# Legal Policy Generator MCP integration for Codex and Claude > Production Streamable HTTP MCP tools for Codex, Claude Code, and AI agents. Legal text remains deterministic and repository-owned; runtime AI does not write clauses. ## Endpoint - MCP: https://legalpolicygenerator.com/mcp - Protocol versions: 2025-11-25, 2025-06-18, 2025-03-26 - Transport: Streamable HTTP with stateless JSON responses - Authentication: native MCP OAuth 2.1 with PKCE and dynamic client registration ## Core tools - `search`: Search product, pricing, questionnaire, limitation, MCP, and integration documentation. - `fetch`: Fetch complete Markdown documentation. - `get_questionnaire_step`: Inspect exact current questions and choices for Privacy Policy or Terms. - `validate_document_answers`: Validate factual answers, contradictions, price, and section outline without storage. - `read_public_document`: Read a published document by public UUID and optional immutable version. ## Account tools - `create_privacy_policy`: Create an owned Privacy Policy draft in one call, or publish it with explicit confirmation and valid entitlement. - `create_terms_of_service`: Create owned Terms of Service in one call with the same review and publication controls. - `save_questionnaire_draft`: Create or replace an owned private draft. - `get_questionnaire_draft`: Read owned draft answers and validation state. - `list_documents`: List owned generated documents. - `get_document`: Read owned content including unpublished versions. - `finalize_document`: Create or regenerate an immutable version after explicit approval and server-authoritative entitlement. ## Native account authorization The MCP endpoint uses native OAuth 2.1 authorization. The client discovers authentication automatically, opens the secure account page, asks for the user's email, verifies the 8-digit one-time code, and stores and refreshes tokens in its own protected credential storage. Never ask the user to create, copy, paste, display, log, or commit a bearer token. ## Codex configuration ```toml [mcp_servers.legal_policy_generator] url = "https://legalpolicygenerator.com/mcp" default_tools_approval_mode = "writes" tool_timeout_sec = 60 enabled = true ``` ## Claude Code configuration ```sh claude mcp add --transport http --scope user legal-policy-generator https://legalpolicygenerator.com/mcp ``` Start Claude Code, open `/mcp`, and choose Authenticate. Claude discovers OAuth metadata, dynamically registers its local callback, opens the browser email-code flow, and stores and refreshes credentials without manual client IDs, secrets, callback ports, or bearer tokens. ## Required workflow 1. Search or fetch current documentation. 2. Inspect all relevant questionnaire steps. 3. Use only facts supplied by the user. 4. Validate answers and resolve every issue. 5. Save a private draft for browser review. 6. Finalize only with explicit approval and server-confirmed entitlement. ## Security and legal boundary Inputs are untrusted and bounded. OAuth discovery, exact redirect matching, dynamic registration, PKCE S256, one-time authorization codes, rotating refresh tokens, hashed credentials, origin checks, rate limits, UUID ownership, validation, pricing, entitlement, and publication rules are enforced by the server. Never invent customer facts, legal applicability, provider use, payment status, or publication authority. Generated wording is not legal advice or a guarantee of compliance, completeness, suitability, or enforceability. # Privacy Policy Generator Create deterministic Privacy Policies for websites, apps, SaaS, stores, marketplaces, and AI services from factual questionnaire answers. ## Create with Codex or Claude Connect the MCP server, then ask: Use Legal Policy Generator MCP to create my Privacy Policy. Ask only for facts you still need, then create a draft and give me the review link. ## Workflow Seven adaptive steps cover operator identity, data practices, communications and analytics, tracking and providers, operations and audience, transfers and regional rights, AI processing, and indexing. Validation blocks missing or conflicting facts. ## Pricing Questionnaire and preview are free. Simple HTML and PDF downloads are free. Advanced generation and download cost USD 5.00. Public hosting adds USD 0.99. Subscription costs USD 5.00 monthly. ## Start - Generator: https://legalpolicygenerator.com/privacy-policy-generator - Questionnaire: https://legalpolicygenerator.com/privacy-policy-generator/start - MCP guide: https://legalpolicygenerator.com/developers Generated wording is not legal advice or a guarantee of compliance, completeness, or suitability. # Terms of Service Generator Create deterministic Terms of Service for websites, apps, SaaS, stores, marketplaces, APIs, and communities from factual questionnaire answers. ## Create with Codex or Claude Connect the MCP server, then ask: Use Legal Policy Generator MCP to create my Terms of Service. Ask only for facts you still need, then create a draft and give me the review link. ## Workflow Seven adaptive steps cover operator identity, service and users, content and intellectual property, payments and subscriptions, acceptable use and termination, jurisdictions and disputes, and changes and indexing. Validation blocks missing or conflicting facts. ## Pricing Questionnaire and preview are free. Simple HTML and PDF downloads are