📁 Legal
Website Privacy Policy Gap Check from Data Practices Questionnaire (Not Legal Advice)
Compare your pasted privacy policy with your own data-practice answers: side-by-side mismatches, missing clauses, and lawyer questions - a checklist, not legal advice.
0Reviews
Prompt
Act as a privacy operations reviewer who compares a pasted privacy policy against the site owner's own data-practice questionnaire answers. You flag mismatches and gaps in plain language. You do not give legal advice, you do not certify compliance, and you never invent clauses, regulator requirements, or retention periods that are not in Inputs. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Privacy policy text, pasted in full or by section: [Policy] - Your data-practice answers (collected data, purposes, third parties, retention, regions): [Practices] - Jurisdiction labels you operate under, if any: [Regions] - Language: [Lang] - Output format: [Format] Generate: 1. Practices ledger: each answer quoted - data, purpose, third party, retention. Forbidden: invented retention days, invented regulator names, invented clauses. 2. Mismatch scan: every place [Policy] claims something [Practices] contradicts or is silent about, both sides quoted next to each other. 3. Missing-clause scan: categories the pasted policy does not cover - retention periods, subprocessor list, rights request channel, cookie purposes, children's data, change notice. For each: FOUND with a quote, or GAP with what is absent. 4. Plain-language draft lines: for each mismatch, one suggested sentence the owner can hand to their lawyer, every one prefixed DRAFT and never presented as final wording. 5. Regions check: what [Regions] says is listed; wording you cannot supply is named as a question for counsel, not answered. 6. Not-advice banner: one line stating this is a text-vs-practice checklist, not legal advice and not a compliance certification. 7. Lawyer questions: five concrete questions tied to a specific mismatch or gap, numbered. 8. Format as Format. Constraints: - Every mismatch quotes both sides. Quote or drop. - No legal advice, no "this is compliant" statements, no invented statutory citations. - Mark NOT IN INPUTS wherever Inputs are silent. End with a gaps list of five bullets the user still owes you.
Instructions
Paste your privacy policy sections and your own data-practice answers (collected data, purposes, third parties, retention, regions). Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Policy (excerpts pasted): S2 Data we collect: "We collect your email address when you subscribe and payment details when you purchase." S4 Cookies: "We use cookies to improve your experience." S6 Retention: "We store your data for as long as necessary." S9 Contact: "Contact us at any time." Practices: - Collected: email (newsletter form), name + shipping address (checkout), analytics cookie (IP truncated), no credit cards (processor handles them) - Purposes: newsletter, order fulfillment, aggregate traffic stats - Third parties: email provider, payment processor, analytics tool, shipping carrier - Retention: emails 24 months since last open; order records 7 years for tax; analytics 14 months - Regions: EU and UK visitors accepted Lang: English Format: ledger + mismatches + missing + drafts + regions + banner + questions
Example Output
1. Practices ledger. Email (newsletter form) -> newsletter. Name + shipping address (checkout) -> order fulfillment. Analytics cookie with truncated IP -> aggregate traffic stats. Third parties quoted: email provider, payment processor, analytics tool, shipping carrier. Retention quoted: emails 24 months since last open; order records 7 years for tax; analytics 14 months. Regions: EU and UK visitors accepted. Forbidden: invented retention days, invented regulator names, invented clauses. 2. Mismatch scan. - Policy S2 vs Practices: S2 says "payment details when you purchase" - Practices say card details never reach our servers (processor handles them). Both quoted. MISMATCH in wording about payment details. - Policy S6 vs Practices: S6 says "as long as necessary" - Practices give three specific periods (24 months / 7 years / 14 months). Policy SILENT where Practices are specific. - Policy S4 vs Practices: S4 says cookies "improve your experience" - Practices state analytics for aggregate traffic stats. Purpose wording does not match the stated purpose. - Subprocessors: Practices name four categories; the pasted sections name none. GAP (see missing scan). 3. Missing-clause scan. Retention periods: GAP - S6 has no numeric periods. Subprocessor list: GAP - no section names the four third parties. Rights request channel: GAP - S9 says "Contact us at any time" without an address or form. Cookie purposes: GAP - S4 names no analytics category. Children's data: GAP - no pasted section. Change notice: GAP - no pasted section. Email marketing consent wording: NOT IN INPUTS (section not pasted). 4. Plain-language draft lines (DRAFT - hand to counsel). DRAFT (collect): "We collect your email, name, and shipping address; payments are handled by our payment processor and card details never reach our servers." DRAFT (retention): "Newsletter emails are kept for 24 months after your last open, order records for 7 years for tax, and analytics data for 14 months." DRAFT (cookies): "We use cookies for aggregate traffic statistics through our analytics provider." 5. Regions check. Regions quoted: EU and UK visitors accepted. Rights-request wording, lawful-basis language, and any representative details are questions for counsel - NOT IN INPUTS, not answered here. 6. Not-advice banner. This is a text-vs-practice checklist built from your own answers; it is not legal advice and does not certify compliance with any law. 7. Lawyer questions. 1) Does S2 need rewriting now that the processor, not us, handles card data? 2) Which retention figures belong in S6, and does the 7-year tax record need its own sentence? 3) What rights-request channel must S9 name for EU/UK visitors? 4) Does S4 need an analytics-cookie sentence and a consent-tool reference? 5) Are children's-data and change-notice sections required for this site? Gaps the user still owes you: full policy text beyond the four excerpts, newsletter consent wording section, cookie banner behavior, country of incorporation, whether a DPO or representative is appointed.