privacy-page-generator

What this skill does

# Pages: Privacy Policy

Guides Privacy Policy page content, structure, compliance, and AI-specific disclosures.

**When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output.

## Initial Assessment

Identify:
1. **Product category**: Free anonymous, free with account, freemium, subscription SaaS, enterprise/B2B, API/developer, marketplace, e-commerce, content/media, mobile app, AI agent/MCP — see legal-page-generator §Product Categories
2. **Data actually collected**: URLs, prompts, uploads, analytics, cookies, account data, payment data — be exhaustive
3. **AI involvement**: Whether AI models process user data and whether data is used for training (see §AI Disclosures)
4. **Jurisdiction needs**: Which privacy regulations apply — see legal-page-generator §Jurisdiction Decision Framework
5. **Indexing**: Typically index (see legal-page-generator §Indexing Strategy)

---

## Required Sections (14-Section Framework)

### 1. Who We Are

- Operator name (or "the operator of [Product]" for anonymous operations)
- Tool purpose in one plain-language sentence
- Contact email

### 2. What [Product] Does

- One paragraph explaining the core function
- Mention that no account or payment is required (if applicable)
- Set expectations: this is a [free/paid] [tool type] that does [X]

### 3. Information We Collect

Structure with clear sub-sections:

**What We Do NOT Collect** (trust signal — include for all products):
- No accounts, no passwords, no user profiles
- No payment information (if free)
- No contact lists or address books
- No precise location data
- Adapt this list to what's actually true for the product

**Data You Submit** (URLs, prompts, uploads, form inputs):
- What happens to it: processed for [purpose], sent to [AI providers if applicable]
- Whether it's stored: "processed in-memory and discarded after the request" or retention period
- Whether it's used for training: "not used to train AI models" (if true — state explicitly)

**Generated Content** (AI output, images, text):
- Returned to user's browser/account
- Whether retained on servers
- Whether used for training

**Analytics Data**:
- Which analytics tool (GA4, Plausible, etc.)
- What's collected (page views, device/browser, referrer, country-level location, session duration)
- Whether it identifies individuals

**Account Data** (if applicable):
- Email, username, profile information
- How it's used and stored

**Payment Data** (if applicable):
- Note that payment is processed by [processor], not stored directly

### 4. How We Use Information

- Purposes: service provision, improvement, security, analytics, legal compliance
- **AI Model Training Disclosure**: State explicitly whether user data is used to train, improve, or fine-tune AI models. If using API-based AI (OpenAI API, Google Cloud), note that these providers do not train on API data. If using consumer AI tools, disclose that training may occur.
- Marketing communications (with consent where required)

### 5. Cookies

Table format with opt-out instructions:

| Cookie | Purpose | Duration | How to Opt Out |
|--------|---------|----------|----------------|
| `_ga`, `_ga_*` | Google Analytics — aggregate usage measurement | Up to 2 years | [GA opt-out browser add-on](https://tools.google.com/dlpage/gaoptout) or block third-party cookies |
| `[session_cookie]` | Session management / fair-use enforcement | 24 hours / session | Clear browser data |

Also state:
- Whether advertising cookies are used
- Whether cross-site tracking occurs
- Whether the site responds to Do Not Track signals

### 6. Third-Party Processors

Table format with privacy policy URLs:

| Provider | Purpose | Privacy Policy |
|----------|---------|----------------|
| [Cloud provider] | Hosting / backend | [URL] |
| [CDN provider] | Content delivery / routing | [URL] |
| [AI model provider 1] | AI generation / processing | [URL] |
| [AI model provider 2] | AI generation / processing | [URL] |
| [Analytics provider] | Usage analytics | [URL] |

### 7. Data Retention

Specify per category — avoid vague "as long as needed" language:

- **Submitted data** (URLs, prompts, uploads): processed in-memory, discarded after response — not stored
- **Generated content**: delivered to browser, not retained on servers
- **Analytics aggregates**: retained for [X] months (GA4 default: 14 months)
- **Server access logs**: retained for 30 days for security/debugging
- **Account data** (if applicable): retained until account deletion; then deleted within [X] days

### 8. Your Rights

Structure by jurisdiction:

**GDPR (EEA/UK)**:
- Rights: access, rectification, erasure, restriction, portability, objection
- Legal basis for processing (Art. 6)
- Right to lodge complaint with supervisory authority
- Response timeframe: 30 days

**CCPA (California)**:
- Rights: know, delete, correct, opt-out of sale/sharing
- Statement: "[Product] does not sell personal information"
- How to exercise rights

**How to Exercise**:
- Email contact
- Identity verification if needed (note: for anonymous tools, minimal data exists)

### 9. International Transfers

- Where data is processed (country/region)
- Safeguards: Standard Contractual Clauses, adequacy decisions, or other mechanisms
- Note that data may transit through other regions as part of standard internet routing

### 10. Children

- Age threshold: under 13 (US/COPPA) or under 16 (EEA/GDPR)
- Statement: "not directed to children" / "do not knowingly collect"
- What to do if a child has submitted data: contact for deletion

### 11. Security

- TLS/HTTPS in transit
- Encryption at rest (provider-managed or self-managed)
- **No-credentials advantage** (if no accounts): "no passwords or credentials to leak"
- No payment data stored (if applicable)
- Breach notification commitment

### 12. Changes

- Material changes posted with new "Last updated" date
- Encouragement to review periodically
- If significant, additional notification (email, banner)

### 13. Contact

- Email address
- Response timeframe (e.g., "within 30 days")
- DPO or representative contact (if required by jurisdiction)

### 14. Regional Supplements

Follow the model of leading AI platforms: append jurisdiction-specific modules. At minimum:

**EEA/UK Supplement**:
- Legal bases for processing (Art. 6: consent, contract, legitimate interest)
- Full data subject rights (Art. 15–22)
- DPO or Art. 27 Representative contact
- Right to complain to supervisory authority
- Standard Contractual Clauses for international transfers

**California Supplement**:
- 11-category data collection and disclosure table
- Right to know, delete, correct
- "Do Not Sell or Share My Personal Information" statement
- Authorized agent provisions

Other supplements (China PIPL, Brazil LGPD, India DPDP) when the product has significant users in those jurisdictions.

---

## AI-Specific Disclosures

These are **mandatory** for any product that uses AI models:

### Must Disclose
1. **Which AI models process user data**: Name them specifically (Google Gemini, OpenAI GPT-4, etc.)
2. **Training data use**: Explicitly state whether submitted data is used for model training. If using API-based services that don't train on API data, state "not used for AI model training" — this is a significant trust signal.
3. **Probabilistic nature**: Generated output may contain inaccuracies, artifacts, or mis-rendered content.
4. **Image authenticity**: AI-generated images are not photographs of real individuals or places.

### 2025–2026 Regulatory Developments to Flag

- **EU AI Act**: Training data disclosure template required for GPAI providers (Aug 2025); full enforcement Aug 2026
- **Connecticut CTDPA**: LLM training data use must be disclosed in privacy notices (effective Jul 2026)
- **China GB/T 45654-2025**: Users must have ≤4-click opt-out from training da