free. Advanced generation and download cost USD 5.00. Public hosting adds USD 0.99. Subscription costs USD 5.00 monthly. ## Start - Generator: https://legalpolicygenerator.com/terms-of-service-generator - Questionnaire: https://legalpolicygenerator.com/terms-of-service-generator/start - MCP guide: https://legalpolicygenerator.com/developers Generated wording is not legal advice or a guarantee of enforceability or compliance. # Legal Policy Generator resources Practical guides for collecting accurate facts before creating a privacy policy or Terms document. - [Do I need a privacy policy?](https://legalpolicygenerator.com/resources/do-i-need-a-privacy-policy.md): Learn which collection, tracking, platform, contract, and regional facts commonly require or justify a privacy policy. - [What should a privacy policy include?](https://legalpolicygenerator.com/resources/what-should-a-privacy-policy-include.md): Review essential privacy-policy sections from scope and collection through recipients, retention, rights, and contact. - [Website versus application privacy policies](https://legalpolicygenerator.com/resources/website-vs-app-privacy-policies.md): Compare privacy-policy facts for websites and applications, including cookies, permissions, SDKs, stores, identifiers, and deletion. - [GDPR privacy-policy requirements](https://legalpolicygenerator.com/resources/gdpr-privacy-policy-requirements.md): Understand transparent GDPR notice elements including controllers, purposes, bases, recipients, transfers, retention, and rights. - [CCPA and CPRA disclosures](https://legalpolicygenerator.com/resources/ccpa-cpra-disclosures.md): Understand California categories, purposes, retention, sale and sharing, sensitive information, requests, agents, and GPC. - [Analytics privacy disclosures](https://legalpolicygenerator.com/resources/analytics-privacy-disclosures.md): Explain analytics providers, identifiers, events, purposes, retention, consent, transfers, and privacy controls accurately. - [Advertising privacy disclosures](https://legalpolicygenerator.com/resources/advertising-privacy-disclosures.md): Explain contextual, personalized, retargeting, conversion, pixel, and advertising-identifier processing in a privacy policy. - [Stripe privacy disclosures](https://legalpolicygenerator.com/resources/stripe-privacy-disclosures.md): Describe the difference between Stripe card processing and billing records retained by a product operator. - [Firebase privacy disclosures](https://legalpolicygenerator.com/resources/firebase-privacy-disclosures.md): Review Firebase authentication, analytics, crash, messaging, hosting, database, and device data disclosures. - [AI product privacy disclosures](https://legalpolicygenerator.com/resources/ai-product-privacy-disclosures.md): Plan transparent disclosures for prompts, outputs, providers, logs, model training, human review, and automated decisions. - [Publishing a policy for Google Play](https://legalpolicygenerator.com/resources/google-play-privacy-policy.md): Align a public privacy policy with Google Play Data safety, SDK behavior, permissions, and account deletion. - [Publishing a policy for the Apple App Store](https://legalpolicygenerator.com/resources/apple-app-store-privacy-policy.md): Align a public policy with Apple App Privacy labels, permissions, tracking, SDKs, and account deletion. # Free Privacy Policy Generator > Answer a free guided questionnaire and download a simple policy free, with optional $0.99 public hosting. The questionnaire and tailored preview cost nothing. When no premium jurisdiction or advanced optional module applies, standalone HTML and professional PDF downloads are also free. Canonical URL: https://legalpolicygenerator.com/free-privacy-policy-generator ## What is free All branching questions, validation, contradiction checks, policy outline, generated preview, price calculation, and simple-policy downloads are available without payment. ## What simple hosting includes A verified $0.99 purchase stores an immutable version and publishes a public UUID link. Downloading the same simple document does not require hosting payment. ## Why facts still matter Free does not mean generic: platform, provider, tracking, audience, transfer, and regional answers control which clauses appear. Advanced generation remains $5, and public hosting adds $0.99. ## Common questions ### Is the final policy free? A simple policy without premium jurisdictions or advanced optional modules can be downloaded free. Public hosting costs $0.99 once for simple and advanced policies. Advanced generation and downloads cost $5, making an advanced hosted policy $5.99. ### Does it use AI to write my policy? No runtime language model writes policies. A versioned static clause library produces deterministic wording. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Website Privacy Policy Generator > Generate a website privacy policy covering forms, accounts, cookies, analytics, advertising, email, and service providers. Website notices need to connect visible collection, background technical processing, tracking choices, and outside providers in one readable disclosure. Canonical URL: https://legalpolicygenerator.com/website-privacy-policy-generator ## Map every collection point Include contact forms, newsletters, checkouts, accounts, server logs, embedded media, and browser storage rather than describing only data a visitor types. ## Separate essential and optional tracking State which storage keeps the site secure and which analytics or advertising tools wait for consent or offer an opt-out. ## Keep provider wording accurate Name selected hosting, email, payment, analytics, social, captcha, and support services without copying irrelevant template clauses. ## Common questions ### Does every website need a privacy policy? A policy is commonly needed when a site collects personal information, uses tracking, serves regulated residents, or must satisfy a provider or platform rule. