Use this privacy policy generator for ecommerce when you need both policy copy and working pages. Compliance Pages inspects a website project, drafts privacy, terms, shipping and refund content from the store's facts, and helps add policy links and cookie-consent controls so the written promises can be checked against the site's behavior.
Compliance Pages starts with the website rather than a blank policy template. It examines the project, uses the merchant's business and data-handling facts to draft related policies, and can update navigation and consent-related script loading as part of the implementation.
Use it where a developer can review the changed files and test the controls. The worked example produced four policy types and tested consent choices in a simple site. A store theme, tag manager or existing consent app needs its own integration checks; generated pages are not legal certification.
Compliance Pages suits teams that can edit their storefront code and need policy pages implemented as well as written. It combines website inspection, policy drafting, navigation changes and cookie-consent controls, making it a better fit for a site project than for someone who only wants a paragraph to paste into an admin field.
One set of merchant facts supports privacy, terms, shipping and refund pages. Keep detailed delivery and return rules on their own pages and link them from the terms, making it easier to maintain consistent promises across the store.
The workflow can add policy navigation and consent controls rather than stopping at a statement about cookies. In the worked example, browser checks covered rejection, acceptance, saved preferences and withdrawal; those actions provide a useful implementation review checklist.
Review changed scripts and pages in a project copy before release. If the storefront already relies on a consent app or only allows policy-text edits, adapt the relevant content and retain the existing system's control of tracking rather than adding overlapping behavior.
Prepare the following business inputs and software before starting the workflow.
Prepare a source-code checkout with routes, payment and tracking integrations visible.
Prepare confirmed entity, contact details, commercial policies and target markets.
Prepare a clean branch, a build command and permission to review proposed content and layout edits.
Install the complete Skill package, then start with the merchant inputs listed above.
Copy this request into Codex or Claude Code. The assistant downloads the original repository at the specified commit, installs the complete files and checks required dependencies.
Install compliance-pages in the app I am using and carry out the file installation, not just explain it.
Original repository: https://github.com/mavens-tech-lab/skills.git
Commit: fc21ef60c6f1fc029589ed3bb15be7456b6695f9
Skill folder: compliance-pages
1. Download this exact source into a new directory. Read SKILL.md and its setup references before running any bundled scripts. Do not substitute another author’s package.
2. For Codex, use ~/.agents/skills/compliance-pages; for Claude Code, use ~/.claude/skills/compliance-pages. Install only for my current app. Install the complete Skill folder, including scripts, references, assets and bundled notices. Keep any root license with the installed folder. Check all destination folders first; if any already exist, report differences before replacing them.
3. Compare the source and installed file lists and hashes. Inspect documented runtimes, dependencies and required connections. Configure only the local dependencies needed for this Skill; use an isolated environment when appropriate. Ask me to complete any account login locally, without putting credentials in chat.
4. Report the source commit, actual installation path, file-check results and any remaining runtime setup. Explain how to invoke compliance-pages in this app. Check discovery separately from file copying; start a new session if needed. Do not run production tasks or claim a successful business outcome from installation alone.Starter prompts for the main use cases—copy and use them directly.
Generate a physical-goods shipping draft to produce a shipping page with regions, rates, timings and exception handling. A codebase scan and confirmed shipping facts.
Use compliance-pages with [INPUT]. Read the shipping reference, generate only the physical-goods shipping draft, and preserve [[FILL: ...]] for missing facts. Confirm customs responsibilities rather than defaulting them. Do not publish.[INPUT]Keep terms consistent with refunds to produce a terms draft linking policy sources and listing discrepancies. Confirmed refund rules, payment behavior and existing terms.
Use [INPUT] to refresh terms with compliance-pages. Preserve existing reviewed prose, link the authoritative refund and shipping policies, and report contradictions. Leave jurisdiction and disputed liability choices for confirmation.[INPUT]Audit tracking disclosures and consent to produce a vendor inventory, proposed disclosure changes and a browser test plan. Source files and a list of approved tracking vendors.
