Discovery Guide

Privacy Policy Build Checklist & Discovery Guide

A practical checklist for gathering business, website, tracking, advertising, and privacy-rights information before drafting a privacy policy.

Start here

Fill out the checklist below. At the bottom, Step 11 will generate a custom master prompt from your checkboxes, dropdowns, radio answers, written details, and table rows.

Important note

AI can help draft and organize a strong privacy policy, but AI is not an attorney and PrimeAxiom is not a law firm. This checklist is not legal advice. Use it to gather accurate operational details, then review the final policy with qualified legal counsel.

1

Business Basics

Start with exact business details. These fields usually appear directly in the policy, so use the legal names, live URLs, and current contact information.

Legal Business Name*Required
Your Answer:e.g., PrimeAxiom LLC
DBA / Brand Name
Your Answer:e.g., PrimeAxiom
Website URL*Required
Your Answer:e.g., https://primeaxiom.ai
Business Type*Required
Your Answer:
Audience Type*Required
Your Answer:
Products/services offered*Required
Your Answer:
Anything unusual about the business model
Your Answer:
2

Privacy Contact And Legal Scope

Collect the exact contact information and legal coverage choices needed for the final policy footer, rights section, and regional compliance language.

Privacy contact email*Required
Your Answer:e.g., privacy@company.com
Phone number
Your Answer:
Mailing address
Your Answer:
Effective date*Required
Your Answer:
Main privacy law coverage*Required
Your Answer:
Do you transfer data internationally?
Your Answer (Choose one):
Custom privacy notes
Your Answer:
3

Website Collection Points

Select every place where the business collects information. Add “Other” if the user journey includes something not listed.

Website collection points*Required
Your Answer (Select all that apply):
How the business collects personal information
Explain direct collection, automatic tracking, vendor imports, offline intake, and any data received from third parties.
Your Answer:
Do you allow user accounts?
Your Answer (Choose one):
Do you collect payment information?
Your Answer (Choose one):
4

Personal Information Collected

Select the categories collected and explain anything sensitive, regulated, or unusual. This is one of the most important parts of the prompt.

Personal information categories*Required
Your Answer (Select all that apply):
Do you process sensitive personal information?
Your Answer (Choose one):
Do you collect children’s information?
Your Answer:
How the business uses personal information*Required
Your Answer:
Other uses of data
Your Answer:
5

Tools, Vendors, And Data Sharing

Document the systems that receive personal information and whether any disclosure could count as sale, sharing, or targeted advertising.

Third-party tools used*Required
Your Answer (Select all that apply):
Main CRM name
Your Answer:
Main email/SMS platform
Your Answer:
Main payment processor
Your Answer:
Main hosting provider
Your Answer:
Do you use contractors or vendors?
Your Answer (Choose one):
Do you sell personal information?
Your Answer:
Do you share personal information for targeted advertising?
Your Answer:
Vendor/data sharing table
Add a row for each vendor, agency, platform, affiliate, or recipient that receives personal information.
Your Answer (Add rows as needed):

Row 1

6

Cookies, Pixels, And Tracking

Identify tracking tools, cookie controls, opt-out links, and whether visitors can control consent.

Cookie banner status
Your Answer:
Global Privacy Control support
Your Answer:
Cookie settings link
Your Answer:
Opt-out link
Your Answer:
Cookie/tracking table
Use this table for cookies, pixels, analytics scripts, session replay, conversion tracking, and similar tools.
Your Answer (Add rows as needed):

Row 1

7

Marketing And Communications

Explain email, SMS, call recording, unsubscribe, and marketing opt-out behavior.

Do you send marketing emails?
Your Answer (Choose one):
Do you send SMS messages?
Your Answer (Choose one):
Do you record calls?
Your Answer (Choose one):
Do users have a way to opt out of marketing?
Your Answer (Choose one):
Unsubscribe link
Your Answer:
Other privacy concerns
Your Answer:
8

Privacy Rights And Requests

Define how people submit requests, how identity is verified, and what happens when requests are denied.

Privacy request form link
Your Answer:
Do users have a way to request deletion?
Your Answer (Choose one):
How privacy requests are verified*Required
Your Answer:
Appeal process for denied privacy requests
Your Answer:
Authorized agent process
Your Answer:
Data deletion method
Your Answer:
9

Retention And Security

Add specific retention periods and security practices. Tables are intentionally used here because policy accuracy depends on category-by-category details.

Data retention table*Required
Your Answer (Add rows as needed):

Leads

Customers

Billing records

Support messages

Analytics data

Chat logs

Call recordings

AI prompts/uploads

Backups

Inactive accounts

Security practices description*Required
Your Answer:
Other security controls
Your Answer:
Breach/incident response process
Your Answer:
10

AI Core & Model Governance

Document how AI tools process user data, retain prompts/files, support human review, and handle incorrect or harmful outputs.

Do you use chatbots?
Your Answer (Choose one):
Do you use AI tools?
Your Answer (Choose one):
Main AI provider
Your Answer:
AI training usage
Your Answer:
Automated decision-making
Your Answer:
AI use description
Your Answer:
Human review process for AI outputs
Your Answer:
How users can report incorrect AI output
Your Answer:
Other AI uses
Your Answer:
AI tools table
Add one row per AI provider, chatbot, voice AI tool, model platform, vector database, or automation tool.
Your Answer (Add rows as needed):

Row 1

11

Final Policy Sections To Draft

Use the discovery answers to draft policy sections that match the actual operation of the business.

Introduction and scope
Information collected
How information is collected
How information is used
Cookies, pixels, and tracking choices
How information is shared, sold, or disclosed
Marketing, SMS, and unsubscribe rights
Privacy choices, access, correction, deletion, appeals, and authorized agents
Data retention and security
International transfers and region-specific privacy rights
AI systems, model training, subprocessors, automated decision-making, and human review
Children, changes, accessibility, and contact information

Step 11

🚀 Generate Your Custom Master Prompt

Ready to draft your policy? Enter your email below to bundle your active checklist selections, written details, dropdown choices, radio answers, and table rows into a formatted master prompt. You can copy and paste this directly into Cursor, ChatGPT, or Claude to write your tailored Privacy Policy in seconds.

⚠️ Reminder: This is drafting support, not legal advice. AI can help organize your answers into a strong starting draft, but AI is not an attorney. Always review the generated policy with qualified legal counsel before publishing it live.

Privacy note: the full master prompt is generated for your use. By entering your email, you allow PrimeAxiom to follow up about this checklist and your privacy policy draft.

By entering your email and clicking Generate, you agree that PrimeAxiom may contact you about this privacy policy checklist and your generated prompt.

Next Step

🎥 Join Our Live AI & Compliance Workshops

Got your master prompt? Before you go off and deploy your new privacy policy, join us for our next live workshop. We regularly host live deep-dives and open Q&A sessions covering:

  • Upstream AI vendor secrets (OpenAI, Anthropic, AWS Bedrock compliance)
  • Step-by-step walk-throughs for user opt-out workflows
  • Live data-mapping teardowns for scaling platforms
View All Upcoming Webinars & Claim Your Seat