Draft Your Privacy Policy and Terms With AI for €0
Updated: November 2026 · Prices checked: November 2026
In short
- A free AI chat can turn a list of facts about your business into a first draft of a privacy policy and terms in about an hour.
- The draft is only as true as the facts you give it. AI does not know which tools collect data on your site.
- Under the GDPR, your privacy notice must say who you are, why you use data, the legal basis, how long you keep it, who receives it, and what rights people have.
- Have a lawyer check the final text. You pay for one review hour instead of a full drafting job.
This guide is general information, not legal advice. Laws differ by country and business type. Have a qualified lawyer check your documents before you publish them.
Most small sites copy a competitor’s privacy policy. It describes their tools, not yours. A better cheap route: list what your business really does with data, let AI turn that list into a clean draft, and pay a lawyer only to check it.
What you save
Lawyers usually bill legal drafting by the hour. A blank-page draft of two documents takes far longer than a review of a clear draft that already matches your business.
The maths: plug in your own lawyer’s hourly rate. Say it is €80. Drafting a privacy policy and terms from zero could take four hours, so about €320. Reviewing a solid AI draft with your fact sheet attached could take one to two hours, so €80 to €160. The AI chat costs €0 on a free plan. You save roughly half, and you understand your own documents better.
| Option | Cost | Matches your business? | Main risk |
|---|---|---|---|
| Copy a competitor’s policy | €0 | No | Wrong tools, wrong company, copyright issue |
| AI draft only | €0 | Only if your facts are complete | Missing local rules, confident mistakes |
| AI draft + lawyer review | A few lawyer hours | Yes | Low |
| Lawyer drafts from zero | Most lawyer hours | Yes | Low, but slowest and most expensive |
The EU basics AI must cover
If you serve people in the EU, the GDPR applies. The European Commission lists what you must tell people when you collect their data. Use it as a checklist for the AI draft:
- Who you are and how to contact you, plus your data protection officer if you have one.
- Why you use the data (the purposes) and the legal basis for each purpose.
- Which categories of data you collect.
- How long you keep it.
- Who else receives it: your hosting, email tool, payment provider, courier, accountant.
- People’s rights, such as access and erasure, and the right to complain to a data protection authority. In Bulgaria that is the Commission for Personal Data Protection.
- Whether you use the data for automated decisions, and what that means for the person.
The text must be concise, transparent and in clear, plain language. That is where AI helps most.
Two more rules catch small sites. Cookies: analytics and advertising cookies need consent before they are set. Only strictly necessary cookies are exempt, and refusing must be as easy as accepting. Online sales: consumers in the EU usually get 14 days to withdraw from a distance purchase without giving a reason. Your terms must explain how, and you must provide the model withdrawal form. If you skip this, the withdrawal period can be extended by up to 12 months.
How to do it step by step
- Make a data inventory. Open a blank note. For each place you collect data, write one line: what you collect, why, which tool stores it, how long you keep it. Check forms, newsletter, orders, analytics and ads pixels in your real site, not from memory.
- List your processors. Hosting company, email marketing tool, payment provider, courier, accounting software. Note where each one stores data.
- Open a free AI chat. ChatGPT and Claude both have free plans that are enough for this. Use a fresh chat. Do not paste customer data, only facts about your business.
- Paste the drafting prompt:
“You are helping a small EU business draft a website privacy notice under the GDPR. Use only the facts below. Do not invent tools, purposes or retention periods. Where a fact is missing, write [MISSING: what you need] instead of guessing. Structure: who we are, what data we collect, why and on what legal basis, how long we keep it, who receives it, international transfers, your rights, how to complain, cookies, changes. Write in plain language, short sentences. Facts: [paste inventory and processor list].” - Fill every [MISSING] gap. Do not let the AI fill them. Go back to your tools and find the real answers.
- Draft the terms with a second prompt. Give it your business model: what you sell, prices with or without VAT, delivery, returns, warranties, payment methods, how complaints work. Add: “Include the EU 14-day withdrawal right for consumers and its exceptions that apply to us. Mark anything that depends on national law as [CHECK LOCAL LAW].”
- Ask the AI to audit its own draft. Prompt: “List every statement in this text that is not backed by my facts. List every GDPR information item from Article 13 that is missing.”
- Send the draft and your fact sheet to a lawyer. Ask for a review, not a rewrite. This is what keeps the bill small.
- Publish and link. Put both pages in your site footer, link the privacy notice next to every form, and date the documents.
New to prompts? Our guide on how to write AI prompts that work explains the “facts plus rules” pattern used above. Before you paste anything, read what never to share with AI chatbots.
What AI can draft and what a lawyer must check
| Part | AI drafts well | Lawyer must check |
|---|---|---|
| Structure and headings | Yes | Quick look |
| Plain-language wording | Yes | Quick look |
| Legal basis for each purpose | Suggests | Yes, always |
| Retention periods | No, needs your facts | Yes, tax and accounting rules apply |
| Data transfers outside the EU | Lists them | Yes |
| Liability limits, warranties, governing law | Generic text | Yes, always |
| Withdrawal right and exceptions | Basic rule | Yes, for your product type |
If you run a shop, our guide to AI for an online shop shows other tasks you can hand to AI safely.
Limits and traps
- AI invents with confidence. It may add a data protection officer you do not have or a retention period that sounds right. Check every claim against your fact sheet. Our routine to check if an AI answer is true works here too.
- A policy that lies is worse than none. If your text says “we do not use tracking cookies” and your site loads an ads pixel, the policy itself is evidence against you.
- The fines are real. The most serious GDPR breaches can cost up to €20 million or 4% of worldwide annual turnover, whichever is higher.
- National law differs. Consumer rules, retention for invoices and language requirements depend on your country. AI often defaults to US or UK wording.
When to pay instead: skip the cheap route and hire a lawyer from the start if you process health, financial or children’s data, run a marketplace or subscription model, sell across many EU countries, or use automated decisions about people. The risk there is too high for a review-only job.
FAQ
Can I publish an AI-written privacy policy without a lawyer?
You can, but you carry the risk. AI does not know your tools, your country’s rules or your contracts. A short lawyer review catches wrong legal bases, missing rights and invented facts. For a small site, that review usually costs a fraction of drafting from zero.
What must a GDPR privacy policy include?
Who you are and how to contact you, why you use the data and on what legal basis, which data, how long you keep it, who receives it, and people’s rights, including the right to complain to a data protection authority. Write it in clear, plain language.
Is it safe to paste my business details into ChatGPT or Claude?
Facts about your business and tools are fine. Never paste customer names, emails, orders or contracts with personal data. Describe categories instead, such as “email addresses from the newsletter form”. Check the chat’s data settings if you do not want your chats used for training.
Read also: Name Your Business and Check the Domain in 30 Minutes for €0 · Realistic Product Mockups for €0 With Free Tools and AI · What Never to Share With AI Chatbots: Privacy Guide (2026)
Ivan’s Take
The real work is the data inventory, not the wording. Do that list honestly and AI will give you a clean, readable draft in an hour. Then pay a lawyer to check it, not to write it. That is the cheap part I would never skip. A copied policy saves you nothing if it describes someone else’s business.
Sources: European Commission: What information must be given to individuals · Your Europe: How to use cookies on your website · Your Europe: Returns and the right of withdrawal · European Commission: GDPR enforcement and sanctions · GDPR text on EUR-Lex · Claude pricing · ChatGPT pricing
HawkValue
If it doesn’t save you time or money, you won’t see it here
- Facts, not hypeEvery price and number is checked against the official source
- Always the real priceYou see what it costs before you click
- I say when it’s weakEven when it’s OpenAI or Google
