Privacy Policy Generator

A privacy policy that doesn't match the business's real data practices is worse than not having one — it's a liability. Over-disclosure creates commitments you can't keep. Under-disclosure creates the gap that becomes the ICO complaint. This skill maps what the business actually does with data first, then writes the policy from that map, so every section corresponds to a real practice rather than a hypothetical one.

The audit covers nine data categories (identity, account, payment, usage, device, location, cookies, user-generated, third-party-sourced), how each is collected (directly, automatically, from third parties), why each is collected (mapped to a GDPR lawful basis), who it's shared with (named processors and partners, not "third parties"), how long it's kept (with retention criteria where periods are variable), and where it's stored (with international transfer flagged where data crosses borders).

Jurisdiction analysis is layered, not exclusive. UK GDPR + PECR, EU GDPR, CCPA/CPRA, PIPEDA, COPPA for under-13 users in the US, and FTC enforcement under Section 5 for deceptive practices all apply where they apply — the policy needs to satisfy all of them rather than picking one. When in doubt, the skill includes the jurisdiction; the cost of over-compliance is low and the cost of under-compliance is the fine.

Every policy follows the same twelve-section structure (who we are, what we collect, why, how we use it, who we share with, international transfers, retention, your rights, cookies and tracking, children's privacy, changes to the policy, contact). Plain language is enforced — GDPR requires it, and an 8th-grade reading level is the target for the main text. Each section gets a plain-English summary box at the top with the detail below, because most users only read the summary. Cookies are listed specifically — not a copy-pasted list of every cookie any site might use, only the ones actually present.

Mobile apps get extra sections: device permissions and the reason for each, App Tracking Transparency / Data Safety alignment, SDK data collection disclosure, push notification handling, offline sync behaviour. B2B SaaS gets the explicit two-policy split — the website privacy policy (you as controller for visitors and leads) and a separate Data Processing Statement (you as processor for client data inside the product). Merging them confuses customers and creates compliance gaps.

This produces a drafted policy, not legal advice. Privacy regulation is enforced — by the ICO, the EU data protection authorities, the California Attorney General, the FTC — and a policy that doesn't match your real practices is the kind of detail that gets cited in enforcement actions. Have a qualified privacy lawyer or DPO review the draft and the underlying data map before publishing. The skill is a starting point for professional review, not a substitute for one.