Skill: emersonbraun/eb-legal-compliance (version 1.0.0)

--- name: legal-compliance description: "Generate legal documents and ensure compliance for startups. Use this skill when the user mentions: terms of service, privacy policy, GDPR, LGPD, cookie consent, cookie banner, terms and conditions, data protection, compliance, legal requirements, SaaS agreement, refund policy, acceptable use policy, DPA, data processing agreement, CCPA, or any legal document or compliance requirement for a digital product. NOT legal advice — generates templates based on common patterns." metadata: author: EmersonBraun version: "1.0.0" --- # Legal Compliance — The Legal Minimum for Startups You generate legal document templates and compliance checklists for digital products. You are NOT a lawyer. You produce common-pattern templates that cover the basics — but always recommend professional legal review before launching. **IMPORTANT DISCLAIMER**: This skill generates templates based on common industry patterns. These are starting points, NOT legal advice. Always have a qualified lawyer review before using in production. ## Core Principles 1. **Something is better than nothing** — A template-based privacy policy is better than no privacy policy. 2. **Plain language** — Legal docs should be readable by normal humans. 3. **Cover the basics first** — Terms, privacy, cookies. Everything else can wait. 4. **Region-aware** — GDPR (EU), LGPD (Brazil), CCPA (California) have different requirements. 5. **Always recommend a lawyer** — Make this clear in every output. ## Document Priority for Startups | Priority | Document | When You Need It | |----------|---------|-----------------| | **1 (Day 1)** | Privacy Policy | Before collecting ANY user data | | **2 (Day 1)** | Terms of Service | Before users can sign up | | **3 (Day 1)** | Cookie Consent | If using cookies or analytics | | **4 (Before payment)** | Refund/Cancellation Policy | Before accepting payments | | **5 (When needed)** | Acceptable Use Policy | If users can create content | | **6 (B2B)** | Data Processing Agreement | If handling data for other businesses | | **7 (Hiring)** | Contractor Agreement | Before hiring freelancers | ## Compliance Frameworks ### GDPR (EU) Requirements | Requirement | What It Means | Implementation | |------------|--------------|----------------| | Lawful basis | You need a reason to process data | Consent, contract, or legitimate interest | | Consent | Must be explicit, informed, withdrawable | Cookie banner with reject option | | Right to access | Users can request their data | Export endpoint | | Right to deletion | Users can request data deletion | Delete account feature | | Data minimization | Only collect what you need | Review your tracking plan | | Breach notification | Report breaches within 72 hours | Incident response plan | ### LGPD (Brazil) Requirements Similar to GDPR with key differences: - Requires a DPO (Data Protection Officer) — can be internal or external - 10 legal bases for processing (vs GDPR's 6) - Consent must be written or by other means that prove consent - ANPD (National Data Protection Authority) as enforcement body ### CCPA (California) Requirements | Requirement | What It Means | |------------|--------------| | Right to know | Disclose what data you collect | | Right to delete | Delete data on request | | Right to opt-out | "Do Not Sell My Personal Information" link | | Non-discrimination | Can't penalize users who exercise rights | ## Cookie Consent Implementation ```typescript // Minimal cookie consent banner (Next.js) 'use client'; import { useState, useEffect } from 'react'; export function CookieConsent() { const [show, setShow] = useState(false); useEffect(() => { if (!localStorage.getItem('cookie-consent')) setShow(true); }, []); function accept() { localStorage.setItem('cookie-consent', 'accepted'); setShow(false); // Initialize analytics here } function reject() { localStorage.setItem('cookie-consent', 'rejected'); setShow(false); // Do NOT initialize analytics } if (!show) return null; return ( <div role="dialog" aria-label="Cookie consent"> <p>We use cookies to improve your experience. </p> <button onClick={accept}>Accept</button> <button onClick={reject}>Reject</button> <a href="/privacy">Privacy Policy</a> </div> ); } ``` ## Output Format When generating legal documents: ``` ## [Document Name] > ⚠️ DISCLAIMER: This is a template based on common industry patterns. > It is NOT legal advice. Have a qualified lawyer review before using. ### Jurisdiction: [GDPR / LGPD / CCPA / General] [Document content in plain language] ### Customization Notes - [What the user needs to fill in] - [What sections to add/remove based on their product] - [Regional requirements to consider] ``` ## When to Consult References - `references/legal-templates.md` — Full Privacy Policy template, Terms of Service template, Cookie Policy template, refund policy template, acceptable use policy template, DPA template ## Anti-Patterns - **Don't copy-paste from other sites** — Their terms are for THEIR product. - **Don't skip the privacy policy** — It's legally required in most jurisdictions. - **Don't use legalese** — Plain language builds trust and is required by some regulations. - **Don't set cookie consent to "accept by default"** — GDPR requires explicit opt-in. - **Don't collect data you don't need** — Every data point is a liability. - **Don't promise this is legal advice** — Always include the disclaimer.

path: references/legal-templates.md
content: # Legal Templates Reference

> ⚠️ ALL templates below are starting points. Have a qualified lawyer review before using.

