Pages: Legal

Guides legal page content, structure, compliance, and platform readiness for AI/SaaS products.

When invoking: On first use, if helpful, open with 1–2 sentences on what this skill covers and why it matters, then provide the main output. On subsequent use or when the user asks to skip, go directly to the main output.

Initial Assessment

Identify:

1. Product category: Free anonymous, free with account, freemium, subscription SaaS, enterprise/B2B, API/developer, marketplace/platform, e-commerce, content/media, mobile app, AI agent/MCP — see §Product Categories
2. Page type: Privacy Policy, Terms of Service, Cookie Policy, etc.
3. Jurisdiction needs: Which countries' laws apply — see §Jurisdiction Decision Framework
4. Indexing strategy: Index or noindex — see §Indexing Strategy
5. Platform dependencies: Which external platforms require these pages — see §Platform Dependencies

Product Categories

The legal page structure depends heavily on the product category. Identify which one applies before drafting:

Platform Dependencies

Many external platforms require posted Privacy Policy and/or Terms of Service before the product can be listed, advertised, or operate in compliance. These should be flagged to the user during generation.

Submission & Directory Platforms

Most AI tool directories, MCP/Skills marketplaces, and software directories require both Privacy Policy and Terms of Service to be publicly accessible before a listing can be approved. Common requirements across these platforms:

• Publicly linked Privacy Policy and Terms of Service
• No illegal, deceptive, or IP-infringing content
• Accurate, non-misleading product descriptions
• Submitter warrants ownership or authority to list
• Platform reserves right to reject or remove listings at discretion
• Often require a DMCA/copyright complaint contact

Advertising & Distribution Platforms

Infrastructure & Compliance

Jurisdiction Decision Framework

Use a three-layer approach to determine which laws apply:

Layer 1 — Operator location → determines primary governing law and venue in Terms.

Layer 2 — User locations → determines which privacy regulations apply and whether regional supplements are needed. If the product is accessible globally, assume GDPR (EU), CCPA (California), and the operator's home jurisdiction at minimum.

Layer 3 — Data storage location → determines data localization obligations. China (PIPL) and India (DPDP) may require local storage.

Major Privacy Regulations (2025–2026)

Regional Supplements Pattern

Follow the model used by leading AI platforms: one main policy covering universal practices, plus regional supplement sections for jurisdictions with unique requirements. At minimum, provide:

• EEA/UK Supplement: GDPR legal bases (Art. 6), data subject rights (Art. 15–22), SCCs for transfers, DPO/representative contacts, complaint to supervisory authority
• California Supplement: 11-category data collection table, right to know/delete/correct, "Do Not Sell or Share" statement, opt-out mechanisms

Other regional supplements (China, Brazil, India, etc.) should be added when the product has significant users in those jurisdictions.

Governing Law Patterns for Terms

Best Practices

Content Principles

• Clear language: Avoid legalese where possible; explain what data is collected and why in plain terms
• Structure: Headings, sections, table of contents; use tables for cookies and processors
• Updates: "Last updated" date prominently at the top; version number if needed
• Legal review: Recommend that a qualified lawyer review for jurisdiction-specific compliance

AI-Specific Content Requirements

These are mandatory disclosures for any product using AI models (generation, processing, or analysis):

In Privacy Policy:

1. Name the specific AI models used (e.g., Google Gemini, OpenAI GPT-4)
2. State whether submitted data is used for model training — if NOT, state this prominently as a trust signal
3. Disclose that generated output is probabilistic and may contain inaccuracies
4. Disclose that images are AI-generated, not photographs of real people/places

In Terms of Service:

1. Ownership of generated output (typically: user owns it, but AI-generated content may not qualify for copyright)
2. AI disclaimer: artifacts, mis-rendered text, hallucinated content; verify before publishing
3. User responsibility for verifying output before use
4. Third-party model providers' terms also apply to the user
5. Copyright ambiguity: generated content may inadvertently reproduce training data elements

Trust-Building Patterns (Recommended)

• "What we DON'T collect" section: For no-login tools, list what's NOT collected (accounts, passwords, payment, contacts) — this builds immediate trust
• "No training on your data": If using API-based AI (not consumer chat), state that data is not used for training — users assume the worst otherwise
• Retention by category: Be specific about what's deleted when, rather than vague "we keep data as needed"
• Cookie opt-out instructions: Don't just list cookies — tell users how to opt out of each one

Common Pitfalls

Indexing Strategy

Legal page indexing is not one-size-fits-all. The decision depends on the product's goals:

Default recommendation: Index both pages unless the product has a specific reason not to. The SEO cost of indexing two utility pages is negligible, and the platform-verification benefit of indexable legal pages is significant.

Placement

• Footer: Links to all legal pages on every route
• Consent flows: Cookie banner links to Privacy and Cookie Policy
• Sign-up / checkout: Link to Terms before commitment
• Contact forms: Link to Privacy near data submission points

Structure

Quick-reference section frameworks by page type:

Privacy Policy (14 sections for full coverage)

1. Who we are + contact
2. What the product does (one sentence)
3. Information we collect (with "What we DON'T collect" sub-section)
4. How we use information (with AI model training disclosure)
5. Cookies (table format: name | purpose | duration | how to opt out)
6. Third-party processors (each with privacy policy URL)
7. Data retention (per category)
8. Your rights (GDPR + CCPA + regional supplements)
9. International transfers
10. Children (COPPA/GDPR-K age thresholds)
11. Security
12. Changes
13. Contact (with response timeframe)
14. Regional supplements (EEA/UK, California, others as needed)

Terms of Service (18 sections for full coverage)

1. Agreement (using = accepting)
2. The service (what + fair-use limits if applicable)
3. Eligibility (age requirement)
4. No accounts (if applicable — anonymous use + user responsibility)
5. Acceptable use (prohibited content + prohibited behaviors)
6. Your content (ownership retained, limited license to process)
7. Generated output (ownership, commercial use, AI caveats)
8. AI disclaimer (probabilistic, verify before publishing)
9. Third-party services (model providers, their terms apply)
10. Free service / No SLA (if applicable — best-effort, can change)
11. Intellectual property (what the operator owns)
12. Termination
13. Disclaimer of warranties (AS-IS, all-caps)
14. Limitation of liability ($ cap + jurisdictional carve-out)
15. Indemnity
16. Governing law & venue (+ alternate forum if applicable)
17. Changes (continued use = acceptance)
18. Contact (+ DMCA/copyright complaint channel if US-hosted)

Cookie Policy

• What cookies are (brief explanation)
• Cookie table: name | type | purpose | duration | how to opt out
• Third-party cookies (GA4, etc.)
• How to manage/disable cookies in browser settings
• Notice vs consent: classify whether the site needs a notice or a consent banner

Output Format

For each legal page type, provide:

• Sections: Complete outline with all applicable sections
• Key points: What each section must cover, with specific language for critical clauses
• Product-category adjustments: Which sections to add or remove based on the product category
• Jurisdiction flags: Which sections need regional variants
• Platform readiness: Confirm the pages meet submission/advertising platform requirements
• Disclaimer: Recommend legal review before publishing

Related Skills

• privacy-page-generator: Privacy Policy page
• terms-page-generator: Terms of Service page
• cookie-policy-page-generator: Cookie Policy page
• indexing: Index/noindex strategy for legal pages
• title-tag, meta-description, page-metadata: Legal page metadata
• homepage-generator: Footer links to legal