# Privacy Ledger

> The data inventory a website privacy notice needs, built free in the browser from the site's own HTML and a short
> business facts sheet; a metered run drafts a reviewable notice with every unknown left as a placeholder, or reviews
> the notice a business has now. A template for informational purposes, not legal advice: a qualified privacy professional
> should check anything before it is published or relied on. Built on the SkillSafe skill
> @sickn33/legal-advisor (sickn33/antigravity-awesome-skills, MIT).

https://privacy-ledger.skillsafe.ai/

## The input
- Business facts, one per line: Business:, Contact:, Address:, Website:, What we do:, Users in: (UK, EU, US (California), Canada, Brazil...), Children:, Newsletter:, Accounts:, Payments:, Tools: (services not visible in the HTML), Retention:, DPO:.
- The page's HTML (view source), or a saved .html file.
- Optionally the privacy notice the business has now.

## What is free
- Tools recognised from the tags they load: Google Analytics, Tag Manager and Ads; Meta, TikTok, LinkedIn, X and Pinterest pixels; Hotjar, Microsoft Clarity, Plausible, Fathom, Segment, Mixpanel, Amplitude, PostHog; Intercom, Crisp, Zendesk, HubSpot; Mailchimp, Kit, Klaviyo; Stripe, PayPal, Shopify; reCAPTCHA, hCaptcha, Turnstile, Cloudflare; YouTube, Vimeo, Google Maps; Google and Adobe Fonts; Sentry, Calendly, Typeform, Disqus, Gravatar, Vercel Analytics - each with what it collects, non-essential cookies, US transfer and advertising.
- Form fields read from names, types and labels: email, name, phone, address, date of birth, age, password, card, message, uploads, company, location, and sensitive data (health, ethnicity, religion, orientation, government ID), plus children's details.
- The laws whose disclosures likely apply (GDPR, UK GDPR, the ePrivacy and PECR cookie rules, CCPA/CPRA, COPPA, CAN-SPAM, CASL, PIPEDA, LGPD) and the required disclosures for each; the unknown facts.
- Findings: non-essential cookies with EU or UK visitors (consent), children, advertising with California visitors (sharing), US transfers, sensitive form fields, email marketing without a postal address, unknown facts, the CCPA thresholds, payment processors, third-party fonts.
- For a pasted notice: each required disclosure found or missing, each tool named or missing, a date over a year old, and statements the site contradicts ("we do not use cookies" on a site that sets them).
- Exports: the inventory as CSV, the findings as CSV, the ledger as Markdown.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (draft or review), `business` (the facts sheet), `site` (the tags and fields the page read - not the whole HTML), `policy` (for review), `today` and `page` (the inventory).
- `draft` replies with `summary`, `sections` (heading and body), `unknowns` (each placeholder), `implementation` (what the notice cannot do by itself), `findings`, `prescan` and `caveats`. The page requires every required disclosure, every tool named and no other, a [[placeholder]] for every unknown fact, no retention period or email the facts do not give, no claim of compliance, and the disclaimer.
- `review` replies with `verdict` (sound, gaps or rework), `summary`, `contradictions` (quoted from the notice), `gaps` (each with a suggested clause), `tools`, `keep`, `findings`, `prescan` and `caveats`. The page requires every contradiction, missing disclosure and unnamed tool to be answered and the verdict to match its findings.

## Links
- API tutorial: https://privacy-ledger.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@sickn33/legal-advisor