Step 1: Disclaimer & Scope     → Set expectations
Step 2: Project Detection      → Scan codebase for data collection
Step 3: Guided Questions       → Interactive Q&A to fill gaps (5 rounds)
Step 4: Generate Documents     → Create tailored legal pages
Step 5: Implementation         → Add to project with proper routing
Step 6: Next Steps            → Cookie consent, lawyer review, etc.

Search for and report on:

AUTHENTICATION
├── next-auth / NextAuth.js    → OAuth providers, session strategy
├── clerk                       → User profiles, organizations
├── supabase auth              → Email, OAuth, phone auth
├── firebase auth              → Multiple auth methods
├── lucia                       → Session-based auth
├── auth0                       → Enterprise SSO, social login
├── passport.js                → Strategy-based auth
└── Custom auth                → JWT, session cookies

ANALYTICS & TRACKING
├── Google Analytics (gtag, GA4)
│   └── Cookies: _ga (2 years), _gid (24h), _gat (1 min)
├── Google Tag Manager         → Container for multiple tags
├── Plausible                  → Privacy-focused, no cookies
├── Fathom                     → Privacy-focused, no cookies
├── PostHog                    → Product analytics, session recording
├── Mixpanel                   → Event tracking, user profiles
├── Amplitude                  → Product analytics
├── Heap                       → Auto-capture analytics
├── Hotjar/FullStory          → Session recording, heatmaps
├── Vercel Analytics          → Privacy-focused, no cookies
└── Segment                    → Customer data platform

PAYMENTS & BILLING
├── Stripe
│   └── You store: customer_id, subscription status
│   └── Stripe stores: payment methods, card details
│   └── Cookies: __stripe_mid, __stripe_sid
├── Paddle                     → Merchant of record model
├── LemonSqueezy              → Merchant of record model
├── PayPal                     → Payment processor
└── Custom billing             → Invoice data, payment history

EMAIL SERVICES
├── Resend                     → Transactional email
├── SendGrid                   → Email delivery
├── Postmark                   → Transactional email
├── Mailchimp/ConvertKit      → Marketing email, subscriber lists
├── Customer.io               → Marketing automation
└── AWS SES                    → Email infrastructure

ERROR TRACKING & MONITORING
├── Sentry                     → Error tracking, may capture user context
├── LogRocket                  → Session replay, error tracking
├── Bugsnag                    → Error monitoring
├── Datadog                    → APM, logging, traces
└── New Relic                  → Application monitoring

CUSTOMER SUPPORT
├── Intercom                   → Chat, user data, conversation history
├── Crisp                      → Live chat
├── Zendesk                    → Support tickets
├── HelpScout                  → Customer support
└── Freshdesk                  → Support platform

DATABASE & STORAGE
├── PostgreSQL/MySQL          → User data storage
├── MongoDB                    → Document storage
├── Prisma                     → ORM (check schema for PII)
├── Drizzle                    → ORM
├── Supabase                   → Database + auth + storage
├── PlanetScale               → MySQL platform
├── Neon                       → Serverless Postgres
├── Cloudinary                → Image/video storage
├── Uploadthing               → File uploads
├── AWS S3                     → Object storage
└── Vercel Blob               → File storage

HOSTING & INFRASTRUCTURE
├── Vercel                     → Logs IP addresses, request data
├── Netlify                    → Similar logging
├── AWS                        → CloudFront logs, ALB logs
├── Cloudflare                → CDN, may set cookies
└── Railway/Render            → Platform logs

MARKETING & ADS
├── Facebook Pixel            → Conversion tracking
│   └── Cookies: _fbp, fr
├── Google Ads                → Conversion tracking
│   └── Cookies: _gcl_au, _gcl_aw
├── LinkedIn Insight Tag      → B2B tracking
├── Twitter/X Pixel           → Conversion tracking
├── TikTok Pixel              → Conversion tracking
└── Pinterest Tag             → Conversion tracking

CMS & CONTENT
├── Sanity                     → Content management
├── Contentful                → Headless CMS
├── Payload                    → Headless CMS
├── Strapi                     → Headless CMS
└── WordPress API             → Content source