Scan [INPUT] with compliance-pages. List vendor hosts and load locations, compare them with privacy disclosures, and propose consent-gating changes. Keep edits in a separate branch and verify pre-consent network requests before claiming success.[INPUT]A four-file storefront sold mugs and towels to the US and Canada. It had a test Analytics tag but no policy pages or consent controls.
Case input files: business-inputs.zip
Use the compliance-pages Skill.
Prepare the attached storefront for a policy and consent review. Read its pages, scripts and merchant facts, then create privacy, terms, shipping and return pages with footer and checkout links. Preserve the contact page. Add reject, accept, preferences and withdrawal controls for optional analytics, and verify that analytics remains blocked until consent and after withdrawal. Deliver the revised site and a business-readable change report.
The attached business materials are:
- inputs/merchant.json
- inputs/storefront/store/checkout.html
- inputs/storefront/store/contact.html
- inputs/storefront/store/index.html
- inputs/storefront/store/styles.css
Deliver a complete result.md report that the operations team can read, plus any finished files needed for this task. Keep supporting calculations and evidence with the deliverables. Write the report in English; use the requested target language for customer-facing copy. The business datasets are fictional examples unless the brief explicitly names a live public website.The primary file produced by this prompt is shown below in its original language.
Created four complete policy review pages and integrated them into the supplied Cedar & Cart Demo storefront. Added privacy, terms, shipping and returns links to the homepage, checkout and policy footers; checkout now also links to shipping and refunds beside the form. The contact page remains byte-for-byte unchanged, including its fictional contact notice.
Optional Google analytics is now blocked until an affirmative choice. Visitors can reject all, accept all, customize the analytics category, reopen preferences from the footer and withdraw. Accept and reject use the same visual treatment. The analytics category starts off; a missing, expired, invalid or unsavable preference record keeps it off. Choices are held in browser storage for at most 180 days. Withdrawal records rejection, disables analytics events, clears accessible known analytics cookies, removes the script and reloads. It does not delete information already received by a third party.
Only the homepage contains an analytics loader. Checkout and policy pages expose consent controls without adding a new tracker. The preserved contact page has no analytics and remains untouched. This is an executable revised demonstration website, not a live store: checkout still creates no order or payment, no messages are sent, and G-TEST000000 is a test identifier.
| Check | Actual result |
|---|---|
| Before any choice, rejection and rejected reload | Zero Google script/collection requests |
| Accept analytics | Controlled Google-script substitute loaded and emitted the expected permitted event |
| Withdraw before reload | Tag removed, analytics disabled, accessible test cookies cleared and events blocked |
| After withdrawal and reload | No additional Google requests |
| Other tab changes / expired or invalid record | Choice synchronized; tracking stayed off as appropriate |
| Browser storage unavailable | Failed closed, including an attempted acceptance |
| Keyboard preferences and mobile layout | Focus behavior and 390 px layout checks passed |
| Integrated pages | All seven pages checked at 1440 px and 390 px: 14 page/viewport checks passed |
| Footer and checkout links | Local targets resolved successfully; six integrated pages had one footer preference control |
| Contact preservation | Exact byte equality with the supplied page |
The consent tests used an intercepted script that exercises loading, event dispatch and cookie cleanup without sending visitor data to Google. They establish browser control behavior, not a production analytics property's configuration, Google backend retention or legal compliance. The actual business-readable observations are in consent-checks.json and integration-checks.json.
US handling is 1–2 business days, preorder handling 5–7, with 3–5 business-day USPS transit after handoff. Shipping is $5.95 below $75 after discounts and free at $75 or more. Canada uses $18 UPS shipping with 7–12 business-day transit and seller-paid import duties/taxes. These are estimates, not holiday guarantees.
Returns use the supplied 30-day window, unused/original packaging condition and no restocking fee. Customer-paid change-of-mind postage and seller-paid confirmed-defect postage remain distinct. Refunds are processed after inspection using the stated 5–10-day period, interpreted with the merchant's general business-day definition and flagged for confirmation. Mandatory consumer rights are preserved. The test site has no payment provider or refund execution.
