Draft a clear, plain-language privacy policy tailored to what a product actually collects and does with data. Use when asked to write a privacy policy, draft a data-protection notice, or create a GDPR/CCPA-aware privacy statement. Produces a structured policy covering data collected, purposes, legal bases, sharing, retention, user rights, and contact — written to be readable, not boilerplate. Not legal advice; have counsel review before publishing.
Start a fresh conversation. Replace the highlighted placeholders.
Use privacy-policy-drafter to draft a ready-to-review privacy policy for [product and company], based on [data practices and sharing] and [jurisdictions and privacy contact]; flag assumptions and include counsel’s review checklist before publication.
Required inputs
[product and company]
[data practices and sharing]
[jurisdictions and privacy contact]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: privacy-policy-drafterdescription: "Draft a clear, plain-language privacy policy tailored to what a product actually collects and does with data. Use when asked to write a privacy policy, draft a data-protection notice, or create a GDPR/CCPA-aware privacy statement. Produces a structured policy covering data collected, purposes, legal bases, sharing, retention, user rights, and contact — written to be readable, not boilerplate. Not legal advice; have counsel review before publishing."
Privacy Policy Drafter Skill
A privacy policy should tell users plainly what you collect, why, and what control they have — not hide it in legalese. This skill drafts a structured, regulation-aware policy from how the product actually handles data. Not legal advice — a qualified lawyer should review before you publish, and obligations vary by jurisdiction.
Working from a brief
Given a product description, draft the full policy anyway, inferring typical data flows and marking each inference (confirm — reflects assumed practice). Never leave "[company name]"-style gaps un-flagged, and never state a practice the founder didn't confirm as fact without labelling it an assumption.
Required Inputs
Ask for (if not already provided):
Product / company and what it does
Data collected (account info, usage/analytics, payment, location, cookies, etc.)
Why it's collected and who it's shared with (processors, analytics, payment, ads)
Jurisdictions / regulations in scope (GDPR, UK GDPR, CCPA/CPRA, others)
Contact for privacy requests and whether there's a DPO
Output Format
A ready-to-review policy with these sections:
Who we are & scope — controller identity, what the policy covers, effective date
Information we collect — categorised (provided / automatic / from third parties), each with examples
How and why we use it — purposes, with legal bases where GDPR applies (consent, contract, legitimate interest…)
Cookies & tracking — types used and how to control them (link to a cookie notice if separate)
Sharing & disclosure — processors and third parties, why, and cross-border transfer note
Retention — how long, and the criteria for deciding
Your rights — access, deletion, correction, portability, objection, opt-out of sale/sharing; how to exercise them
Security — high-level measures (no false guarantees)
Children — whether the service targets/permits minors
Changes & contact — how updates are notified; the privacy contact / DPO
End with: ⚠️ Review checklist — the specific items counsel must confirm (legal bases, retention periods, transfer mechanism, sub-processor list).
Quality Checks
Each data category ties to a stated purpose (and legal basis where GDPR applies)
User rights and how to exercise them are explicit
Retention is addressed, not skipped
Plain language — readable by a non-lawyer
Assumptions flagged; "not legal advice — counsel must review" retained
Anti-Patterns
Generic boilerplate that doesn't match what the product does
Claiming GDPR/CCPA compliance as a fact rather than reflecting practices
Vague "we may share with third parties" with no categories or purpose