Compliance Checklist

---
name: compliance-checklist
description: Compliance checklists for SaaS, content platforms, data handling — NOT legal advice. Activate for compliance, ToS, privacy policy, GDPR, DPDP, license, copyright tasks.
user-invocable: true
---

# Compliance Checklist

> **DISCLAIMER**: This is a checklist, NOT legal advice. Consult an actual lawyer for binding decisions. This skill flags things you should CHECK, not things you should ASSUME are correct.

## When to Activate
- User mentions: compliance, ToS, privacy, GDPR, DPDP, license, copyright, terms of service
- Launching a new product or feature that handles user data
- Publishing content that uses third-party assets
- Entering a new market (India, EU, US)

## SaaS Launch Checklist (India-Based Founder)

### Must Have Before Launch
- [ ] Privacy Policy (what data you collect, how you use it, how to delete)
- [ ] Terms of Service (liability limits, acceptable use, termination)
- [ ] Cookie consent banner (if serving EU users)
- [ ] Data deletion mechanism (user can request deletion)
- [ ] Secure authentication (hashed passwords, HTTPS everywhere)
- [ ] Payment processor compliant with PCI DSS (use Stripe/Razorpay, don't handle cards yourself)

### India-Specific (DPDP Act 2023)
- [ ] Consent before collecting personal data
- [ ] Purpose limitation (only collect what you need)
- [ ] Data retention policy (delete when purpose is served)
- [ ] Data Principal rights (access, correction, erasure)
- [ ] Penalties: up to Rs. 250 Crore for non-compliance

### If Serving EU Users (GDPR)
- [ ] Lawful basis for processing (consent, contract, legitimate interest)
- [ ] Right to be forgotten
- [ ] Data portability (export user data)
- [ ] 72-hour breach notification
- [ ] Data Processing Agreement with sub-processors

### If Serving US Users
- [ ] CCPA compliance (California users: right to know, delete, opt-out)
- [ ] CAN-SPAM compliance (if sending marketing emails)
- [ ] COPPA (if any chance of users under 13)

## Content Platform Checklist (YouTube)

### Stock Footage Licensing
- [ ] Pexels: Free for commercial use, no attribution required
- [ ] Pixabay: Free for commercial use, no attribution required (check individual)
- [ ] Coverr: Free for commercial use
- [ ] NEVER use footage without verifying the license first

### Music/Audio Licensing
- [ ] YouTube Audio Library: safe for monetized videos
- [ ] Auto-generated BGM: you own it (no copyright claim)
- [ ] NEVER use copyrighted music without a sync license

### AI Content Disclosure
- [ ] YouTube requires disclosure of "altered or synthetic" content
- [ ] Mark AI-generated content during upload
- [ ] FTC disclosure for affiliate links

### YouTube Monetization Compliance
- [ ] Original content (not reused from other channels)
- [ ] Not "repetitious" (vary scripts, voices, visuals between videos)
- [ ] Max 2-4 videos/week per channel (avoid spam detection)
- [ ] Human oversight in content pipeline

## Financial Product Compliance (QuantMind)
- [ ] SEBI registration if providing investment advice in India
- [ ] "Not financial advice" disclaimer on all outputs
- [ ] No guaranteed returns language
- [ ] Risk disclosure for trading tools
- [ ] Audit trail of all recommendations/signals

## Guardrails
- This skill FLAGS items to check — it does NOT provide legal conclusions
- ALWAYS consult a lawyer for binding compliance decisions
- ALWAYS err on the side of more disclosure, not less
- Keep this checklist updated as regulations change (DPDP, GDPR evolve)