The four pages are complete review drafts with 16 explicitly named business fields. They do not invent a legal entity from a brand, a working privacy mailbox, a liability cap, hosting retention or a return address. Resolve those fields, confirm return dispatch/receipt deadlines, refund-day interpretation, cancellation and outbound-postage rules, then obtain the required legal review before real publication. policy-decisions.md lists every field and the supporting source. Cookie behavior is implemented and tested; business identity and jurisdiction cannot be proven by an interface test.
The site folder contains the revised homepage and checkout, preserved contact and stylesheet, four policy pages, and cookie-consent.js/css. Open the site through a normal web preview or hosting service to review navigation and consent storage. The archive also includes the two actual check reports and policy decision log. No live deployment was performed by this example.
The following text was read from the generated policy pages after browser integration checks. The HTML files in the package retain their working links, tables and controls.
Privacy Policy Review draft for a fictional store. This privacy policy was generated from an automated review of this site's code. It is a template, not legal advice — have it reviewed by a qualified attorney before relying on it.
Last updated: [[FILL: policy effective date]]
Who we are
Cedar & Cart Demo presents ceramic mugs and linen towels. Its operator is [[FILL: legal entity name]], at [[FILL: registered business address]]. This is a demonstration: the checkout preview creates no order or payment. Please use fictional information when testing it.
Information used by this demo Checkout entries: the email and delivery-address fields remain in the browser form. The checkout code prevents submission and does not send or save these entries. It has no order database or payment processor. Support: the contact link opens an email application. A message could contain your email address, order number and anything you choose to include. The supplied address, [email protected], is fictional and is not a working support or privacy-request channel. Technical information: a hosting provider may record IP addresses, browser information and requested pages to serve and protect the site. Hosting provider and logging arrangements: [[FILL: hosting provider and server-log practices]]. Optional analytics: if you accept analytics, the homepage loads a Google Analytics test tag from googletagmanager.com. That request reveals technical information such as your IP address and browser details to Google. The tag may send page and usage information and set analytics cookies. The test setup does not establish that a working analytics property receives events. Cookies and your choice
Google Analytics is the only optional service in this demo. It is blocked until you choose to allow analytics; rejecting it does not prevent use of the store preview. Analytics is limited to the homepage and is not loaded on checkout, contact or policy pages.
The essential preference record, cookie_consent, is saved in this browser's local storage so the site can remember your choice. It contains a version, choice date and necessary/analytics preferences, not checkout details. It is accepted for up to 180 days, then treated as expired on a later visit. It is not sent to a server by the consent controls. Browser settings may clear it earlier; if saving preferences is unavailable, analytics stays blocked.
Cookie preferences lets you change your choice or withdraw analytics consent. Withdrawal saves rejection, attempts to clear accessible Google Analytics cookies and reloads the page to stop the loaded tag. It blocks later analytics loads unless you consent again. It does not erase information already received by Google. Choices apply to this browser and site address; other browsers need their own choice.
Google describes its analytics cookie usage. The cookies actually set, their configured lifetimes and Google's backend retention have not been verified for this test setup.
Use, recipients and retention
Current purposes are displaying the preview, remembering privacy choices, optional homepage measurement and any hosting security logs. Google receives the optional analytics requests; the hosting provider may receive request logs. No payment, fulfillment or email service is connected. USPS and UPS are planned shipping carriers, not active data integrations.
For any future real store, customer information would be needed to fulfill orders and handle inquiries and returns. That processing is not implemented here; its vendors and information flows must be documented before real orders begin. Retention beyond the browser preference described above: [[FILL: privacy retention periods and deletion process for hosting logs, analytics and future support/order records]].
Security
The checkout code does not transmit your entries, but that is not a guarantee of security for your browser or any deployed hosting service. No transmission or storage method is completely secure. A real operator must establish appropriate safeguards before collecting customer information.
