Privacy Policy Drafter

---
name: privacy-policy-drafter
description: >-
  Draft and audit external privacy policies, collection notices, employee
  notices, child-facing notices, just-in-time notices, and layered disclosures.
  Use when notices must match verified processing, legal bases, sharing,
  transfers, retention, automated decisions, rights, and contact routes.
---

# Privacy Policy Drafter

Draft from a verified data inventory and user journey, not a generic template.
A notice describes processing; it does not itself create a lawful basis or consent.

## Intake

Obtain the audience and jurisdictions, organisation and roles, products and
channels, data categories and sources, purposes, legal bases or permissions,
cookies and tracking, profiling and automated decisions, recipients, sale or
sharing concepts, transfers, retention, children, security, rights, appeals,
complaints, contact channels, prior versions, effective date, and change process.

## Drafting method

1. Define each notice's audience, collection context, controller or fiduciary,
   scope, language, accessibility, delivery point, and relationship to other notices.
2. Map every disclosed data category to its source, purpose, legal basis or
   permission, recipient, transfer, retention rule, and rights impact.
3. Name categories in language meaningful to the audience; distinguish provided,
   observed, device, transaction, third-party, generated, and inferred data.
4. Explain purposes specifically enough to understand consequences. Separate
   service delivery, security, legal compliance, analytics, personalisation,
   advertising, research, and model training where applicable.
5. Describe recipients and onward use accurately, including processors,
   affiliates, partners, authorities, transaction counterparties, and public disclosure.
6. Explain international transfers, applicable safeguards, and how to obtain
   information where law requires.
7. State retention periods or useful criteria by data and purpose, including
   account closure, backups, disputes, legal holds, and deletion or de-identification.
8. Explain profiling, consequential automated decisions, human review, logic or
   significance where required, and available choices.
9. Present rights, withdrawal, objection, appeal, grievance, complaint, authorised
   agent, verification, accessibility, and response routes without deterring use.
10. Add child, employee, sensitive-data, cookie, mobile, camera, biometric, or
    other contextual disclosures only when the processing exists.
11. Validate the draft with product, engineering, security, HR, marketing,
    procurement, support, and records owners before publication.

## Output

Provide the layered notice, short or just-in-time text, disclosure-to-inventory
matrix, unresolved fact list, localisation plan, publication checklist, version
record, and review triggers.

## Guardrails

Do not copy unsupported practices, promise absolute security, use blanket consent,
hide material processing, or say data is never shared when processors receive it.
Avoid dark patterns and vague future-use clauses. Verify current jurisdictional
notice content, language, timing, and accessibility rules before publication.