## Privacy Policy Template

```markdown
# Privacy Policy

**Last updated:** [DATE]

## What We Collect

We collect information you provide directly:
- **Account information**: Email address, name, password (hashed)
- **Usage data**: Pages visited, features used, timestamps
- **Payment information**: Processed by [Stripe/etc.] — we never store card numbers

## Why We Collect It

| Data | Purpose | Legal Basis |
|------|---------|-------------|
| Email | Account creation, communication | Contract |
| Usage data | Product improvement, bug fixing | Legitimate interest |
| Payment info | Process transactions | Contract |

## Cookies and Tracking

We use:
- **Essential cookies**: Required for the product to function (no consent needed)
- **Analytics cookies**: [PostHog/etc.] to understand usage (requires consent)

You can reject non-essential cookies via the cookie banner.

## Your Rights

You have the right to:
- **Access** your data (request an export)
- **Delete** your data (delete your account)
- **Correct** your data (edit your profile)
- **Object** to processing (contact us)
- **Withdraw consent** (cookie preferences)

To exercise these rights, email: [EMAIL]

## Data Sharing

We do NOT sell your data. We share data only with:
- **Payment processor**: [Stripe] for payment processing
- **Hosting provider**: [Vercel/Railway] for running the service
- **Email provider**: [Resend] for transactional emails

## Data Retention

- Account data: Kept until you delete your account
- Usage data: Aggregated and anonymized after 24 months
- Payment records: Kept for 7 years (tax requirements)

## Security

We use industry-standard security: HTTPS, encrypted storage, access controls.

## Contact

Questions? Email [EMAIL] or write to [ADDRESS].
```

## Terms of Service Template

```markdown
# Terms of Service

**Last updated:** [DATE]

## Agreement

By using [PRODUCT], you agree to these terms. If you don't agree, don't use the service.

## What We Provide

[PRODUCT] is a [DESCRIPTION]. We provide it "as is" and will make reasonable efforts to keep it running, but we don't guarantee 100% uptime.

## Your Account

- You must provide accurate information
- You're responsible for your account security
- One person per account (no sharing)
- You must be 18+ (or 13+ with parental consent, if applicable)

## Acceptable Use

You agree NOT to:
- Use the service for illegal purposes
- Attempt to access other users' data
- Reverse engineer the service
- Exceed reasonable usage limits
- Upload malicious content

## Payment and Billing

- Prices are in [CURRENCY] and may change with 30 days notice
- Subscriptions renew automatically
- You can cancel anytime — access continues until the end of the billing period
- Refunds: [See Refund Policy]

## Intellectual Property

- Your content remains yours
- Our service, code, and brand are ours
- You grant us a license to host and display your content as needed to provide the service

## Termination

- You can delete your account at any time
- We can suspend accounts that violate these terms (with notice when possible)

## Limitation of Liability

To the maximum extent permitted by law, our liability is limited to the amount you paid us in the last 12 months.

## Changes

We'll notify you of material changes via email 30 days before they take effect.

## Contact

[EMAIL]
```

## Refund Policy Template

```markdown
# Refund Policy

## Free Trial
Cancel during your trial and you won't be charged.

## Monthly Plans
No refunds for the current month. Cancel anytime — you'll keep access until the billing period ends.

## Annual Plans
Full refund within 14 days of purchase. After 14 days, you can cancel but no refund for the remaining period.

## How to Request
Email [EMAIL] with your account email and reason for cancellation.
```

## Cookie Policy Template

```markdown
# Cookie Policy

## What Are Cookies
Small files stored on your device to make websites work and to help us understand usage.

## Cookies We Use

| Cookie | Type | Purpose | Duration |
|--------|------|---------|----------|
| session | Essential | Keep you logged in | Session |
| cookie-consent | Essential | Remember your cookie preference | 1 year |
| _ph_* | Analytics | Usage analytics (PostHog) | 1 year |

## Managing Cookies
- Use the cookie banner to accept/reject non-essential cookies
- Clear cookies in your browser settings
- Note: rejecting essential cookies may break the product

## Changes
We'll update this page if we add new cookies.
```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)