Your rights and contact
Where applicable law provides them, you may request access, correction or deletion of personal information and raise concerns about its use. For Canadian visitors, PIPEDA may provide access and correction rights, a way to challenge handling of personal information, and withdrawal of consent subject to legal or contractual restrictions and reasonable notice. See PIPEDA's privacy principles.
If the operator is covered by California's CCPA/CPRA, California residents may have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive information, and exercise rights without discrimination. See the California Attorney General's explanation. No advertising pixel or sale workflow was found in this demo; that finding does not certify Google's account settings or decide the operator's legal obligations.
A real request channel must be provided before launch: [[FILL: working privacy contact and request procedure]]. The existing support page contains only the fictional address. Legal applicability, including any obligations to visitors outside the intended US/Canada market, remains for review.
Changes
Updates will appear on this page with a revised date. Material changes to actual data handling should be explained before they take effect; new optional uses require a fresh choice.
Terms of Use Review draft for a fictional store. These terms were generated from an automated review of this site's code. They are a template, not legal advice — have them reviewed by a qualified attorney before relying on them.
Last updated: [[FILL: policy effective date]]
About these terms
These draft terms describe use of Cedar & Cart Demo, operated by [[FILL: legal entity name]]. By using the site, you agree to the terms once finalized and made effective. If you disagree, stop using it. This review draft does not represent an approved agreement.
This fictional storefront displays ceramic mugs and linen towels. Checkout only previews a message: it submits no order, takes no payment and creates no purchase contract. Use fictional details in the form. Prices are displayed in USD. The Shipping Policy and Returns & Refunds Policy describe the merchant's planned fulfillment terms; they govern those subjects if a real store is later launched under finalized terms.
Changes
The operator may update these terms and their date. Material changes will be identified on the site. Continued use after revised terms take effect constitutes acceptance to the extent permitted by law; changes will not remove rights that applicable law protects.
Permission to use the site
You receive limited, non-exclusive, revocable permission to view and use the site for its intended purpose. Do not scrape, reverse engineer or use automated access without permission, except where applicable law permits it. Do not use the site unlawfully, infringe others' rights, distribute malware, impersonate anyone, interfere with its operation or bypass security controls.
Content and third-party services
Site content and branding belong to the operator or the relevant rights holders. Permission to use the site does not transfer intellectual-property rights. Google provides optional homepage analytics, as described in the Privacy Policy; the support email link opens your own email application. Those third-party services have their own terms, and the operator does not control their availability or content.
Warranty disclaimer
TO THE EXTENT PERMITTED BY LAW, THIS DEMONSTRATION IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ACCURACY, AVAILABILITY, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. NOTHING HERE EXCLUDES A WARRANTY OR CONSUMER RIGHT THAT CANNOT LAWFULLY BE EXCLUDED.
Liability
TO THE EXTENT PERMITTED BY LAW, THE OPERATOR IS NOT LIABLE FOR INDIRECT OR CONSEQUENTIAL LOSSES ARISING FROM USE OF THE DEMO. ANY AGGREGATE LIABILITY CAP REQUIRES REVIEW: [[FILL: confirm liability cap; template proposal is the greater of USD 100 or amounts paid in the previous 12 months]]. SOME JURISDICTIONS DO NOT ALLOW THESE EXCLUSIONS OR LIMITS; THEY APPLY ONLY TO THE EXTENT LAWFUL AND DO NOT RESTRICT NON-WAIVABLE RIGHTS.
Misuse and access restrictions
To the extent permitted by applicable law, you agree to indemnify the operator for third-party claims resulting from your unlawful misuse or breach of these terms. The operator may suspend or end access for misuse or security reasons. Provisions that by their nature need to continue, including intellectual-property protections and applicable liability limits, survive termination.
Governing law and disputes
Governing law: [[FILL: governing law jurisdiction]]. Dispute venue: [[FILL: courts and venue]], subject to mandatory consumer protections. No arbitration agreement or class-action waiver is adopted in this draft.
General terms
If a provision is unenforceable, the remainder applies to the extent permitted by law. Once finalized, these terms and the policies they incorporate form the agreement about site use. Failure to enforce a provision does not waive it. The operator may assign this agreement only where lawful and without reducing mandatory consumer rights.
