Privacy Policy Drafter
A plain-language privacy policy that describes what your business collects, why, who sees it and how long you keep it, drafted from an interview so it matches how you work, and ready for a lawyer's hour instead of a lawyer's week
The problem
Your website has a privacy policy copied from a template in 2019, or one the web designer pasted from somewhere, or none. It mentions cookies you don't use and leaves out the booking tool that holds every customer's phone number. Canada's federal privacy law expects a business to be able to explain what personal information it collects and why, to get meaningful consent, and to keep information only as long as it's needed. Quebec's Law 25 adds a named person responsible for privacy and stricter rules on consent and tracking, and it applies the moment you have Quebec customers. A policy that describes a business you don't run protects nobody. This prompt interviews you and writes the one that describes yours.
The tool
You draft a plain-language privacy policy for a small business in
Canada. You start by asking questions, because a policy copied from a
template describes the wrong business. You write in short sentences a
customer can understand. You are not a lawyer, and the draft is for a
lawyer to review, not to replace one.
FIRST, INTERVIEW ME. Ask, in one message, about:
- What my business does and where my customers are (which provinces,
any in Quebec, any outside Canada).
- What personal information I collect, from whom, and how (website
forms, booking tool, point of sale, email list, phone, in person,
job applications).
- Why I collect each kind, and what I do with it.
- Which tools and services hold it (name them: booking, payments,
email marketing, accounting, cloud storage, analytics, chatbots,
AI assistants) and whether any are outside Canada.
- Who inside and outside the business can see it.
- How long I keep each kind, and whether I've ever deleted anything.
- Whether my website uses cookies, analytics or tracking pixels.
- Whether I send marketing email or text, and how people opt in.
- Who in the business is responsible for privacy today.
- How a customer could ask what I hold about them, or ask me to
correct or delete it.
THEN, FROM MY ANSWERS, WRITE THE POLICY with these sections, each in
plain words: what we collect and how; why we collect it; consent and
how to withdraw it; who we share it with (name the categories of
service providers and say where they store it); how long we keep it;
how we protect it; your rights (access, correction, deletion,
complaint) and how to use them; cookies and analytics, if any;
marketing messages and how to stop them; children, if relevant; the
person responsible for privacy and how to reach them; the date and
how we announce changes.
IF I HAVE QUEBEC CUSTOMERS, add: the named person responsible for
protection of personal information with their contact details, a
statement about tracking and profiling technologies and how to refuse
them, and a note that the French version prevails for Quebec
customers.
THEN GIVE ME:
- A LAWYER'S LIST: the five points in the draft most worth a lawyer's
review for my situation, and why.
- A GAP LIST: anything I said that the policy can't honestly promise
(for example, "we delete after two years" when I've never deleted
anything), with what to fix before publishing.
- A ONE-PARAGRAPH SHORT NOTICE for a form or a sign-up box.
RULES: Write only what I told you. Don't promise safeguards I don't
have. Don't quote legal sections or penalties. Keep the policy under
1,200 words.Publish the policy only after the gap list is empty; a policy that promises deletion you don't do is worse than one that admits you keep records for seven years for the accountant. The plan for the day the data leaks is the Cyber Incident Response Planner, and the rules for what staff may paste into an AI assistant live in the AI Usage Policy Writer, which the privacy policy should match.
How to use it
- 1Run the prompt and answer the interview in one sitting; the tools list is the part most owners get wrong, so open your subscriptions page while you do it.
- 2Read the draft against how the business works, not against how you'd like it to work.
- 3Fix the gap list: start deleting what you said you delete, name the privacy person, check the opt-in box on the email tool.
- 4Send the lawyer's list and the draft to a lawyer for one hour's review, and have the French version prepared if you have Quebec customers.
- 5Publish, date it, and re-run the interview when you add a tool or a province.
Example
A pilates studio in Gatineau with clients on both sides of the river runs the interview and learns three things about itself: the booking app stores data in the United States, the intake form asks about injuries (health information, kept in the same app), and nobody has ever deleted a former client's record. The draft names the owner as the person responsible, says where the data is stored, and explains the injury information in its own paragraph. The gap list says the two-year deletion the owner wanted to promise isn't true yet, so the policy says "we review and delete inactive records each January" and the owner puts it in the calendar. The lawyer's list leads with the health information and the Quebec requirements. The French version goes up first.
Pro tip
Name the tools. "Service providers" tells a customer nothing; "our booking system, Jane, which stores data in Canada" tells them what they'd want to know and makes you check it yourself. And keep the policy date honest: a policy dated 2019 on a site with a chatbot from 2026 tells a careful customer the rest wasn't checked either.
Related tools
Want this customized and automated for your business?
We take the tools in this toolbox and wire them into your business: your data, your brand voice, running on autopilot.
Talk to Vexlo