SKILL.md
Privacy Policy Drafter Skill
A privacy policy should tell users plainly what you collect, why, and what control they have — not hide it in legalese. This skill drafts a structured, regulation-aware policy from how the product actually handles data. Not legal advice — a qualified lawyer should review before you publish, and obligations vary by jurisdiction.
Working from a brief
Given a product description, draft the full policy anyway, inferring typical data flows and marking each inference (confirm — reflects assumed practice). Never leave "[company name]"-style gaps un-flagged, and never state a practice the founder didn't confirm as fact without labelling it an assumption.
Required Inputs
Ask for (if not already provided):
- Product / company and what it does
- Data collected (account info, usage/analytics, payment, location, cookies, etc.)
- Why it's collected and who it's shared with (processors, analytics, payment, ads)
- Jurisdictions / regulations in scope (GDPR, UK GDPR, CCPA/CPRA, others)
- Contact for privacy requests and whether there's a DPO
Output Format
A ready-to-review policy with these sections:
- Who we are & scope — controller identity, what the policy covers, effective date
- Information we collect — categorised (provided / automatic / from third parties), each with examples
- How and why we use it — purposes, with legal bases where GDPR applies (consent, contract, legitimate interest…)
- Cookies & tracking — types used and how to control them (link to a cookie notice if separate)
- Sharing & disclosure — processors and third parties, why, and cross-border transfer note
- Retention — how long, and the criteria for deciding
- Your rights — access, deletion, correction, portability, objection, opt-out of sale/sharing; how to exercise them