Web legal

Cover the legal basics so launch doesn't become a liability. Structure and prompts only — not legal advice.

⚠️ This skill helps you organize and draft. It is not a substitute for a lawyer. Anything user-facing or money-related should be reviewed by a qualified attorney in the relevant country before you rely on it.

Global default

Core pages most sites need

• Privacy Policy — what data you collect, why, legal basis, how long you keep it, who you share it with (analytics, payments, email tools), and how users exercise their rights. Required the moment you collect any personal data (yes, an email signup counts).
• Terms of Service — the rules for using the site; liability limits; governing law.
• Cookie / tracking notice — if you use analytics, ads, or non-essential cookies.

Cookies & consent

• Distinguish strictly-necessary cookies from analytics/marketing ones.
• For non-essential cookies, get consent before firing them (opt-in), with an easy way to decline and to change the choice later. No pre-ticked boxes.

GDPR (any EU/EEA visitors)

• Have a lawful basis for processing; consent must be freely given and specific.
• Honor data-subject rights: access, correction, deletion, portability, objection.
• Disclose international data transfers; name your processors.
• Breach notification duties apply.

Good habits

• Collect the minimum data you actually need.
• Link Privacy + Terms in the footer on every page.
• Keep a record of what tools touch user data (analytics, payment, email, hosting).

🇮🇱 Israel

• Protection of Privacy Law governs personal data in Israel. Amendment 13 (in force 14 August 2025) significantly tightens it — broader definitions, stronger enforcement powers, higher penalties, and AI/data-governance expectations.
• Database obligations: holding personal data can trigger registration and security duties under the 2017 Security Regulations; larger/sensitive databases carry heavier requirements. Check thresholds for your case.
• You may need to appoint a privacy/data protection officer depending on scale and sensitivity.
• Hebrew: provide the privacy policy and key legal notices in Hebrew for an Israeli audience.
• Consumer protection (Chok Hagnat HaTzarchan) for selling online: clear price display, a cooling-off / cancellation right, and business disclosure.
• Accessibility statement is also legally required (see web-accessibility / IS 5568) — it's part of your launch legal set.
• Cross-border data transfer rules apply if data leaves Israel (common with US cloud/SaaS).

🔌 Power-ups (installed skills)

• legal-terms (GDPR/CCPA Terms of Service), legal-privacy (privacy policy).
• Contract review when needed: legal-review, legal-risks, legal-missing, legal-compare, legal-plain, legal-negotiate, legal-nda.
• 🇮🇱 israeli-privacy-shield (Privacy Law + Amendment 13, database registration), israeli-ecommerce-compliance (Consumer Protection, returns, cookie consent), hebrew-legal-research, israeli-cyber-regulations, israeli-ai-compliance-kit.

Checklist

• [ ] Privacy Policy live (covers all data + processors)
• [ ] Terms of Service live
• [ ] Cookie notice + opt-in consent for non-essential cookies
• [ ] Footer links to Privacy + Terms on every page
• [ ] Data minimized; processor list maintained
• [ ] (EU visitors) GDPR rights + lawful basis + transfer disclosure
• [ ] (Israel) Hebrew policy, Amendment 13 reviewed, database duties checked, accessibility statement published
• [ ] Lawyer reviewed before relying on any of it