user** for the minimum information needed: - Legal entity name - Contact email - Registered address (or "remote / TBD") - Jurisdiction (US, EU, UK, other) - What data is collected (none / analytics-only / accounts / payments / content) - Age requirement (none / 13+ / 16+ / 18+) 4. **Generate the pages** with placeholders clearly marked `[REPLACE: ...]`. 5. **Wire them into the layout** — footer links to all required pages. 6. **Add the cookie banner** if any tracking is used. 7. **Print a "still to do" list** — every placeholder, every legal review needed. ## Output format Each file starts with: ```html ``` After generation, summary: ``` ## Generated - /src/pages/privacy.mdx — Privacy Policy template - /src/pages/terms.mdx — Terms of Service template - /src/pages/cookies.mdx — Cookie Policy template - /src/components/CookieBanner.tsx — Cookie consent banner - /src/pages/refunds.mdx — Refund Policy template (because you mentioned payments) - /src/pages/contact.mdx — Imprint / Contact ## Wired into layout - Footer now links to /privacy, /terms, /cookies, /contact ## Placeholders to fill in (search for [REPLACE:) 1. [REPLACE: legal entity name] — appears in 4 places 2. [REPLACE: registered address] — privacy.mdx, contact.mdx 3. [REPLACE: data retention period] — privacy.mdx 4. [REPLACE: governing law jurisdiction] — terms.mdx ## Before launch - [ ] Have a lawyer review. - [ ] Check that no tracking scripts load before consent. - [ ] Confirm sitemap.xml includes the legal pages. - [ ] Set the effective date on each page. ``` ## Boundaries - **Templates only.** Always remind the user this is not legal advice. - **Don't pretend to be a lawyer.** Flag any time the user is making a choice that has real legal weight (arbitration clauses, GDPR lawful basis, content moderation policy). - **Don't generate jurisdiction-specific clauses without asking.** EU/UK/CA/US/Brazil/etc. have meaningfully different requirements. - **Default to the friendly choice** when ambiguous — easier refund, longer cooling-off, plain language. Aggressive ToS clauses are user-hostile and often unenforceable. - **Never fabricate a real address or phone number.** Use `[REPLACE: ...]` placeholders.