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # App Privacy Policy Generator > Create an app privacy policy for accounts, device data, permissions, notifications, analytics, payments, and deletion. Applications often process identifiers, diagnostics, permissions, account content, and store purchase records across the device, backend, and integrated SDKs. Canonical URL: https://legalpolicygenerator.com/app-privacy-policy-generator ## Describe device capabilities Location, camera, microphone, contacts, notifications, and device identifiers require factual disclosure only when the app uses them. ## Connect SDKs to purposes Analytics, crash reporting, authentication, advertising, and communication SDKs should be tied to data categories and actual purposes. ## Explain deletion paths Users and app-review teams need a practical account and data deletion method, including records retained for fraud, payment, or legal needs. ## Common questions ### Should iOS and Android have separate policies? Usually one policy can cover both when practices match. Separate platform wording is useful only when an integration or data practice differs. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Mobile App Privacy Policy Generator > Build mobile app privacy wording for permissions, mobile identifiers, app stores, SDKs, children, and regional rights. Mobile distribution adds permission prompts, app-store disclosures, advertising identifiers, background diagnostics, and platform account relationships to ordinary privacy questions. Canonical URL: https://legalpolicygenerator.com/mobile-app-privacy-policy-generator ## Align policy and permission prompts The policy should explain the purpose behind each used capability, while the operating-system prompt requests access at the point it becomes relevant. ## Treat app stores independently Apple and Google may process store accounts, purchases, diagnostics, and review data under their own terms; describe only information the app operator receives. ## Review age and ads together Children, teenagers, personalized advertising, and precise location facts can change consent, SDK, and regional obligations. ## Common questions ### Can I use the public link in an app store? Yes. A published UUID policy is readable without authentication and defaults to noindex while remaining accessible to store reviewers. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # GDPR Privacy Policy Generator > Generate GDPR and UK GDPR privacy wording with purposes, legal bases, transfers, rights, sensitive data, and automated decisions. A GDPR notice needs more than a rights list. Each processing purpose should connect to data, source, recipient, retention approach, and legal basis. Canonical URL: https://legalpolicygenerator.com/gdpr-privacy-policy-generator ## Choose legal bases by purpose Contract, consent, legitimate interests, legal obligation, vital interests, and public task are not interchangeable labels. Record only bases supported by the processing context. ## State transfer facts without guessing A provider name alone does not establish adequacy or standard contractual clauses. Confirm the transfer and safeguard or state that the mechanism is not yet confirmed. ## Cover qualified rights Access, correction, erasure, restriction, portability, objection, withdrawal, and complaint rights depend on the processing and legal exceptions. ## Common questions ### When did GDPR begin to apply? The GDPR began to apply on May 25, 2018. ### Does generated wording guarantee GDPR compliance? No. Notices are one part of compliance; actual lawful processing, contracts, security, records, consent, and request handling must match the wording. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # CCPA Privacy Policy Generator > Create California privacy disclosures covering categories, purposes, sale or sharing, sensitive data, GPC, requests, and agents. California disclosure depends on whether the operator is a covered business, which categories it handles, and whether disclosures count as sale or sharing for cross-context advertising. Canonical URL: https://legalpolicygenerator.com/ccpa-privacy-policy-generator ## Test scope facts first Revenue, California consumer or household volume, and revenue from selling or sharing can determine CCPA scope, subject to definitions and exceptions. ## Separate service providers from sharing Contracted operational disclosure can differ from sale or sharing, but labels do not override actual recipient purpose or contract terms. ## Make opt-outs work If sale or sharing occurs, user-facing opt-out methods and recognized Global Privacy Control handling must match published wording. ## Common questions ### When did CCPA and CPRA apply? CCPA took effect January 1, 2020. CPRA amendments took effect January 1, 2023. ### Is targeted advertising always a sale? Definitions and facts vary, but cross-context behavioral advertising can be statutory sharing even without money changing hands. