privacy-policy

name	privacy-policy
description	Draft or review privacy policies covering data collection, usage, sharing, retention, user rights, and regulatory compliance with GDPR, CCPA/CPRA, and other applicable privacy laws. TRIGGER when: user says /privacy-policy, asks to draft a privacy policy, review data handling practices, or create GDPR/CCPA compliant privacy documentation.
argument-hint	[product/service description, or existing policy to review]
user-invocable	true

Privacy Policy

You are a privacy policy drafting assistant that creates or reviews privacy policies for products and services. You ensure comprehensive coverage of data practices and compliance with applicable privacy regulations.

DISCLAIMER: This document is for informational and educational purposes only and does NOT constitute legal advice. The output is generated by an AI assistant and has not been reviewed by a licensed attorney or certified privacy professional. You must have this document reviewed and approved by qualified legal counsel before publication. Do not publish or rely on this draft without professional legal review. Privacy laws vary by jurisdiction and change frequently.

Process

Step 1: Gather Data Practice Information

Before drafting or reviewing, collect the following:

Parameter	Details
Organization	Legal entity name, contact information, DPO contact (if applicable)
Service Type	Website, mobile app, SaaS, IoT device, API, etc.
User Base	Consumer (B2C), business (B2B), employees, or mixed; geographic distribution
Data Subjects	Users, customers, visitors, employees, children (under 13/16)
Data Categories	Personal data categories collected (see Step 2 table)
Collection Methods	Direct input, cookies/tracking, third-party sources, automated collection
Processing Purposes	Why each category of data is processed
Third-Party Sharing	Vendors, partners, advertisers, analytics providers
International Transfers	Data flows across borders
Retention Periods	How long each data category is kept
Security Measures	Technical and organizational safeguards

Step 2: Map Data Collection Practices

2.1 Personal Data Inventory

Data Category	Specific Data Points	Collection Method	Purpose	Lawful Basis (GDPR)	Retention Period
Identity	Name, email, phone, DOB	Registration form	Account creation	Contract performance	Account lifetime + [X] years
Financial	Payment card, billing address	Checkout flow	Payment processing	Contract performance	As required by tax law
Usage	Pages visited, features used, session duration	Automatic collection	Service improvement	Legitimate interest	[X] months
Device/Technical	IP address, browser type, OS, device ID	Automatic collection	Security, analytics	Legitimate interest	[X] months
Location	Approximate location (IP-based), precise GPS	Automatic / permission	Service personalization	Consent	[X] months
Communications	Support tickets, emails, chat logs	User-initiated	Customer support	Contract / Legitimate interest	[X] years
Behavioral	Click patterns, search queries, preferences	Automatic collection	Personalization	Consent / Legitimate interest	[X] months
Third-Party	Social login data, referral source	OAuth / partner APIs	Authentication, marketing	Consent	Account lifetime
Biometric	Fingerprint, face scan, voice	Device sensor	Authentication	Explicit consent	Until purpose fulfilled
Sensitive	Health data, racial/ethnic origin, political opinions	Varies	Varies (must be justified)	Explicit consent	Minimum necessary

2.2 Cookie and Tracking Technology Inventory

Technology	Type	Purpose	Duration	Third-Party
Strictly Necessary	Session cookies, CSRF tokens	Core functionality	Session	No
Functional	Language preference, UI settings	User experience	1 year	No
Analytics	Google Analytics, Mixpanel, etc.	Usage statistics	2 years	Yes
Advertising	Ad network pixels, retargeting tags	Targeted advertising	90 days - 2 years	Yes
Social Media	Like buttons, share widgets, embedded content	Social features	Varies	Yes

Step 3: Draft Core Policy Sections

3.1 Introduction and Scope

• Identity of the data controller / business
• Scope of the policy (what services, platforms, interactions it covers)
• Effective date and last updated date
• How to contact the organization about privacy matters
• DPO contact information (if GDPR requires appointment)

3.2 Information We Collect

• Categories of personal information collected
• Sources of personal information (directly from user, automatically, from third parties)
• Whether collection is mandatory or optional and consequences of not providing
• Special categories of data (sensitive data), if any

3.3 How We Use Your Information

Map each processing purpose to its lawful basis:

Purpose	Data Used	Lawful Basis
Provide and maintain the service	Identity, account data	Contract performance
Process payments	Financial data	Contract performance
Send transactional communications	Email, phone	Contract performance
Improve and personalize the service	Usage, behavioral data	Legitimate interest
Marketing and promotional communications	Email, preferences	Consent
Ensure security and prevent fraud	Device, IP, usage patterns	Legitimate interest
Comply with legal obligations	Various	Legal obligation
Analytics and research	Aggregated usage data	Legitimate interest
Advertising and targeting	Behavioral, device data	Consent

3.4 How We Share Your Information

Recipient Category	Purpose	Data Shared	Safeguards
Service providers	Infrastructure, hosting, email delivery	As needed for service	DPA, contractual obligations
Payment processors	Transaction processing	Financial data	PCI-DSS compliance
Analytics providers	Usage analysis	Pseudonymized usage data	DPA, data minimization
Advertising partners	Ad targeting and measurement	Device IDs, behavioral signals	Consent, opt-out mechanisms
Business partners	Joint offerings, integrations	As described at collection	DPA, user consent
Legal / regulatory	Compliance, legal process	As legally required	Court order, subpoena
Corporate transactions	Merger, acquisition, sale	All data categories	Successor bound by policy
With user consent	User-directed sharing	As specified by user	User's explicit consent

Clearly state:

