legal-page-generator
This Claude Code skill guides the creation and structure of legal pages such as Privacy Policies, Terms of Service, and Cookie Policies for digital products. Use it when users request help drafting, optimizing, or organizing legal compliance content, or mention specific legal page types, compliance requirements, or regulatory needs for their product category and jurisdiction.
git clone --depth 1 https://github.com/kostja94/marketing-skills /tmp/legal-page-generator && cp -r /tmp/legal-page-generator/skills/pages/legal/legal ~/.claude/skills/legal-page-generatorSKILL.md
# Pages: Legal Guides legal page content, structure, compliance, and platform readiness for AI/SaaS products. **When invoking**: On **first use**, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On **subsequent use** or when the user asks to skip, go directly to the main output. ## Initial Assessment Identify: 1. **Product category**: Free anonymous, free with account, freemium, subscription SaaS, enterprise/B2B, API/developer, marketplace/platform, e-commerce, content/media, mobile app, AI agent/MCP — see §Product Categories 2. **Page type**: Privacy Policy, Terms of Service, Cookie Policy, etc. 3. **Jurisdiction needs**: Which countries' laws apply — see §Jurisdiction Decision Framework 4. **Indexing strategy**: Index or noindex — see §Indexing Strategy 5. **Platform dependencies**: Which external platforms require these pages — see §Platform Dependencies --- ## Product Categories The legal page structure depends heavily on the product category. Identify which one applies before drafting: | Category | Key Legal Characteristics | Sections to INCLUDE | Sections to SKIP | |---|---|---|---| | **Free Anonymous** | No accounts, no payment, no persistent storage, GA4 analytics | What we DON'T collect, no-training statement, fair-use limits, free/no-SLA | Payment, account responsibilities, refund, data portability | | **Free with Account** | Login required, user data stored, may have social features | Account security, data access/portability, user responsibilities | Payment, billing, refund | | **Freemium** | Free + paid tiers, payment data, auto-renewal | Payment terms, billing, tier differences, data handling per tier | — | | **Subscription SaaS** | Recurring billing, auto-renewal, cancellation | Payment, billing cycles, auto-renewal disclosure, cancellation process | — | | **Enterprise / B2B** | DPA, SOC 2, zero-training guarantees, SCCs | DPA reference, sub-processor list, security certifications, data processing roles, custom retention | Fair-use limits (usually N/A) | | **API / Developer** | Data processor role, rate limits, API keys | Rate limits, API key security, data processor terms, uptime/SLA | End-user account sections | | **Marketplace / Platform** | Multi-party, UGC responsibility, submission licensing | Content moderation, takedown process, submitter licenses, third-party content disclaimer | — | | **E-commerce** | Physical/digital goods, refunds, shipping | Refund policy, shipping policy, consumer rights, payment security | — | | **Content / Media** | Copyright, DMCA, content licensing | DMCA contact, content ownership, republication terms | Payment (unless paid content) | | **Mobile App** | App store review, privacy nutrition labels, permissions | App store compliance notes, permission justifications, data collection summary | — | | **AI Agent / MCP** | Automated decisions, tool invocation, sub-processor chains | AI decision transparency, sub-processor chain disclosure, autonomous action limits | — | --- ## Platform Dependencies Many external platforms **require** posted Privacy Policy and/or Terms of Service before the product can be listed, advertised, or operate in compliance. These should be flagged to the user during generation. ### Submission & Directory Platforms Most AI tool directories, MCP/Skills marketplaces, and software directories require both Privacy Policy and Terms of Service to be publicly accessible before a listing can be approved. Common requirements across these platforms: - Publicly linked Privacy Policy and Terms of Service - No illegal, deceptive, or IP-infringing content - Accurate, non-misleading product descriptions - Submitter warrants ownership or authority to list - Platform reserves right to reject or remove listings at discretion - Often require a DMCA/copyright complaint contact ### Advertising & Distribution Platforms | Platform | Requires | Consequence if Missing | |----------|----------|----------------------| | Google Ads | Privacy Policy link during account setup | Cannot launch campaigns | | Meta Ads (Facebook/Instagram) | Privacy Policy for ad account verification | Ad account suspended | | TikTok Ads | Privacy Policy for account review | Cannot launch | | Apple App Store | Privacy Policy URL + privacy nutrition labels | App rejected | | Google Play Console | Privacy Policy URL for all apps | App rejected | | LinkedIn Ads | Privacy Policy for business page verification | Restricted access | ### Infrastructure & Compliance | Requirement | What's Needed | |-------------|---------------| | Google