Draft a Privacy Policy and Terms Page for Your Site

What does this setup do?

Draft a privacy policy and terms of service that match what your site actually does, structured so a lawyer can review them fast.

Who is it for?

Site owners who need policy pages before launch. This is not legal advice; a lawyer must review the final pages.

How do you set it up?

Tools

• ChatGPT or Claude (free tier is fine)
• A list of every kind of data your site collects (forms, analytics, cookies, payments)
• A lawyer for review before publishing

Steps

1. Inventory your data first: list everything you collect, why you collect it, and who else sees it. The FTC’s first principle is to take stock of what personal information you have.
2. Cut anything you do not need. Keeping only what you need is both safer and easier to disclose.
3. Draft the privacy policy sections: who you are, what you collect, how and why you use each category, who you share it with, user rights, cookies, security, retention, and children’s privacy.
4. Draft the terms sections: acceptable use, intellectual property, user content, limitation of liability, termination, and governing law.
5. Add a visible last-updated date to the privacy policy.
6. Use clickwrap for terms: a checkbox or button where users affirmatively agree, which courts favor over a passive link.
7. Have a lawyer review both pages against your actual practices, then publish and update them whenever your billing, features, or data practices change.

Help me draft a privacy policy and terms of service for my website. These are DRAFTS for a lawyer to review, not final legal documents.

What my site does: [one paragraph]
Data I collect: [forms, analytics, cookies, payments, accounts: be specific]
Third parties who see data: [analytics provider, payment processor, email tool, etc.]
Do I serve children under 13: [yes/no]
State or country: [location]

Rules:
- Privacy policy sections: business identity and scope, categories of data collected, how and why each is used, sharing and third parties, user rights, cookies and tracking, security, retention, children’s privacy, last-updated date.
- Terms sections: acceptable use, intellectual property, user-generated content, limitation of liability, termination, governing law.
- Describe only what I listed. Do not invent data practices.
- Flag every section a lawyer must customize with "[LAWYER REVIEW]".
- End with: "Have an attorney review and tailor these to your actual business practices before publishing."

Review the drafts before sending them to a lawyer.

Which chat tools work with this prompt?

Paste the prompt into any of these assistants (free or paid tiers).

• ChatGPT
• Claude

What tips make it smoother?

• The policy must describe what you actually do. A misleading privacy policy can be treated as a deceptive practice under the FTC Act.
• Keep sensitive data only as long as you have a business reason for it, then dispose of it properly.
• Update both pages when you change billing, features, or territories. Stale terms drift out of sync with your product.
• Copying a competitor’s terms does not protect you. Only an attorney can tailor terms to how your business actually operates.

Where do the claims come from?

Summaries use public sources linked below, not independent verification. How setups are picked.

• Read Federal Trade Commission’s write-up (www.ftc.gov)

  Federal Trade Commission: Five data-security principles: take stock, scale down, lock it, pitch it, plan ahead; keep sensitive data only as long as needed.

• Read LegalClarity’s write-up (legalclarity.org)

  LegalClarity: Section-by-section list of what a privacy policy must cover; misleading policies as deceptive practice under FTC Act Section 5.

• Read Gouchev Law’s write-up (gouchevlaw.com)

  Gouchev Law: Only an attorney can tailor terms to actual business practices; update terms when billing, features, or territories change.