Contact and notices
The existing Support & contact page uses [email protected], a fictional address for testing. Before launch, supply [[FILL: working legal notice email and postal address]].
Shipping Policy Review draft for a fictional store. This shipping policy was generated from an automated review of this site's code and supplied merchant facts. It is a template, not legal advice — have it reviewed by a qualified attorney before relying on it.
Last updated: [[FILL: policy effective date]]
These are planned shipping terms for ceramic mugs and linen towels from Cedar & Cart Demo. The current checkout is a simulation; no orders are submitted and no parcels are shipped.
Where we plan to ship
Orders would ship from Austin, Texas, US, to the contiguous United States and Canada. No other destinations are offered in this draft. All amounts below are USD.
Planned shipping services and charges Destination Service Shipping charge Estimated transit after handoff PO boxes Contiguous US USPS Ground Advantage $5.95; free when the merchandise subtotal after discounts is $75 or more 3–5 business days Accepted Canada UPS Standard $18; no free-shipping offer 7–12 business days Not accepted Handling, transit and tracking
Allow 1–2 business days for handling in-stock orders or 5–7 business days for preorders, followed by the transit estimate above. Business days are Monday–Friday, excluding US federal holidays. These are estimates, not guaranteed delivery dates. Tracking would be emailed after the parcel is handed to the carrier.
No daily order cutoff or holiday delivery deadline has been confirmed. [[FILL: daily order cutoff, if any, and holiday delivery guidance]].
Canadian duties and taxes
Canadian shipments are planned on a delivered-duty-paid (DDP) basis: the seller pays import duties and taxes. These import charges are not assigned to the customer by this policy.
Address changes and cancellations
Request an address change before carrier handoff. Changes are not guaranteed. Order cancellation rules are not yet set: [[FILL: order cancellation cutoff and procedure]].
Damaged or missing parcels
For damage, contact support within 7 days of delivery with photos and the order number. Each remedy is reviewed individually; an automatic replacement is not promised. If the estimated transit window has passed, contact support so the carrier can be asked to investigate before a remedy is decided. These reporting guidelines do not limit any mandatory consumer rights.
See the Returns & Refunds Policy for return conditions and postage responsibility.
Contact
The Support & contact page lists [email protected], a fictional address for testing. Before accepting real orders, replace it with [[FILL: working shipping and returns support contact]].
Returns & Refunds Policy Review draft for a fictional store. This returns and refunds policy was generated from an automated review of this site's code and supplied merchant facts. It is a template, not legal advice — have it reviewed by a qualified attorney before relying on it.
Last updated: [[FILL: policy effective date]]
These are planned return terms for Cedar & Cart Demo's ceramic mugs and linen towels. This demo creates no purchases or payments, and has no connected payment processor. There is no real transaction to refund.
Return window and condition
For a future real order under these terms, request a return within 30 days after delivery. Change-of-mind items must be unused and in their original packaging. There is no restocking fee. These conditions do not remove rights or remedies that apply by law to faulty goods.
How to request a return
Contact support with the order number and reason for the return before sending the item, so return instructions can be provided. For damage, contact within 7 days of delivery and include photos and the order number. The remedy is reviewed individually, with no automatic replacement promise.
Return destination: [[FILL: authorized return address]]. The shipping origin in Austin is not a confirmed return address. Do not send goods until a return destination is supplied.
Postage and refunds
You pay return postage for a change-of-mind return. The seller pays return postage for a confirmed defect. After the returned item has been inspected and the refund approved, allow 5–10 business days for refund processing to the original payment method. Business days are Monday–Friday, excluding US federal holidays. The time for a payment provider to show the credit may be additional; no payment provider is connected to this demo.
Original outbound shipping charges: [[FILL: whether original shipping charges are refundable, including for confirmed defects]]. Any further return-shipping deadline after contacting support: [[FILL: confirm whether a separate return dispatch or receipt deadline applies]].
