legal-policy-drafter

어떤 스킬인가요?

Draft, update, or audit legal-policy documents such as TERMS.md, PRIVACY.md, cookie notices, SaaS policies, app-store privacy text, and GDPR-friendly privacy disclosures from repository evidence. Use for legal policy work that requires inspecting product behavior, data flows, billing, auth, analytics, subprocessors, and missing business facts without inventing unsupported claims.

설치 방법

웹에서 배포되는 스킬입니다. 원문 페이지의 설치 안내 ↗를 따라주세요.

스킬 원문 파일

interface:
  display_name: "Legal Policy Drafter"
  short_description: "Draft or audit evidence-based legal policies"
  default_prompt: "Use $legal-policy-drafter to inspect this repo and draft evidence-based TERMS.md plus PRIVACY.md with TODO(confirm) markers for missing facts."

# GDPR-Friendly Policy Checklist

Use this checklist while drafting `PRIVACY.md` and cross-checking `TERMS.md`. Keep unresolved items explicit with `TODO(confirm):`.

## Privacy Policy

- Controller: legal entity or owner, website/product name, contact email, postal address when available.
- Scope: website, app, API, CLI, mobile app, SaaS workspace, browser extension, or other surface.
- Data categories: account profile, contact details, billing, authentication, uploaded/user content, support messages, logs, device/browser data, cookies/local storage, analytics events, AI prompts/outputs, location, sensitive data if any.
- Sources: user-provided, automatically collected, third-party login/payment/provider data, imported workspace data.
- Purposes and legal bases: contract, consent, legitimate interests, legal obligation, vital interests, public task when applicable.
- Processing details: account creation, authentication, payments, service delivery, security/fraud prevention, analytics, support, marketing, legal compliance.
- Processors/subprocessors: hosting, database/storage, payment provider, email provider, analytics, crash/error tracking, auth provider, AI provider, customer support, CDN, monitoring.
- International transfers: EEA/non-EEA processing, SCCs, adequacy decisions, provider safeguards when known.
- Retention: account data, billing/tax records, logs, backups, support messages, analytics, deleted accounts.
- Rights: access, rectification, deletion, restriction, portability, objection, withdraw consent, complain to supervisory authority.
- Cookies/tracking: essential cookies, analytics cookies, marketing cookies, local storage, consent controls, browser controls.
- Security: reasonable technical and organizational measures; avoid overpromising certifications unless verified.
- Children: minimum age and whether knowingly collecting children's data.
- Automated decisions/AI: profiling, automated decision-making, AI feature data handling when applicable.
- Changes: policy updates and notice method.
- Contact: support/privacy/legal email and DPO/EU representative if applicable.

## Terms Of Service

- Service identity: product name, owner/company, website URL, short service description.
- Eligibility: minimum age, authority for organizations/workspaces, account responsibility.
- Accounts: registration, credential security, truthful information, suspension/termination rights.
- Acceptable use: illegal activity, abuse, scraping, spam, reverse engineering where appropriate, service disruption, rights infringement.
- User content: ownership retained by user, license needed to operate the service, responsibility for content, removal rights.
- Plans/payment: pricing, subscription renewal, trials, cancellation, refunds, taxes, failed payments, changes to fees.
- Third-party services: integrations, external providers, separate terms, no control over third parties.
- Availability/support: uptime/support promises only if verified; otherwise use reasonable-efforts language.
- Intellectual property: service ownership, trademarks, feedback license if desired.
- Privacy cross-reference: link to `PRIVACY.md`.
- Disclaimers: service provided as-is/as-available where enforceable.
- Liability limits: jurisdiction-sensitive; keep balanced and mark for legal review.
- Indemnity: include only when suitable for the product audience.
- Termination: user cancellation, service suspension, post-termination data handling.
- Changes: updates to terms and continued use.
- Governing law/disputes: ask user; mark `TODO(confirm)` if unknown.
- Contact: support/legal email.

## Evidence Hints

Search the repository for:

- `stripe`, `paddle`, `lemonsqueezy`, `billing`, `checkout`, `subscription`
- `auth`, `oauth`, `session`, `better-auth`, `clerk`, `supabase`, `firebase`
- `posthog`, `plausible`, `analytics`, `gtag`, `sentry`, `bugsnag`
- `openai`, `anthropic`, `ai`, `llm`, `prompt`, `upload`, `storage`, `s3`, `r2`
- `email`, `resend`, `sendgrid`, `mailgun`, `smtp`, `support`
- `cookie`, `localStorage`, `sessionStorage`, `consent`
- `delete`, `export`, `retention`, `backup`, `log`

# Output Checklist

Run this self-check before finalizing `TERMS.md`, `PRIVACY.md`, app-store privacy text, cookie notices, or an audit.