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # CalOPPA Privacy Policy Generator > Generate CalOPPA disclosures for collected categories, third parties, policy changes, effective date, Do Not Track, and third-party tracking. CalOPPA focuses on conspicuous online privacy disclosure, including collection categories, recipients, user review methods, policy changes, and tracking practices. Canonical URL: https://legalpolicygenerator.com/caloppa-privacy-policy-generator ## Cover website and app reach Commercial online services collecting information from California consumers can need the notice even when the operator is established elsewhere. ## State Do Not Track handling The 2013 amendment added disclosure about browser Do Not Track response and third-party collection over time and across services. ## Keep change procedures visible Explain how material changes are posted or otherwise notified and keep a real effective date on the published version. ## Common questions ### When did CalOPPA take effect? CalOPPA took effect July 1, 2004 and received relevant tracking-disclosure amendments in 2013. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # SaaS Privacy Policy Generator > Create SaaS privacy wording for customer accounts, end users, roles, processors, analytics, support, security, retention, and transfers. SaaS products can act as an independent operator for account and billing data while processing customer-controlled end-user content under contract. Canonical URL: https://legalpolicygenerator.com/saas-privacy-policy-generator ## Separate customer and end-user roles Explain which information supports the commercial relationship and which content is processed on a customer's instructions. ## Trace the operational stack Hosting, authentication, email, monitoring, support, payment, and analytics providers may receive different information for distinct purposes. ## Match deletion to tenancy Account closure, customer-configured retention, backups, legal holds, and security records should not collapse into one unrealistic deletion promise. ## Common questions ### Is a privacy policy the same as a data processing agreement? No. A public notice explains processing to individuals; a data processing agreement allocates controller and processor duties between organizations. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # E-commerce Privacy Policy Generator > Generate store privacy wording for checkout, payment providers, fulfillment, accounts, marketing, fraud, tax records, and advertising. Online stores join browsing and marketing data with order, delivery, support, fraud, and legally retained transaction records. Canonical URL: https://legalpolicygenerator.com/ecommerce-privacy-policy-generator ## Describe checkout roles State what the store receives and what Stripe, PayPal, app stores, or other payment providers process independently, especially full card details. ## Include fulfillment recipients Carriers, warehouses, suppliers, fraud services, tax tools, and customer support receive different order information for practical reasons. ## Balance deletion and records A customer may delete an account while invoices, tax records, disputes, chargebacks, and fraud indicators remain for justified periods. ## Common questions ### Should the store say it stores card data? Only when it directly stores full card details. Provider dashboards and transaction IDs usually are not direct full-card storage. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Small Business Privacy Policy Generator > Build a focused small-business privacy policy without irrelevant enterprise clauses or unsupported compliance claims. A useful small-business notice can be concise when it accurately covers forms, email, hosting, payments, analytics, retention, security, and request methods. Canonical URL: https://legalpolicygenerator.com/small-business-privacy-policy-generator ## Start with actual tools List the site builder, host, email, payment, analytics, scheduling, and support tools that receive customer or visitor information. ## Avoid broad promises Do not guarantee perfect security, instant deletion, or compliance everywhere. State restrained safeguards and workable request handling. ## Update when practices change Adding a newsletter, analytics tag, booking service, online checkout, or advertising pixel can require policy and consent changes. ## Common questions ### Can a small business use a short policy? Yes when processing is limited, but every legally and practically relevant fact still needs clear wording. