What does legal-pages do?
Not legal advice. This skill produces templates filled with the user's answers. It does not know the user's jurisdiction-specific obligations and is not a substitute for a lawyer. You must tell the user this in your final message, and the generated pages carry a review notice that the user deletes only after they have reviewed the text. Never claim the pages are "compliant".
Step 1 — Collect facts (ask, don't guess)
Inspect the codebase first to pre-fill what you can (auth provider, analytics script, payment SDK,
email provider, database host, cookies set). Then confirm with the user. Copy
assets/legal-config.example.json to legal-config.json in the project root and fill it:
| Field | Example | Where to look |
|---|---|---|
company_name, product_name, website_url, contact_email | "Acme Studio" | ask; footer; env |
legal_entity_type, address, governing_law | "individual", "Hebei, China", "People's Republic of China" | ask — never invent |
merchant_of_record | creem / paddle / lemonsqueezy / none | package.json deps (creem, @paddle/paddle-js, @lemonsqueezy/..., stripe) |
data_collected | email, name, payment handled by MoR, IP/usage logs | auth + DB schema |
processors | Resend (email), Plausible (analytics), AWS (hosting) | env vars, SDK imports |
uses_cookies, analytics_cookies | true / false | cookies set by auth/analytics |
sells_subscriptions, sells_one_time | pricing page | |
refund_mode | window (N days) / case_by_case / none | ask — must match the provider's rules |
serves_eu, serves_california, serves_china | ask; affects added sections | |
min_age | 13 or 16 | 16 is the safer default if serving the EU |
Anything the user does not know stays as a [[TODO: …]] marker in the output — do not fill legal
facts (address, entity, governing law) with plausible-looking values.
Step 2 — Render
python3 scripts/render_legal.py --config legal-config.json --out legal --format md
python3 scripts/render_legal.py --config legal-config.json --out app/(legal) --format nextjs # Next.js App Router
python3 scripts/render_legal.py --config legal-config.json --out public/legal --format html
Produces privacy, terms, refund documents. The script fails if a required field is missing,
prints every remaining [[TODO]], and stamps "Last updated" with effective_date (or today).
--format nextjs writes privacy/page.tsx, terms/page.tsx, refund/page.tsx with static HTML
and metadata — no extra dependencies. Wrap with your site layout/typography as needed.
Step 3 — Wire up
- Footer links to all three pages on every page (payment providers look for them).
- Checkout: link terms + refund policy near the buy button ("By purchasing you agree to…").
- If
analytics_cookiesis true andserves_euis true: tell the user a cookie consent banner is likely needed before loading analytics (or switch to a cookieless analytics tool). Do not add a banner silently. - Sign-up form: link privacy policy.
Step 4 — Provider-specific checks
Read references/provider-notes.md for the chosen Merchant of Record. Key points: with a MoR,
the MoR is the seller of record to the customer, so terms must say so and the refund policy must
not promise something the MoR's own buyer terms contradict.
Step 5 — Hand-off message (required)
Tell the user, in their language:
- Which files were created and where they are linked.
- The list of
[[TODO]]items still open. - That the text is a template, not legal advice, and should be reviewed by a qualified lawyer, especially for: governing law, liability limits, consumer withdrawal rights (EU 14-day rule for digital content), and data transfers out of the user's country.
- That they must keep the pages accurate when they add a new tool that processes user data.
Files
assets/templates/*.md— the three templates (mustache-style{{field}},{{#flag}}…{{/flag}}).assets/legal-config.example.json— questionnaire with every field.scripts/render_legal.py— renderer (stdlib only).references/provider-notes.md— Creem / Paddle / Lemon Squeezy / Stripe notes with links.references/regional-notes.md— GDPR, UK GDPR, CCPA/CPRA, PIPL pointers (informational).