## Evidence

- Existing policy/legal docs were read first.
- Product behavior was inspected from routes/pages/API/backend code.
- Data model/schema/env/deploy/provider evidence was inspected.
- Third-party providers affecting privacy or terms were verified against current official sources when possible.
- A working evidence matrix exists, even if summarized only in notes.

## Truthfulness

- No invented legal entity, owner, address, contact email, governing law, jurisdiction, or effective date.
- No unsupported claims about GDPR compliance, SOC 2, HIPAA, encryption, uptime, SLAs, refunds, deletion timelines, data residency, or AI training.
- Missing facts use `TODO(confirm):`.
- Existing policy text was preserved only where still accurate.

## Privacy Coverage

- Controller/operator and contact.
- Scope and covered surfaces.
- Data categories and sources.
- Purposes and legal bases where relevant.
- Cookies/local storage/tracking and consent controls.
- Processors/subprocessors and provider categories.
- International transfers and safeguards where known.
- Retention/deletion/export.
- User rights and choices.
- Security, children, AI processing, changes, and contact.

## Terms Coverage

- Service description and eligibility.
- Accounts and account responsibility.
- Acceptable use.
- User content ownership and operating license.
- Payments, subscriptions, trials, cancellation, taxes, invoices, and refunds if relevant.
- Third-party services.
- Availability/support without unsupported promises.
- IP, feedback, privacy cross-reference, termination, disclaimers, liability, governing law, changes, and contact.

## Final Response

- List created or updated files.
- Summarize key repo evidence and provider lookups.
- Call out all `TODO(confirm):` categories needing owner/legal review.
- Mention validation performed.
- Do not present the documents as guaranteed legal compliance.

# Privacy Policy Template

Use this as the preferred structure for `PRIVACY.md`. Keep text specific to repository evidence. Use `TODO(confirm):` for unknown business facts.

```md
# Privacy Policy

Effective date: TODO(confirm): YYYY-MM-DD

This Privacy Policy explains how TODO(confirm): [legal entity/product] ("we", "us", or "our") collects, uses, shares, and protects personal data when you use TODO(confirm): [product/site/app].

This draft is provided for review and is not legal advice.

## 1. Who We Are

- Product/service: TODO(confirm)
- Controller/operator: TODO(confirm)
- Website: TODO(confirm)
- Contact: TODO(confirm)
- Postal address, DPO, or EU representative: TODO(confirm, if applicable)

## 2. Scope

Describe the covered surfaces: website, SaaS app, API, CLI, mobile app, workspace, browser extension, docs, support, or marketing pages.

## 3. Personal Data We Collect

Group by source:

- Data you provide: account profile, contact details, workspace data, uploaded content, support messages, billing details.
- Data collected automatically: logs, IP address, device/browser data, cookies/local storage, analytics events, usage events, crash reports.
- Data from third parties: OAuth providers, payment processors, integrations, imported workspace data.
- AI data, if applicable: prompts, files, outputs, metadata, model/provider routing.

Do not include categories unsupported by evidence.

## 4. How We Use Personal Data

Map purposes to legal bases where GDPR or similar regimes may apply:

| Purpose | Data | Legal basis |
| --- | --- | --- |
| Provide and secure the service | TODO(confirm) | Contract / legitimate interests |
| Process payments | TODO(confirm) | Contract / legal obligation |
| Improve the service | TODO(confirm) | Legitimate interests / consent |
| Send marketing | TODO(confirm) | Consent / legitimate interests |

## 5. Cookies, Local Storage, And Tracking

Describe essential cookies/session storage, analytics cookies, marketing cookies, local storage, consent controls, and browser controls. If no cookie audit was possible, mark unknowns with `TODO(confirm):`.

## 6. Sharing And Processors

List verified provider categories and providers from the evidence matrix. Explain that providers process data for service operation, payment, hosting, analytics, support, security, or AI features as applicable.

## 7. International Transfers

Describe known processing locations and transfer safeguards. Use `TODO(confirm):` for unknown hosting region, SCCs, adequacy decisions, or provider safeguards.

## 8. Retention

Cover account data, billing/tax records, logs, backups, support messages, analytics, and deleted accounts. Do not invent durations.

## 9. Your Rights And Choices

Cover access, correction, deletion, portability, objection, restriction, consent withdrawal, marketing opt-out, cookie controls, and complaint to a supervisory authority where applicable.

## 10. Security

Describe reasonable safeguards only at the level supported by evidence. Avoid naming certifications or encryption details unless verified.

## 11. Children

State the minimum age and whether the service knowingly collects children's data. Use `TODO(confirm):` if unknown.

## 12. AI Features

Include only if relevant. Explain what is sent to AI providers, why, and what user controls exist. Do not claim no training/retention unless verified.

## 13. Changes To This Policy

Explain how updates are posted and whether users are notified of material changes.

## 14. Contact

Provide privacy/support/legal contact details or `TODO(confirm):`.
```

