| name | legal-pages |
| description | Scaffolds production-ready legal page templates for a website: Privacy Policy, Terms of Service, Cookie Policy, Cookie Consent banner, Refund Policy, Contact / Imprint. Templates are clearly marked as a starting point — the user must customize and have a lawyer review before going live. |
/legal-pages
Scaffolds the legal pages a public website needs. Output is a starting template — clearly marked at the top of each file: "This is a template. Have a lawyer review before going live."
Why this exists
Almost every public website needs at least: a Privacy Policy, Terms of Service, and (for EU/UK visitors or any tracking) a Cookie Policy plus consent banner. Without these:
- You expose yourself to GDPR / CCPA / PIPEDA / LGPD fines.
- You can't legally collect any user data, including IP/cookies/analytics.
- App stores reject mobile apps.
- Payment processors reject your account.
- Search engines (and your users) treat you as low-trust.
This skill produces baseline templates so you can launch — but they're templates, not legal advice. You always need a lawyer to review for your jurisdiction and business model.
When to use
- Starting a new website project.
- An existing site has no legal pages.
- Adding a new feature that changes data handling (analytics, payments, user accounts, cookies).
- After a
/web-launch-check flagged missing legal pages.
What it produces
1. Privacy Policy (/privacy or /privacy-policy)
Sections every privacy policy needs:
- Who we are — legal entity name, address, contact email.
- What data we collect — categorized:
- Information you give us (name, email, payment, content uploaded).
- Information we collect automatically (IP, browser, device, cookies, usage).
- Information from third parties (OAuth providers, analytics, advertisers).
- Why we collect it — legitimate interest, contract performance, consent, legal obligation. Be specific.
- Who we share it with — sub-processors (hosting, analytics, email, payment, support). List by category if not by name.
- How long we keep it — retention periods.
- Your rights — access, correction, deletion, portability, objection, withdraw consent.
- How to exercise rights — email address or DSAR endpoint, response within 30 days.
- International transfers — if servers are in another country, name the safeguards (SCCs, adequacy).
- Children's privacy — if not for under 13/16, say so explicitly.
- Cookie policy — link to the dedicated page or include a section.
- Changes — how you'll notify users of changes.
- Contact — DPO if you have one, or general contact.
- Effective date — last updated date at the top.
2. Terms of Service (/terms or /terms-of-service)
- Acceptance — by using the site, you accept these terms.
- Eligibility — minimum age, geographic restrictions.
- Account — registration, security, termination.
- Acceptable use — what users may and may not do (no harassment, no scraping, no IP infringement).
- User content — who owns it, what license you take, content moderation.
- Payments — pricing, billing, refunds, taxes.
- Intellectual property — your IP, trademarks, copyright.
- Disclaimers — service "as is," limitations of liability, indemnification.
- Termination — when you can suspend or terminate accounts.
- Governing law — which jurisdiction's law applies, dispute resolution (arbitration clauses are tricky — consult a lawyer).
- Changes — how you'll notify users.
- Contact — for legal notices.
3. Cookie Policy (/cookies) and consent banner
- What cookies we use — categorized:
- Strictly necessary (always on, no consent needed).
- Functional (preferences, language).
- Analytics (Plausible/GA/etc.).
- Marketing (Meta Pixel, Google Ads, etc.).
- Per-cookie table — name, purpose, expiry, first-party / third-party.
- How to manage — link to settings UI, browser settings.
Banner pattern:
┌─────────────────────────────────────────────────────────────┐
│ We use cookies to make this site work. │
│ Optional: analytics + marketing cookies (only with consent).│
│ │
│ [Accept all] [Reject all] [Customize] │
└─────────────────────────────────────────────────────────────┘
Rules the banner must follow:
- "Reject all" must be as easy as "Accept all" (no hidden behind clicks).
- No tracking/analytics scripts load until consent is given.
- Choice persisted (cookie or localStorage) so the user isn't asked again.
- Settings page lets the user change their mind.
4. Refund / Cancellation Policy (/refunds)
For any e-commerce or paid product:
- Refund window — typical 14–30 days, longer is friendlier.
- What's refundable — and what's not (digital goods consumed? services rendered?).
- How to request — link or email.
- Processing time — when the user gets their money back.
- Cancellation — for subscriptions, how to cancel and when it takes effect.
EU-specific: 14-day cooling-off period for distance contracts (Consumer Rights Directive).
5. Contact / Imprint (/contact or /imprint)
- Legal entity name (e.g., "Acme Inc.", "Acme GmbH").
- Registered address.
- Email — at least one human-monitored.
- Phone — required in some jurisdictions.
- Tax / company registration number — required in EU (Impressum), UK (Companies House number).
- VAT number — if EU/UK.
- Responsible person — director / managing partner — required in some EU countries.
6. (Recommended) Accessibility Statement (/accessibility)
- WCAG conformance level (AA target).
- Known issues being worked on.
- Contact for accessibility complaints.
Required by the European Accessibility Act for many sites in the EU. Strongly encouraged elsewhere.
7. (Recommended) Security disclosure (/.well-known/security.txt)
Contact: mailto:security@example.com
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt
Acknowledgments: https://example.com/security-thanks
Operating method
- Detect the framework — Next.js, Astro, plain HTML, etc.
- Detect what exists — don't overwrite an existing privacy policy.
- Ask the user for the minimum information needed:
- Legal entity name
- Contact email
- Registered address (or "remote / TBD")
- Jurisdiction (US, EU, UK, other)
- What data is collected (none / analytics-only / accounts / payments / content)
- Age requirement (none / 13+ / 16+ / 18+)
- Generate the pages with placeholders clearly marked
[REPLACE: ...].
- Wire them into the layout — footer links to all required pages.
- Add the cookie banner if any tracking is used.
- Print a "still to do" list — every placeholder, every legal review needed.
Output format
Each file starts with:
After generation, summary:
## Generated
- /src/pages/privacy.mdx — Privacy Policy template
- /src/pages/terms.mdx — Terms of Service template
- /src/pages/cookies.mdx — Cookie Policy template
- /src/components/CookieBanner.tsx — Cookie consent banner
- /src/pages/refunds.mdx — Refund Policy template (because you mentioned payments)
- /src/pages/contact.mdx — Imprint / Contact
## Wired into layout
- Footer now links to /privacy, /terms, /cookies, /contact
## Placeholders to fill in (search for [REPLACE:)
1. [REPLACE: legal entity name] — appears in 4 places
2. [REPLACE: registered address] — privacy.mdx, contact.mdx
3. [REPLACE: data retention period] — privacy.mdx
4. [REPLACE: governing law jurisdiction] — terms.mdx
## Before launch
- [ ] Have a lawyer review.
- [ ] Check that no tracking scripts load before consent.
- [ ] Confirm sitemap.xml includes the legal pages.
- [ ] Set the effective date on each page.
Boundaries
- Templates only. Always remind the user this is not legal advice.
- Don't pretend to be a lawyer. Flag any time the user is making a choice that has real legal weight (arbitration clauses, GDPR lawful basis, content moderation policy).
- Don't generate jurisdiction-specific clauses without asking. EU/UK/CA/US/Brazil/etc. have meaningfully different requirements.
- Default to the friendly choice when ambiguous — easier refund, longer cooling-off, plain language. Aggressive ToS clauses are user-hostile and often unenforceable.
- Never fabricate a real address or phone number. Use
[REPLACE: ...] placeholders.