FORMS & DATA COLLECTION
├── Contact forms              → Name, email, message
├── Newsletter signup         → Email address
├── User profiles             → Various PII
├── File uploads              → User-generated content
├── Surveys/feedback          → User responses
└── Job applications          → Resumes, personal info

undefined

---

Question: "What are your business details?"
Header: "Business"
Options: [Free text response needed]

Gather:
- Legal business name (e.g., "Acme Inc." or "John Smith trading as Acme")
- Country/state of incorporation or residence
- Business type: Company, LLC, Sole proprietor, etc.
- Website URL
- Contact email for privacy/legal inquiries
- Physical address (required for some jurisdictions, recommended for all)

Question: "Where are your users located?"
Header: "Jurisdiction"
Options:
  - "Worldwide (GDPR + CCPA compliant)" [Recommended]
    → Covers EU, California, and general best practices
  - "US only"
    → CCPA for California, general US practices
  - "EU/EEA only"
    → GDPR-focused
  - "Specific countries"
    → Ask follow-up for which countries

Follow-up if needed:
Question: "Do you expect users under 18?"
Header: "Age"
Options:
  - "No, adults only (18+)"
  - "Yes, 13-17 with parental consent"
  - "Yes, under 13" → COPPA applies, special handling required
  - "Not sure"

Question: "Which legal documents do you need?"
Header: "Documents"
MultiSelect: true
Options:
  - "Privacy Policy" [Required for almost all sites]
    → Required if you collect ANY data (even just analytics)
  - "Terms of Service"
    → Required for apps/SaaS, recommended for all
  - "Cookie Policy"
    → Required if using non-essential cookies (can be section in Privacy Policy)
  - "Acceptable Use Policy"
    → Recommended if users can post content or interact

Question: "What type of service is this?"
Header: "Service type"
Options:
  - "SaaS / Web application"
    → User accounts, possibly subscriptions
  - "E-commerce / Online store"
    → Products, checkout, shipping
  - "Content / Blog / Marketing site"
    → Minimal data collection
  - "Marketplace / Platform"
    → Multiple user types, transactions between users
  - "API / Developer tools"
    → API keys, usage data, developer accounts

Follow-up based on selection:
- SaaS: "Do you offer free trials? Refund policy? Subscription billing?"
- E-commerce: "Physical or digital products? Return policy? Shipping regions?"
- Marketplace: "Do you facilitate payments between users? Take commission?"

Question: "What are your data practices?"
Header: "Practices"
MultiSelect: true
Options:
  - "We use data only for providing our service"
  - "We send marketing emails (with consent)"
  - "We share anonymized/aggregated data"
  - "We use AI/ML to process user data"
  - "We allow third-party integrations"

Question: "What is your refund/cancellation policy?"
Header: "Refunds"
Options:
  - "14-day money-back guarantee"
  - "30-day money-back guarantee"
  - "Pro-rated refunds for annual plans"
  - "No refunds (for digital goods)"
  - "Custom policy" → Ask for details

We share data with [SERVICE_PROVIDERS].
Contact us at [EMAIL].

We share data with Vercel (hosting), Stripe (payments), and Resend (email).
Contact us at privacy@acme.com.

app/
├── (legal)/
│   ├── layout.tsx          # Shared layout for legal pages
│   ├── privacy/page.tsx    # Privacy Policy
│   ├── terms/page.tsx      # Terms of Service
│   └── cookies/page.tsx    # Cookie Policy (or section in privacy)

// app/(legal)/layout.tsx
export default function LegalLayout({ children }: { children: React.ReactNode }) {
  return (
    <div className="container mx-auto max-w-3xl px-4 py-12">
      <article className="prose prose-gray dark:prose-invert max-w-none">
        {children}
      </article>
    </div>
  )
}

undefined

---

<arc_log>
**After completing this skill, append to the activity log.**
See: `${CLAUDE_PLUGIN_ROOT}/references/arc-log.md`

Entry: `/arc:legal — Generated Privacy Policy, Terms, Cookie Policy`
</arc_log>

---