# Provider Research

Use this reference when the repository reveals third-party services that affect `TERMS.md`, `PRIVACY.md`, cookies, subprocessors, international transfers, or payment/refund wording.

## Rule

Verify current official provider pages before naming a provider as a processor/subprocessor or making claims about privacy, DPAs, subprocessors, data location, retention, cookies, or AI training. Prefer official privacy pages, DPA pages, subprocessor pages, product docs, and security pages. Do not rely on package names alone.

Use Context7 for library/framework/API/CLI docs. Use web search for current provider legal/privacy/subprocessor/DPA pages.

## Research Notes Format

Keep working notes like this before drafting:

```md
| Provider | Evidence | Role | Data likely involved | Policy impact | Confidence |
| --- | --- | --- | --- | --- | --- |
| Stripe | package.json + official privacy/DPA URL | payment processor | billing/contact/payment metadata | Payments, retention, subprocessors, transfers | High |
```

## Common Provider Categories

- Payments: Stripe, Paddle, Lemon Squeezy, Chargebee, PayPal. Check checkout, invoices, tax records, subscription renewal, refund/cancellation flow, and payment processor wording.
- Email: Resend, SendGrid, Mailgun, Postmark, AWS SES, SMTP. Check transactional email, marketing email, unsubscribe, message metadata, and provider role.
- Authentication: Clerk, Auth0, Supabase Auth, Firebase Auth, Better Auth, OAuth providers. Check account identifiers, sessions, OAuth profile data, cookies, and security logs.
- Analytics: PostHog, Plausible, Google Analytics, Vercel Analytics, Segment, Amplitude, Mixpanel. Check cookies/local storage, event data, consent, IP handling, and opt-out controls.
- Error tracking/monitoring: Sentry, Bugsnag, Datadog, Logtail/Better Stack, Axiom. Check logs, stack traces, IP/device data, user IDs, retention, and masking.
- Hosting/storage/database: Vercel, Cloudflare, AWS, GCP, Azure, Railway, Fly.io, Supabase, Neon, PlanetScale, R2, S3. Check hosting region, backups, logs, storage, transfers, and subprocessors.
- AI providers: OpenAI, Anthropic, Google AI, Mistral, Groq, Replicate. Check prompts/files/outputs, model training settings, retention, abuse monitoring, and user-facing AI disclosures.
- Support/customer messaging: Intercom, Crisp, Zendesk, Help Scout, Linear, GitHub Issues. Check support messages, contact details, attachments, and retention.
- CDN/media: Cloudflare, Imgix, UploadThing, Cloudinary. Check IP logs, uploaded media, transformations, and retention.

## Claims To Avoid Without Evidence

- "We never share data."
- "We are GDPR compliant."
- "Data is encrypted at rest and in transit."
- "We delete all data within X days."
- "We host exclusively in the EU/US."
- "We do not use cookies."
- "AI providers never train on your data."
- "We offer refunds" or "all sales are final."

Use `TODO(confirm):` instead.

