📁 Legal
Privacy Policy Prompt: Draft From Your Real Data Practices
Turn your forms, checkout, newsletter, tools and cookies into a data map and a plain-English privacy policy draft, with rule questions for your lawyer.
0Reviews
Prompt
Act as a privacy program coordinator who drafts website privacy policies for small businesses from what they actually collect, then hands the draft to their lawyer. You write in plain English, you describe only the practices I list, and you treat legal coverage as questions for counsel, not conclusions. This is drafting help, not legal advice. Inputs: - Business name, legal entity, address and privacy contact: [BusinessIdentity] - Every place we collect information (web forms, checkout, newsletter, in-store tablet, Wi-Fi, social): [CustomerTouchpoints] - What each touchpoint collects, field by field: [DataInventory] - Outside tools and vendors that receive the data and what they do with it: [VendorsAndTools] - Cookies, analytics, pixels and embeds on the site: [CookiesAndTracking] - How long we keep each kind of data and how we delete it: [RetentionHabits] - Where customers live, whether we sell outside our country, and whether anything is aimed at children: [AudienceAndRegions] - How people can reach us to see, fix or delete their data, and how fast we answer: [RequestHandling] Rules: if a practice is not in my inputs, write ASK OWNER instead of guessing. Never write "we never share" or "fully secure" unless my inputs prove it. Do not quote statute numbers; name the law and let the lawyer confirm. Generate: 1. Data map: one row per touchpoint with data collected, purpose, vendor that receives it, retention, and an ASK OWNER note for any gap. 2. Rules to raise with the lawyer: from AudienceAndRegions and the data map, list which privacy laws might reach this business (for example California's online privacy law, the CCPA, the GDPR, COPPA) and the one fact that decides each. 3. Privacy policy draft: who we are, what we collect, how we use it, who receives it, cookies and analytics, how we respond to Do Not Track signals, retention, your choices and how to make a request, children, how we protect data, changes to this policy, effective date and contact. 4. Promise check: quote any draft sentence that promises more than the data map shows and rewrite it to match. 5. Lawyer review questions: five to eight specific questions, each tied to a row of the data map. 6. Update triggers: the business changes (new tool, new form, new region) that mean the policy must be revised.
Instructions
List every form field and tool you really use; the draft is only as accurate as your inventory. Variation: run it once per website if you have two brands. Tip: keep the data map next to the policy and update both together. Not legal advice; have a lawyer licensed where you operate review the draft before you post it.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
BusinessIdentity: Crumb & Copper Bakery LLC, 214 Mill Street, Asheville, North Carolina. Privacy contact: Dana Ruiz, owner, hello@crumbandcopper.example. CustomerTouchpoints: custom cake order form on our website; online checkout for pickup orders and cookie tins; newsletter signup on the site and on the counter tablet; loyalty signup on the counter tablet; free customer Wi-Fi with no login. DataInventory: cake form asks name, email, phone, pickup date, allergy notes and an optional inspiration photo upload. Checkout takes name, email, phone, shipping address for tins; card details are entered on Square's payment page and we never see full card numbers. Newsletter takes email only. Loyalty takes phone number and first name. VendorsAndTools: Square (online store, payments, loyalty), Mailchimp (newsletter), Google Analytics 4 on the website, our web host. CookiesAndTracking: Google Analytics 4 cookies only. No ad pixels, no retargeting. An Instagram feed embed on the home page. RetentionHabits: cake form emails stay in our inbox about 2 years. We delete inspiration photos 30 days after pickup. Newsletter until unsubscribe. Loyalty until the customer asks us to remove it. AudienceAndRegions: mostly local customers; we ship cookie tins anywhere in the US, including California. No sales outside the US. Nothing is aimed at children. RequestHandling: email Dana; we answer within 10 business days. About $600k yearly revenue, one shop.
Example Output
1. DATA MAP Cake order form | name, email, phone, pickup date, allergy notes, optional photo | make and schedule the cake | web host, our inbox | about 2 years; photos deleted 30 days after pickup Checkout | name, email, phone, shipping address; card entered on Square's page | fill and ship orders | Square | ASK OWNER: how long order records stay in Square Newsletter (site and tablet) | email | send the newsletter | Mailchimp | until unsubscribe Loyalty (tablet) | phone, first name | track rewards | Square | until removal request Website | GA4 cookie data | see which pages people use | Google Analytics 4 | ASK OWNER: GA4 retention setting Instagram embed | ASK OWNER: whether the embed sets cookies | show our feed | Instagram | ASK OWNER Wi-Fi | no login collected | none | none | none 2. RULES TO RAISE WITH THE LAWYER California's online privacy law (CalOPPA): you sell to California residents online, so ask whether the posted policy must list categories collected, who receives them, how people review changes, how you announce updates, an effective date, and your Do Not Track response. CCPA: deciding fact is whether you cross its revenue, consumer-volume or data-sale thresholds; at about $600k and one shop, ask counsel to confirm you are outside it. GDPR: deciding fact is whether you offer goods to people in the EU or monitor their behavior there; you do not sell outside the US, so confirm it does not apply. COPPA: deciding fact is whether anything is aimed at children under 13; you said nothing is. 3. PRIVACY POLICY DRAFT Who we are. Crumb & Copper Bakery LLC, 214 Mill Street, Asheville, North Carolina. Questions: Dana Ruiz, hello@crumbandcopper.example. What we collect. When you order a custom cake: your name, email, phone, pickup date, allergy notes, and any inspiration photo you upload. When you buy online: your name, email, phone and shipping address. Card details go straight to Square; we never see your full card number. Newsletter: your email. Loyalty: your phone number and first name. How we use it. To make, schedule and deliver your order, keep you safe from allergens you tell us about, send the newsletter you asked for, and track loyalty rewards. Who receives it. Square (orders, payments, loyalty), Mailchimp (newsletter), Google Analytics 4 (site use) and our web host. We do not sell your information. Cookies and analytics. Our site uses Google Analytics 4 cookies to count visits. We use no advertising pixels. Our home page shows an Instagram feed, and Instagram may collect information under its own policy. Do Not Track. ASK OWNER, then state plainly how the site responds to browser Do Not Track signals. How long we keep it. Order emails about 2 years; inspiration photos 30 days after pickup; newsletter until you unsubscribe; loyalty until you ask us to remove it. Your choices. Email Dana to see, correct or delete your information. We reply within 10 business days. Unsubscribe links are in every newsletter. Children. Our site and shop are not aimed at children under 13. Protecting your data. ASK OWNER: describe the real steps, such as who can open the order inbox and the tablet. Changes. We will post updates here and change the effective date. Effective date: ASK OWNER. 4. PROMISE CHECK No sentence promises more than the map. The security section stays ASK OWNER until you list real steps; do not fill it with "fully secure". 5. LAWYER REVIEW QUESTIONS 1. Do allergy notes count as health data under any state law that reaches us? 2. Is "about 2 years" in an inbox acceptable, or should we set a fixed deletion date? 3. Does the Instagram embed need a cookie notice? 4. Which Do Not Track statement fits a site with only GA4? 5. Does shipping tins to California put us under CalOPPA's posting rule? 6. Should the tablet signup show a short notice before collecting a phone number? 6. UPDATE TRIGGERS Adding an ad pixel, a new form field, a delivery app, sales outside the US, or a new email tool.