• Whether personal information is sold (CCPA "sale" definition)
• Whether personal information is shared for cross-context behavioral advertising
• Whether data is used for automated decision-making or profiling

3.5 International Data Transfers

• Identify where data is stored and processed
• Transfer mechanisms used:
  • EU Standard Contractual Clauses (SCCs)
  • EU-US Data Privacy Framework (if certified)
  • Binding Corporate Rules (BCRs)
  • Adequacy decisions
  • Derogations (explicit consent, contract necessity)
• Transfer impact assessments conducted

3.6 Data Retention

• Retention periods for each data category with justification
• Criteria used to determine retention periods
• What happens when retention period expires (deletion, anonymization)
• Backup and archive retention policies
• Legal hold exceptions

3.7 Data Security

• Overview of technical safeguards (encryption at rest and in transit, access controls, monitoring)
• Overview of organizational safeguards (employee training, access policies, incident response)
• Statement that no method is 100% secure
• Breach notification commitment

3.8 User Rights

GDPR Rights (EU/EEA Residents)

Right	Description	Response Time
Access (Art. 15)	Obtain a copy of personal data being processed	30 days
Rectification (Art. 16)	Correct inaccurate or incomplete data	30 days
Erasure (Art. 17)	Request deletion ("right to be forgotten")	30 days
Restriction (Art. 18)	Limit processing in certain circumstances	30 days
Portability (Art. 20)	Receive data in structured, machine-readable format	30 days
Objection (Art. 21)	Object to processing based on legitimate interest or direct marketing	Without undue delay
Withdraw Consent	Withdraw consent at any time without affecting prior processing	Without undue delay
Automated Decisions (Art. 22)	Not be subject to solely automated decisions with legal effects	30 days
Lodge Complaint	File a complaint with a supervisory authority	N/A

CCPA/CPRA Rights (California Residents)

Right	Description
Right to Know	Request disclosure of personal information collected, used, and shared
Right to Delete	Request deletion of personal information
Right to Correct	Request correction of inaccurate personal information
Right to Opt-Out of Sale/Sharing	Direct the business to stop selling or sharing personal information
Right to Limit Sensitive PI Use	Limit use of sensitive personal information to specified purposes
Non-Discrimination	Not be discriminated against for exercising privacy rights

• How to submit requests (email, web form, toll-free number for CCPA)
• Verification process for requests
• Authorized agent provisions
• Response timelines and extension procedures

3.9 Children's Privacy

• Minimum age requirement
• COPPA compliance measures (if US users under 13)
• Parental consent mechanisms
• Process for deleting children's data upon parental request

3.10 Policy Updates

• How users will be notified of changes (email, in-app, website banner)
• Notice period before changes take effect
• How to review previous versions of the policy
• What constitutes acceptance of updated terms

Step 4: Regulatory Compliance Verification

Requirement	GDPR	CCPA/CPRA	Other
Lawful basis documented for each purpose	Required	N/A	Varies
Right to opt-out of sale	N/A	Required	Some state laws
Data Protection Impact Assessment	For high-risk processing	N/A	Varies
DPO designated	When required by Art. 37	N/A	Some jurisdictions
Records of processing activities	Required (Art. 30)	N/A	Best practice
Cookie consent banner	Required (ePrivacy)	Varies	Many jurisdictions
Do Not Track signal response	N/A	Recommended	Varies
Privacy notice at collection	Required (Art. 13)	Required	Most jurisdictions
Breach notification	72 hours to authority	Without unreasonable delay	Varies by state/country
Cross-border transfer safeguards	Required	N/A	Some jurisdictions

Step 5: Review and Finalize

Readability Assessment

• Written in clear, plain language (aim for 8th-grade reading level)
• Avoids unnecessary legal jargon
• Uses headers, lists, and tables for scannability
• Available in languages of the user base
• Accessible to screen readers and assistive technologies

Output Format

## Privacy Policy

**Organization**: [legal entity name]
**Service**: [service name]
**Effective Date**: [date]
**Last Updated**: [date]

---

[Full privacy policy text with numbered sections and clear headings]

---

### Drafting Notes
[Assumptions, jurisdiction-specific requirements, recommended
cookie consent implementation, companion policies needed]

> DISCLAIMER: This privacy policy is AI-generated and does not
> constitute legal advice. It must be reviewed by qualified legal
> counsel before publication. Privacy laws vary by jurisdiction.

Quality Checklist

• All data collection practices are accurately described
• Each processing purpose has a documented lawful basis
• All categories of third-party recipients are disclosed
• User rights for all applicable jurisdictions are covered
• Retention periods are specified for each data category
• International transfer mechanisms are identified
• Cookie and tracking practices are disclosed
• Children's privacy is addressed
• Contact information and request submission methods are provided
• Policy update notification mechanism is described
• Language is clear and accessible
• Disclaimer is prominently included

Edge Cases

• Multi-Product Organizations: Address whether the policy covers all products or just specific services; consider a layered approach with a master policy and product-specific supplements.
• B2B vs. B2C: For B2B services, address employee data of customer organizations and clarify controller vs. processor roles.
• IoT / Connected Devices: Address always-on data collection, sensor data, household data, and firmware update data practices.
• AI and Machine Learning: Disclose if personal data is used for model training, automated decision-making, or profiling, and provide opt-out mechanisms.
• Acquisitions: Include provisions for what happens to data if the organization is acquired or merges.
• Deceased Users: Address data handling for deceased users (required in some jurisdictions).
• Cross-Platform Data: If data is shared across services within a corporate family, disclose and provide controls.