# Terms Of Service Template

Use this as the preferred structure for `TERMS.md`. Preserve accurate existing policy text when updating, but remove contradictions and unsupported promises.

```md
# Terms Of Service

Effective date: TODO(confirm): YYYY-MM-DD

These Terms of Service ("Terms") govern your access to and use of TODO(confirm): [product/service] provided by TODO(confirm): [legal entity/owner].

This draft is provided for review and is not legal advice.

## 1. The Service

Describe the product plainly using repo evidence: website, SaaS app, API, CLI, mobile app, developer tool, marketplace, content service, or other surface.

## 2. Eligibility And Authority

Cover minimum age, account eligibility, and organization/workspace authority if applicable.

## 3. Accounts

Cover registration, truthful information, credential security, account responsibility, OAuth/session use, and suspension for misuse.

## 4. Acceptable Use

Include clauses relevant to the product:

- Illegal, harmful, abusive, deceptive, or rights-infringing activity.
- Attempts to disrupt, overload, scrape, reverse engineer, or bypass access controls.
- Spam, malware, credential theft, harassment, or unauthorized access.
- Uploading content without rights or in violation of laws.

Avoid overbroad enterprise clauses if the product is consumer/simple.

## 5. User Content And Data

State that users retain ownership of their content. Grant the service only the license needed to host, process, transmit, display, back up, and operate the service. Explain user responsibility for content and removal rights.

## 6. Plans, Payments, Trials, And Refunds

Include only if billing evidence exists. Cover pricing, subscriptions, renewal, cancellation, failed payments, taxes, invoices, plan changes, free trials, and refunds. Use `TODO(confirm):` where business rules are unknown.

## 7. Third-Party Services

Describe integrations, hosting, payment processors, AI providers, analytics, app stores, or external services. Note that third-party services may be governed by separate terms.

## 8. Service Changes, Availability, And Support

Use reasonable-efforts language unless uptime/SLA/support commitments are verified. Do not invent support response times.

## 9. Intellectual Property

Cover service ownership, trademarks, docs/API/client code if applicable, and feedback license if desired.

## 10. Privacy

Reference `PRIVACY.md` or the hosted privacy policy URL.

## 11. Termination

Cover user cancellation, service suspension/termination, effect of termination, and post-termination data handling with `TODO(confirm):` where retention/deletion is unknown.

## 12. Disclaimers

Use balanced "as is" and "as available" language where enforceable. Keep jurisdiction-sensitive claims for review.

## 13. Limitation Of Liability

Use balanced limitation language and mark jurisdiction-specific caps with `TODO(confirm):`.

## 14. Indemnity

Include only if suitable for the product audience, especially developer tools, marketplaces, user-generated content, APIs, or business SaaS.

## 15. Governing Law And Disputes

Ask the owner or use `TODO(confirm):`. Do not invent governing law, venue, arbitration, or class action waiver.

## 16. Changes To These Terms

Explain how updates are posted and when continued use means acceptance.

## 17. Contact

Provide support/legal contact details or `TODO(confirm):`.
```

---
name: legal-policy-drafter
description: Draft, update, or audit legal-policy documents such as TERMS.md, PRIVACY.md, cookie notices, SaaS policies, app-store privacy text, and GDPR-friendly privacy disclosures from repository evidence. Use for legal policy work that requires inspecting product behavior, data flows, billing, auth, analytics, subprocessors, and missing business facts without inventing unsupported claims.
---

# Legal Policy Drafter

## Core Rule

Draft practical legal-policy documents from evidence, not guesses. Treat the output as a professional draft for owner/counsel review, not legal advice.

Before writing policy text, inspect the current repository and ask for missing blockers. Do not invent company identity, jurisdiction, contact details, retention periods, subprocessors, pricing terms, children policy, compliance claims, or security guarantees.

If the user wants speed, ask at most 5 blocker questions and mark unresolved facts with `TODO(confirm):`.

## Modes

Infer the mode from the request:

- `draft`: create fresh `TERMS.md` and `PRIVACY.md`.
- `update`: revise existing policy docs while preserving accurate useful text.
- `audit`: report gaps and contradictions without editing unless asked.
- `app-store`: produce concise mobile/app-store privacy wording in addition to or instead of full docs.
- `enterprise`: emphasize subprocessors, DPA/security posture, admin/workspace controls, SLAs, support, and organization authority.

## Intake

Ask only for facts that block a truthful draft and are not present in the repo or user prompt:

- Legal/service identity: company or owner name, product name, website URL, country/state of establishment, governing law preference.
- Contact: support/legal/privacy email, postal address if needed, DPO/EU representative if applicable.
- Effective date: confirm the current/effective date; use the runtime/system date as the proposed default when available.
- Audience and tone: plain, formal, friendly, developer-focused, consumer, enterprise, or app-store style.
- Commercial model: free, paid, subscriptions, trials, refunds, cancellation, taxes, invoicing.
- User data: account data, billing data, analytics, logs, uploaded content, AI prompts/files, cookies, location, device data, sensitive data, children/minors.
- Operations: hosting region, providers/subprocessors, retention/deletion/export process, security contact, data transfer mechanism.
- Output preferences: overwrite existing files, update existing docs, or create first drafts.

