Text Analysis & GenerationLegalContent Creation

Draft Website Privacy Policy

Create a jurisdiction-aware website privacy policy with GDPR/CPRA disclosures, cookies/tracking details, third-party links, and content tailored to your provided site, data, and compliance information.

Prompt Content

Draft a comprehensive, jurisdiction-aware website privacy policy using the details provided. 1) Act as an experienced privacy counsel for public-facing websites. 2) Produce a final policy with clear headings and numbered sections: 1. Overview 2. Scope 3. Data We Collect 4. Sources of Data 5. How We Use Data 6. Legal Bases (if applicable) 7. Cookies and Tracking 8. Sharing and Disclosure (processors/partners) 9. International Transfers (if applicable) 10. Data Retention 11. Security 12. Your Rights and Choices 13. Children's Privacy (if applicable) 14. Do Not Track 15. Jurisdiction-Specific Notices 16. Changes to This Policy 17. Contact 18. Effective Date (use today's date) 3) Tailor content strictly to the details provided; include jurisdiction-specific rights and required disclosures for each region listed; include links for third parties when provided; omit sections that do not apply. Constraints: • Plain text only. No placeholders left blank. • Use simple, direct language suitable for site visitors. • Do not add services, practices, or jurisdictions not listed. • Keep statements accurate and consistent with provided details. • If a typical element is missing, use neutral, non-specific phrasing (e.g., "We retain data as necessary for the purposes described") rather than inventing specifics. • If cookies or tracking are used, describe types and choices, and reference consent settings if provided. • If 'sell' or 'share' is indicated or targeted ads are used, include CPRA disclosures and an opt-out method. • For GDPR/EEA/UK, identify controller, legal bases, data subject rights, and transfer safeguards when listed. Details to use: - Website and business: <site-details> Site Details </site-details> - Data collection and use: <data-practices> Data Practices </data-practices> - Security and compliance: <security-and-compliance> Security And Compliance </security-and-compliance> <example> Data categories format: • Account data: name, email • Usage data: pages viewed, actions taken • Device data: IP address, browser, OS </example> <example> Third-party processors format: • Stripe - payments (https://stripe.com/privacy) • Google Analytics - analytics (https://policies.google.com/privacy) </example>

Variables

Site Details: Site name and URL; operator/entity and location; audience (age limits); markets/jurisdictions served; controller/representatives; contact email/address/phone; general business model.; Example: Site: AcmeFit (https://acmefit.com). Operator/Controller: Acme Fitness LLC, Delaware, USA. Markets: US, EU, UK, Canada, Brazil. Audience: general; not for children under 13. Contact: [email protected]; 123 Main St, Austin, TX, USA. EU/UK representative: none.
Data Practices: What data you collect; sources (user-provided, automatic, third parties); purposes; legal bases (if applicable); retention periods; cookies/tracking types; analytics/ads tools; sale/share status; third-party processors/partners (name, purpose, link); international transfers; sensitive data (if any).; Example: Data: account (name, email), support messages, payment via Stripe, usage logs, cookies, device IDs, approx. location. Sources: user input, automatic via cookies, third-party auth (Google). Purposes: provide service, payments, security, analytics, marketing with consent. Legal bases (EEA/UK): contract, legitimate interests (security), consent (marketing/cookies). Retention: account life + 2 years. Cookies: essential, analytics, advertising. Tools: Google Analytics, Meta Pixel. Sale/share: do not sell; share for cross-context ads. Processors: Stripe - payments (https://stripe.com/privacy); AWS - hosting (https://aws.amazon.com/privacy/). Transfers: US processing with SCCs. Sensitive data: none.
Security And Compliance: Security measures; data subject rights you honor; request submission/verification steps; opt-out links (ads/cookies); DNT policy; data residency; transfer safeguards (SCCs, TIA); policy update cadence; complaints channels; DPO/privacy contact; applicable laws (e.g., GDPR, CCPA/CPRA, PIPEDA, LGPD).; Example: Security: encryption in transit/at rest, least-privilege access, audit logs, incident response. Rights: access, correction, deletion, portability, restriction, objection, withdraw consent; CA rights: know, delete, correct, opt-out of sale/share, limit sensitive use. Requests: email [email protected] or web form /privacy-request; verify via email. Opt-outs: /do-not-sell-or-share, AdChoices link, cookie banner settings. DNT: not responded; provide explanation. Laws: GDPR, CCPA/CPRA, PIPEDA, LGPD. Transfers: SCCs with TIA. Updates: notify via site and email. Complaints: contact us or local authority/DPA. DPO: [email protected].

Prompt Content

Variables

Site Details

Site name and URL; operator/entity and location; audience (age limits); markets/jurisdictions served; controller/representatives; contact email/address/phone; general business model.

Example: Site: AcmeFit (https://acmefit.com). Operator/Controller: Acme Fitness LLC, Delaware, USA. Markets: US, EU, UK, Canada, Brazil. Audience: general; not for children under 13. Contact: [email protected]; 123 Main St, Austin, TX, USA. EU/UK representative: none.

Data Practices

What data you collect; sources (user-provided, automatic, third parties); purposes; legal bases (if applicable); retention periods; cookies/tracking types; analytics/ads tools; sale/share status; third-party processors/partners (name, purpose, link); international transfers; sensitive data (if any).

Example: Data: account (name, email), support messages, payment via Stripe, usage logs, cookies, device IDs, approx. location. Sources: user input, automatic via cookies, third-party auth (Google). Purposes: provide service, payments, security, analytics, marketing with consent. Legal bases (EEA/UK): contract, legitimate interests (security), consent (marketing/cookies). Retention: account life + 2 years. Cookies: essential, analytics, advertising. Tools: Google Analytics, Meta Pixel. Sale/share: do not sell; share for cross-context ads. Processors: Stripe - payments (https://stripe.com/privacy); AWS - hosting (https://aws.amazon.com/privacy/). Transfers: US processing with SCCs. Sensitive data: none.

Security And Compliance

Security measures; data subject rights you honor; request submission/verification steps; opt-out links (ads/cookies); DNT policy; data residency; transfer safeguards (SCCs, TIA); policy update cadence; complaints channels; DPO/privacy contact; applicable laws (e.g., GDPR, CCPA/CPRA, PIPEDA, LGPD).

Example: Security: encryption in transit/at rest, least-privilege access, audit logs, incident response. Rights: access, correction, deletion, portability, restriction, objection, withdraw consent; CA rights: know, delete, correct, opt-out of sale/share, limit sensitive use. Requests: email [email protected] or web form /privacy-request; verify via email. Opt-outs: /do-not-sell-or-share, AdChoices link, cookie banner settings. DNT: not responded; provide explanation. Laws: GDPR, CCPA/CPRA, PIPEDA, LGPD. Transfers: SCCs with TIA. Updates: notify via site and email. Complaints: contact us or local authority/DPA. DPO: [email protected].