AI Prompts for a Privacy Policy: Write Down What You Actually Do

Most small sites have the same story behind their privacy page: someone typed "write a privacy policy for my website" into a chat and pasted the answer. That is also why AI prompts for a privacy policy only work after the boring part is done - the facts.

The text sounds right: dense, numbered, full of user rights. It also describes a company that is not yours - affiliates you do not have, a data protection officer who does not exist, retention "as long as necessary", cookies the site never sets. A policy is not legal filler: it is a description of what you do with other people's data, and readers treat it as a claim. The order that works: inventory first, prose second, contradiction test last.

What AI Prompts for a Privacy Policy Can and Cannot Supply

The Model Writes the Shape, You Supply the Facts

A model is good at structure and wording: sensible order, short sentences, neutral tone, rights in familiar language. It cannot know what you collect. Every useful section answers a question about your operation, and those answers live in your form, your inbox, and your payment gateway. Ask for a retention clause and you get a placeholder number inside a well-formed sentence. Ask for third parties and you get "service providers", a category rather than a disclosure.

The Text Is Read as a Description of the Business

Regulators treat a policy as a statement of fact, not boilerplate, and they read it alongside everything else the site says - marketing pages, checkout, support replies. A recent enforcement action in the United States made that point from the other side: the agency assessed the company's privacy representations as a whole, not the policy page alone. You are not filling a checkbox. You are writing down what happens to the data.

Three Clauses That Describe a Company That Is Not Yours

• "We do not sell personal data" - next to an advertising pixel that shares visitor identifiers.
• "We retain data only as long as necessary" - while the inbox keeps every email forever.
• "We share data with service providers" - with no categories, while hosting, email, analytics, and an AI tool all sit in the flow.

Each is half true, and the missing half is the half that matters. None is fixed by a better adjective; they are fixed by a row in a table you have not built yet.

Step 1 - Fill the Data Inventory Before You Open a Chat

Six Columns, One Row per Collection Point

Build the table by hand before writing a line of policy text. One row per place data enters, six columns:

1. What data is collected - email, name, phone, card details, IP, message body.
2. Which door it comes through - form, checkout, booking, newsletter, cookies, logs.
3. What it is used for - answering, shipping, billing, measuring.
4. Where it ends up - inbox, CRM, spreadsheet, payment processor.
5. Who else sees it - hosting, email, analytics, the AI assistant you paste into.
6. How long it is kept, and who deletes it.

If a row cannot be completed, that section cannot be written yet. The inventory is boring and takes an afternoon, but it is the only part the model cannot do, and the same table answers the app store questionnaire and the first question in a lawyer consultation.

The Row People Forget

If a customer email, a CV, or a support ticket gets pasted into a chat to be summarized or translated, that text left your system and entered a third-party service. It is a row like any other, and it belongs where readers expect to see who receives their data. A policy without it describes a workflow that no longer exists. The refund window works the same way: the only sentence that carries weight is the term and the condition - how many days, from when, what is refunded and what is not. The model can phrase it warmly; it cannot choose the number.

Step 2 - The Plain-Language Pass

What the Pass Changes

Legal text to plain language rewrites dense policy prose so a reader without legal training can follow it: shorter sentences, jargon replaced, same paragraph order, meaning intact. It is the pass for the public version. Run it once the facts are in, because simplifying a document that already states the wrong facts only makes them easier to read.

What It Must Not Touch

Names, dates, and numbers are preserved exactly, and that is the test to run: compare the before and after figure by figure - refund window, retention period, contact address. If one number moved, the pass failed. Clear language is not a style preference; where transparency rules apply they ask for information that is concise, intelligible, and easy to access, in clear and plain language.

The [AMBIGUOUS] Flag Is the Work

The prompt marks unclear passages instead of quietly fixing them. Every flag is a pending decision: rewrite it with the real fact from the inventory, or delete the section. A policy with ten open flags is ready for the meeting where those decisions get made, not for publication.

Step 3 - Audit the Terms You Copied

Clause Map, Red Flags, Numbers

Most small businesses download a template and change the company name. That template is a third-party commercial document, which makes it a valid input for the Claude Contract Redline Assistant. It returns five blocks: what each clause group means in plain language, red flags by severity with the section reference, a table of every amount and deadline, five concrete changes, and a verdict. For terms of service, the groups that matter are payment, content ownership, termination, and liability.

Missing Beats Present

The most useful part is what is not there: no cancellation clause, no liability cap, no governing law, no complaint process. A template is recognizable by the sections it omits.

What the Verdict Cannot Mean

The prompt does not decide whether a clause is enforceable where you operate, and it does not certify compliance; it carries its own disclaimer that the user is not a lawyer. It is preparation, so you arrive at a consultation with a clause map, a numbers table, and five specific questions instead of a vague worry.

Step 4 - Make the Three Pages Agree

The Contradiction Test

Put the privacy page, the terms, and the refund page in three columns and compare only sentences with a number or a promise: refund window, how to cancel, response time, what happens to data when an account closes, who is the controller. Any pair of cells that disagrees is a problem with the site, not with the reader.

The Deletion Promise

"You can ask us to delete your data" is the most repeated sentence in the genre and the least operated one. If the data also lives in the CRM, the email provider, and the backups, the sentence has to say how far deletion reaches and within what period. Writing the limit beats promising an erasure nobody executes.

The Store and Platform Row

If you distribute an app through a marketplace the page stops being optional: the listing requires a privacy policy URL and a separate privacy questionnaire, and the current user privacy guidance is what to re-check before each release, because the questionnaire has to tell the same story as the page.

When the Answer Is a Lawyer and Not a Prompt

The Three Signals

Three situations leave prompt territory: health or financial data, data belonging to minors, or users in the European Union and the United Kingdom where specific transparency duties apply. Add employees in the flow or a regulated sector and the same applies. The prompts still help - inventory done, questions written, template audited - but they prepare the meeting instead of closing it.

The Transparency Duty in One Line

The UK regulator summarizes the right to be informed as the privacy notice itself: when, how, and what you must tell a person about the use of their information - the individual rights guidance walks through that duty. It names the three decisions the inventory answers.

What the Model Must Never Invent

Retention periods, refund windows, the tools that receive data, and any claim about selling data. These are facts about your business, and a generated sentence about them is a promise you have to keep. Write the inventory row first.

The order is the argument: inventory, prose, audit, cross-check. Once the facts are in, run the draft through Legal text to plain language, and put your terms template through the Claude Contract Redline Assistant before it reaches a lawyer. A privacy policy is written after the inventory, never before it.