## Exploration Workflow

1. Read existing policy/legal files first: `TERMS.md`, `PRIVACY.md`, `LICENSE`, `README`, docs, marketing pages, app-store metadata, footer/contact copy.
2. Map product behavior from source: routes/pages, auth, onboarding, billing, uploads, messaging, admin areas, API endpoints, SDKs, telemetry, emails, background jobs, and data export/deletion paths.
3. Inspect data and infrastructure: schemas, migrations, ORM models, config files, env examples, Docker/worker/deploy files, analytics/error tracking, payment/email/storage/cloud providers.
4. Search or fetch current official documentation for detected third-party services that affect privacy or terms. Prefer official docs, subprocessor lists, DPA/privacy pages, SDK docs, and configuration docs. Use Context7 for library/framework/API/CLI docs when available; use web search for current provider privacy, cookie, subprocessor, and DPA facts. Record source names/URLs in working notes, not necessarily in the final policy unless useful.
5. Compare evidence against the GDPR checklist in `references/gdpr-policy-checklist.md`.
6. Build a working evidence matrix before drafting:

```md
| Finding | Evidence file/provider | Policy impact | Confidence |
```

7. Draft, update, or audit the requested output, defaulting to repo-root `TERMS.md` and `PRIVACY.md` for full policy work.

## References

Load these files only when needed:

- `references/gdpr-policy-checklist.md`: GDPR-friendly coverage checklist and repo search hints.
- `references/provider-research.md`: how to verify third-party provider privacy, DPA, cookie, and subprocessor facts.
- `references/privacy-template.md`: preferred `PRIVACY.md` structure and section-level prompts.
- `references/terms-template.md`: preferred `TERMS.md` structure and section-level prompts.
- `references/output-checklist.md`: final self-check before presenting the work.

## Subagent Plan

When the user explicitly authorizes subagents, spawn 4-5 independent agents with read-only exploration tasks. If authorization is unclear and the active environment requires explicit delegation permission, ask once before spawning. Keep write ownership in the main agent; subagents should return notes, not edit files.

Use these passes:

- Product and user flows: app purpose, target users, account model, user-generated content, public/private surfaces, risky terms clauses.
- Data model and backend: personal data categories, API endpoints, database fields, retention/deletion/export evidence, logs, admin access.
- Infrastructure and subprocessors: hosting, storage, payment, email, auth, analytics, error tracking, AI providers, CDNs, package/service integrations.
- Frontend and tracking: cookies/local storage, analytics scripts, consent UX, forms, marketing pages, privacy-facing copy.
- Existing docs and legal consistency: current policies, README claims, pricing/refund wording, license, jurisdiction hints, support/contact details.

Merge the notes into a single evidence table before drafting. Resolve conflicts by checking the source files yourself.

## Drafting Standards

- Write clear markdown with an effective date near the top.
- Generate exactly `TERMS.md` and `PRIVACY.md` unless the user requested different filenames.
- Keep language professional and specific to the product. Avoid fake legal certainty, boilerplate-only policies, and broad claims not supported by the codebase.
- Use `TODO(confirm): ...` for missing facts instead of fabricating them.
- Include a short "not legal advice / review with counsel" note only if appropriate for the project style; do not make it the main content.
- Keep GDPR friendliness concrete: legal bases, data categories, purposes, processors, transfers, retention, rights, deletion/export/contact, security, cookies/tracking, and children.
- For Terms, cover service description, accounts, acceptable use, user content, payments/refunds if relevant, third-party services, availability, termination, disclaimers, liability, governing law, changes, and contact.
- Preserve useful existing policy text when updating files, but remove contradictions and stale claims after confirming with evidence.
- Never claim SOC 2, HIPAA, GDPR compliance, encryption details, uptime, support response times, refund rights, data residency, or deletion timelines unless the repo or user confirms them.

## Final Response

Summarize:

- Files created or updated.
- Key evidence used from the repo and provider lookups.
- Any `TODO(confirm)` items that need owner/legal review.
- Validation performed, such as markdown lint/checks if available.

Do not present the documents as guaranteed legal compliance.