Cancellations and delivery issues
Order cancellation cutoff and procedure: [[FILL: order cancellation cutoff and procedure]]. Address changes may be requested before carrier handoff but are not guaranteed. For a missing parcel, contact support after the estimated transit window; the carrier must be consulted before the remedy is decided. See the Shipping Policy for the planned services and estimates.
For a future payment dispute, please contact support first if possible so the issue can be investigated. This request does not require you to give up any rights or deadlines with your payment provider.
Contact
The Support & contact page lists [email protected], a fictional address for testing. Before accepting real orders, supply [[FILL: working shipping and returns support contact]].
Merchant business data is synthetic. Website observations, when present, come from the public URLs listed in the report.
Review these limits before using generated files or estimates in your store.
The Skill can change page code and tracking-script loading; review those changes in a separate branch.
Our browser fixture simulated analytics; production integrations need their own check.
Fill in business identity, contact details and actual processing practices before publishing.
Understand which policy pages and consent controls your website needs, how to check them and how the workflow fits your platform.
In the local store case, it created privacy, terms, shipping and refund pages, then added navigation and checkout links. Start by listing which pages are missing and which existing pages should be preserved. Supply one shared set of business facts so the shipping charge, return window and support contact do not change from page to page.
The necessary disclosures depend on your business and markets; four generated pages are not a universal checklist for every store. Give the assistant any existing subscription, product-specific or regional policy requirements and identify who will review them. Its practical advantage is coordinating content with website files and links, rather than returning four disconnected text blocks.
A privacy policy describes the personal data your business handles. Cookie information focuses on storage or tracking used on a visitor's device. A consent banner is a control that records a visitor's choice and passes that choice to the relevant scripts; publishing policy text does not create that behavior.
Give Compliance Pages a list of forms, analytics, advertising tags and embedded services, plus the current script-loading code. Ask for the explanation and controls that match those actual services. The worked example connected a test Analytics tag to consent choices, which is a narrower, checkable result than claiming that adding a banner makes every service compliant.
Use a clean browser session and inspect network requests as well as the visible buttons. Check the initial page before a choice, reject all, accept, save a custom selection, reload, and withdraw a previous choice. Record which scripts or requests run in each state. A banner disappearing after a click only proves that the interface changed.
Our local case passed 12 independent browser checks with an intercepted Analytics loader, including persistence and withdrawal. For your store, repeat the checks against the actual tags, consent integration and visitor regions you use. Keep the observations with the deployment so a later theme or marketing-script change can be checked against the same behavior.
The verified implementation is a local plain-HTML storefront. It demonstrates editing site files, adding policy links and wiring consent controls; it does not establish a ready-made Shopify app or WordPress plugin. For a custom site, a developer can adapt that workflow to the framework and deployment process.
On Shopify, use the platform's policy and customer-privacy settings as the starting point, and check how manually added tags honor consent. On WordPress, identify which plugin or theme owns the policy routes and consent controls before changing code. Avoid installing a second banner that conflicts with the one already collecting visitor choices.
No. The output is a set of documents and website controls that still need to match your actual data handling and applicable obligations. Useful review questions include which visitor regions you serve, what information leaves the site, which vendors receive it, how requests are handled and whether the stated choices change the underlying behavior.
Use the Skill to make that review concrete: list the data flows, produce the relevant pages and record what the controls do. Have the responsible privacy or legal reviewer resolve jurisdiction-specific requirements. The example's browser checks establish local behavior for a test tag; they do not establish that a live business meets every requirement of a named law.
Revisit the affected pages when you change a payment or analytics provider, add advertising pixels, introduce accounts or subscriptions, change retention rules, or expand delivery destinations. Start from the actual change: a new tracking service affects the data description and script controls, while a new shipping zone may affect delivery and return wording.
Ask the assistant for a focused comparison of the old and new setup, the pages that need editing and the browser states that need retesting. Preserve unaffected content, including support details and approved policy choices. A scheduled rewrite of every page is less useful than keeping each published promise aligned with the feature or business rule that changed.
No reviews yet.