Analytics ToS §7 | Posted privacy policy that discloses GA usage | | Stripe / payment processors | Privacy Policy URL during onboarding | | OAuth providers (Google, GitHub) | Privacy Policy URL for app verification | | SOC 2 / ISO 27001 | Both pages are standard vendor-assessment prerequisites | | Enterprise procurement | Both pages are due-diligence checklist items | | Accelerators (YC, Techstars, etc.) | Legal pages are standard application requirements | --- ## Jurisdiction Decision Framework Use a three-layer approach to determine which laws apply: **Layer 1 — Operator location** → determines primary governing law and venue in Terms. **Layer 2 — User locations** → determines which privacy regulations apply and whether regional supplements are needed. If the product is accessible globally, assume GDPR (EU), CCPA (California), and the operator's home jurisdiction at minimum. **Layer 3 — Data storage location** → determines data localization obligations. China (PIPL) and India (DPDP) may require local storage. ### Major Privacy Regulations (2025–2026) | Jurisdiction | Law | Consent Model | Max Penalty | Notable | |---|---|---|---|---| | EU/EEA | GDPR | Opt-in | €20M / 4% global revenue | 72h breach notification; DPO required for certain entities | | UK | UK GDPR + DPA 2018 | Opt-in | £17.5M / 4% | Post-Brexit independent; UK Representative required | | Ca
When the user wants to analyze Google Search Console data, use the GSC API, or interpret search performance. Also use when the user mentions "GSC," "Search Console," "indexing report," "Core Web Vitals," "Enhancements," "Insights report," "search performance," "search queries," "search performance report," "URL inspection," "impressions," "CTR," "average position," "index coverage," "GSC data analysis," "Search Console API," or "searchanalytics.query." When the user wants to rewrite title tags (not only report on them), use title-tag. For meta description rewrites, use meta-description.
When the user wants to build an SEO data analysis system, monitor indexing/traffic/keywords/backlinks, or set up benchmarks. Also use when the user mentions "SEO data analysis," "SEO monitoring," "article database," "traffic benchmark," "penalty recovery," "SEO work document," "SEO dashboard," "keyword tracking," "ranking monitoring," "indexing report," or "backlink monitoring." For GSC API, use google-search-console.
When the user wants to track AI search traffic in GA4 or GSC. Also use when the user mentions "AI traffic," "ChatGPT referral," "Perplexity traffic," "AI Overviews," "GA4 AI sources," "AI search analytics," "track AI referrals," "AI search traffic," "Claude traffic," or "how to track AI traffic." For AI SEO strategy, use generative-engine-optimization.
When the user wants to analyze website traffic sources, attribution, or dark traffic. Also use when the user mentions "traffic sources," "dark traffic," "direct traffic," "UTM parameters," "traffic attribution," "channel attribution," "attribution optimization," "channel analysis," "traffic analysis," "traffic diversification," "natural traffic benchmark," or "organic vs paid traffic." For GA4 setup, use analytics-tracking.
When the user wants to set up, audit, or optimize analytics tracking (GA4, events, conversions). Also use when the user mentions "Google Analytics," "GA4," "event tracking," "conversions," "attribution model," "gtag," "data layer," "GA4 setup," "conversion tracking," "event setup," "User ID tracking," or "CTA attribution." For traffic insights, use traffic-analysis.
When the user wants to promote via forums, communities, or invite users to join a community. Also use when the user mentions "forum promotion," "Indie Hacker," "Hacker News," "community growth," "Discord promotion," "vertical community," "brand encyclopedia," "Wikipedia," "Quora," "Reddit community," "community building," "forum marketing," or "community invite." For Reddit copy, use reddit-posts. For strategy, use integrated-marketing.
When the user wants to submit a product or app to directories, curated lists, launch platforms, or app stores—and needs ready-to-paste copy per platform. Reads project-context.md when present. Also use when the user mentions "directory submission," "get listed," "app store listing," "submit to directories," "curated list," "best tools list," "Taaft," "Product Hunt," "directory ads," "newsletter feature," "directory campaign," "tailor description per platform," "Shopify App Store," "Chrome Web Store," "navigation site," or "product directory." For Product Hunt launch day tactics (hunter, first comment, timing), use product-hunt-launch. For full 0→1 channel planning, use cold-start-strategy.
When the user wants to launch on Product Hunt, prepare a PH submission, or plan launch day (hunter, first comment, timing, upvotes). Also use when the user mentions "Product Hunt," "launch on Product Hunt," "PH launch," "Product Hunt submission," "hunter," "Product of the Day," "upvotes," or "Product Hunt first comment." For multi-platform directory listings and paste-ready copy beyond PH, use directory-submission.