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # AI Privacy Policy Generator > Generate AI product privacy disclosures for prompts, outputs, providers, retention, training, automated decisions, and opt-outs. AI features add specific questions about what leaves the product, how prompts and outputs persist, whether training occurs, and whether automated results affect people significantly. Canonical URL: https://legalpolicygenerator.com/ai-privacy-policy-generator ## Name the processing chain Identify the operator-facing feature and provider, the broad content sent, why it is sent, and whether provider processing occurs abroad. ## Distinguish service delivery from training Using a model to produce an answer is different from retaining submissions to improve or train models. Configuration and contract terms matter. ## Explain consequential decisions If AI contributes to legal or similarly significant decisions, describe available explanation, human review, contest, and opt-out routes where applicable. ## Common questions ### Does selecting OpenAI automatically prove a transfer safeguard? No. Provider selection can indicate processing, but the operator must separately confirm transfer locations and legal mechanisms. ### Can generated text make an AI system compliant? No. Governance, data minimization, contracts, testing, security, notices, rights, and actual system behavior must align. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Privacy Policy Template > Use a guided privacy policy template whose sections activate from your actual products, data, providers, purposes, and regions. A static template is a useful checklist but often leaves blanks, irrelevant clauses, contradictions, and disconnected regional add-ons. Guided generation resolves those problems before publication. Canonical URL: https://legalpolicygenerator.com/privacy-policy-template ## Core template structure A strong policy moves from scope and collection through sources, purposes, bases, tracking, providers, retention, security, audience, rights, changes, and contact. ## Conditional sections belong in context Payments, analytics, advertising, social, AI, transfers, and regional details should appear where readers expect them, not as random text at the end. ## Version the finished document Keep the answers, clause versions, rendered output, effective date, and immutable history so later edits are explainable. ## Common questions ### Will the output contain blanks? No. Final generation blocks when active clauses need missing information and never publishes placeholder tokens. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Privacy Policy for Google Play > Create a public app privacy policy for Google Play with accurate data, SDK, account deletion, security, and children disclosures. Google Play review expects a stable public notice that matches the app's data practices, permissions, SDKs, Data safety answers, and account deletion behavior. Canonical URL: https://legalpolicygenerator.com/privacy-policy-google-play ## Match Data safety answers Collected and shared categories, purposes, security claims, deletion, and optionality should agree across the store form, app behavior, and privacy policy. ## Use an accessible public URL The hosted policy opens without authentication and defaults to noindex, allowing reviewers and users to read it without adding customer policy pages to ordinary search results. ## Review SDK behavior Firebase, analytics, advertising, crash, authentication, and social SDK configurations can change what data is collected or shared. ## Common questions ### Can I submit a noindex policy to Google Play? Yes. Noindex affects search-result eligibility, not direct public access. Crawlers can read the page and its noindex directive. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Privacy Policy for Apple App Store > Generate an Apple App Store privacy policy aligned with app data, SDKs, tracking, permissions, accounts, and deletion. App Store privacy disclosures, permission prompts, tracking choices, and the linked public policy should describe the same implemented behavior. Canonical URL: https://legalpolicygenerator.com/privacy-policy-apple-app-store ## Align App Privacy labels Data linked to users, data used for tracking, diagnostics, purchases, location, contact information, and user content should be reviewed against SDK and backend behavior. ## Treat tracking precisely Advertising identifiers, cross-company data linkage, attribution, and retargeting require facts beyond ordinary first-party product analytics. ## Publish deletion details Apps offering account creation should provide a workable deletion route and explain justified retention after closure. ## Common questions ### Does the policy replace App Tracking Transparency? No. Platform permission and disclosure mechanisms remain separate operational requirements. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Do I need a privacy policy? > Learn which collection, tracking, platform, contract, and regional facts commonly require or justify a privacy policy. Need depends on actual information practices, audience, location, contracts, and distribution platforms, not only business size. Canonical URL: https://legalpolicygenerator.com/resources/do-i-need-a-privacy-policy ## Collection creates transparency duties Forms, accounts, payments, device identifiers, analytics, cookies, support, and server logs can all involve personal information. ## Platforms and providers set rules App stores, advertising networks, payment providers, and enterprise customers often require a public notice that matches integration behavior. ## Geographic laws can reach abroad Privacy laws may apply based on establishment, targeting, monitoring, resident data, business thresholds, or commercial reach. ## Common questions ### Does a brochure site need one? It may if it uses analytics, logs identifiable requests, embeds third parties, accepts forms, or reaches people protected by an applicable law. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # What should a privacy policy include? > Review essential privacy-policy sections from scope and collection through recipients, retention, rights, and contact. A policy should let a reader understand who processes information, what happens, why, with whom, for how long, and what choices exist. Canonical URL: https://legalpolicygenerator.com/resources/what-should-a-privacy-policy-include ## Identity, scope, and information Name the responsible operator and covered products, then describe categories and sources in language a normal user can recognize. ## Purposes, recipients, and storage Connect processing reasons to providers and recipient groups, international handling, retention logic, and restrained security measures. ## Choices, regional rights, and updates Give working request methods, applicable consent or opt-outs, age handling, effective date, change notice, and contact details. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Website versus application privacy policies > Compare privacy-policy facts for websites and applications, including cookies, permissions, SDKs, stores, identifiers, and deletion. Both formats need the same transparency foundation, but their collection surfaces and distribution constraints differ. Canonical URL: https://legalpolicygenerator.com/resources/website-vs-app-privacy-policies ## Websites emphasize browser context Cookies, pixels, embedded content, forms, server requests, and browser consent controls are common website disclosures. ## Apps emphasize device and platform context Permissions, SDKs, advertising identifiers, notifications, diagnostics, store purchases, and background operation are common app facts. ## One policy can cover both A combined document works when it clearly identifies shared and platform-specific practices without implying unused integrations. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # GDPR privacy-policy requirements > Understand transparent GDPR notice elements including controllers, purposes, bases, recipients, transfers, retention, and rights. GDPR transparency requires concise, intelligible, accessible information that reflects processing rather than a copied rights catalogue. Canonical URL: https://legalpolicygenerator.com/resources/gdpr-privacy-policy-requirements ## Article 13 and 14 context matters Required detail differs depending on whether information comes from the person or another source, and includes identity, purposes, bases, recipients, retention, and rights. ## Legitimate interests need substance When relied on, name the interests and assess necessity and balancing rather than using the phrase as a universal basis. ## Changes require operational follow-through A published notice must match records, contracts, security, consent, transfer mechanisms, and request handling. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # CCPA and CPRA disclosures > Understand California categories, purposes, retention, sale and sharing, sensitive information, requests, agents, and GPC. California notices use defined information categories and require facts about collection, use, disclosure, retention, sale, sharing, and consumer rights. Canonical URL: https://legalpolicygenerator.com/resources/ccpa-cpra-disclosures ## Use statutory categories carefully Map real data to categories instead of claiming every possible type. Keep the lookback disclosure and current collection practices aligned. ## Sale and sharing need separate analysis Cross-context behavioral advertising may be sharing even without a monetary transaction; provider or contractor exceptions depend on facts and contracts. ## Request methods must function Verification, authorized agents, correction, deletion, disclosure, opt-out, limitation, appeal where relevant, and GPC handling need operational support. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Analytics privacy disclosures > Explain analytics providers, identifiers, events, purposes, retention, consent, transfers, and privacy controls accurately. Analytics ranges from aggregate privacy-focused counts to user-linked cross-service measurement. The policy should describe the configured tier, not the provider's entire feature set. Canonical URL: https://legalpolicygenerator.com/resources/analytics-privacy-disclosures ## Identify data and purpose Common inputs include page or screen events, device details, approximate location, account identifiers, session identifiers, and errors. ## Review configuration IP handling, user-ID features, advertising signals, retention, consent mode, session replay, and provider data-use settings can materially change wording. ## Connect consent and opt-outs Browser consent, app permissions, provider opt-outs, account settings, and regional rights should match when analytics starts. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Advertising privacy disclosures > Explain contextual, personalized, retargeting, conversion, pixel, and advertising-identifier processing in a privacy policy. Advertising disclosure should separate contextual delivery from profiling, retargeting, conversion measurement, and cross-context data sharing. Canonical URL: https://legalpolicygenerator.com/resources/advertising-privacy-disclosures ## Describe tracking inputs Pixels, cookies, mobile advertising identifiers, hashed contact details, page events, purchases, and inferred audiences can support different advertising purposes. ## Address sale and sharing Applicable US laws may treat some advertising disclosures as sale or sharing, triggering opt-out links and Global Privacy Control handling. ## Keep consent implementation aligned Where prior consent is required, tags and SDKs must remain inactive until the choice is recorded and remain changeable later. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Stripe privacy disclosures > Describe the difference between Stripe card processing and billing records retained by a product operator. Stripe can process payment credentials, identity, transaction, device, and fraud information while the merchant keeps order, customer, tax, and payment-status records. Canonical URL: https://legalpolicygenerator.com/resources/stripe-privacy-disclosures ## Do not claim card storage inaccurately When Stripe-hosted Checkout collects the card, the merchant generally should state that Stripe handles full card details rather than implying they are stored in its database. ## Disclose operational records Checkout Session, customer, payment, subscription, refund, dispute, amount, currency, billing email, and tax metadata can remain necessary for service and legal purposes. ## Explain independent processing Stripe publishes its own privacy terms and may process information for security, fraud, compliance, and service operation under roles determined by context. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Firebase privacy disclosures > Review Firebase authentication, analytics, crash, messaging, hosting, database, and device data disclosures. Firebase is a product family. Privacy wording must identify configured services because Authentication, Analytics, Crashlytics, Cloud Messaging, Hosting, and databases process different information. Canonical URL: https://legalpolicygenerator.com/resources/firebase-privacy-disclosures ## Name enabled products Do not copy a universal Firebase paragraph. Map each enabled product to identifiers, events, diagnostics, messages, account details, or hosted content. ## Review identifiers and retention Analytics identifiers, installation IDs, crash traces, messaging tokens, logs, and developer-selected retention controls affect the notice. ## Check regional transfers Cloud region choices and provider terms inform but do not automatically prove a legal transfer mechanism. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # AI product privacy disclosures > Plan transparent disclosures for prompts, outputs, providers, logs, model training, human review, and automated decisions. AI transparency starts with the user content and metadata crossing each system boundary, plus the decisions made about retention and secondary use. Canonical URL: https://legalpolicygenerator.com/resources/ai-product-privacy-disclosures ## Trace prompts and outputs State which content is sent, whether files or conversation history are included, which provider receives it, and how long operator and provider copies persist. ## State training choices Distinguish inference, abuse monitoring, evaluation, feedback, fine-tuning, and general model training using actual contract and configuration facts. ## Provide controls for high impact Significant automated decisions may require explanation, human intervention, contest, consent, or opt-out mechanisms depending on law and context. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Publishing a policy for Google Play > Align a public privacy policy with Google Play Data safety, SDK behavior, permissions, and account deletion. Store reviewers and users should be able to open the policy directly and compare it with permissions, Data safety answers, and app behavior. Canonical URL: https://legalpolicygenerator.com/resources/google-play-privacy-policy ## Use a stable public link Avoid authentication, expiring file shares, or pages that require scripts to reveal the document. Keep prior versions available for records. ## Cross-check release changes Every SDK, permission, account feature, payment route, analytics setting, and deletion path introduced in a release should trigger privacy review. ## Test as a signed-out visitor Open the exact listing URL without cookies on phone and desktop, verify readability, and confirm contact and effective date. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability. # Publishing a policy for the Apple App Store > Align a public policy with Apple App Privacy labels, permissions, tracking, SDKs, and account deletion. The linked notice, App Privacy responses, permission purpose strings, App Tracking Transparency behavior, and actual data flows should tell one consistent story. Canonical URL: https://legalpolicygenerator.com/resources/apple-app-store-privacy-policy ## Review linked and tracking data Apple's disclosure vocabulary distinguishes data linked to identity and data used to track across other companies' apps or websites. ## Check provider SDK defaults Analytics, crash, authentication, advertising, attribution, and social SDK defaults can process more than the app's own interface suggests. ## Keep account choices reachable Account deletion and privacy request methods should work from the app or a clearly linked web route and explain justified retained records. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability.