EasyHive
CLAUDE RUNS MY BIZ / 42
THE PROMPT AND THE CHECKLIST

Make your vibe coded
website legally safe

An AI builder gives you a good looking site in an afternoon and skips the boring part: the privacy policy, the cookie banner, the refund terms, the alt text. This is one prompt that has Claude draft those pages and check the rest of the site, plus the checklist behind it. Claude does the first pass. A lawyer for your country reads it before you rely on it.

Works best in Claude Code, opened in your site's project folder. Laws and rules checked in October 2026. General information, not legal advice.

Before you paste the prompt

  1. Open the project where Claude can read the code

    Claude Code in your site's folder is the best fit: it can read every file, find every tracking script and make the changes. Built the site in an online builder? Sync it to GitHub and open that folder.

  2. Save a copy first

    Commit or duplicate the project before you start. The prompt touches pages, forms, the footer and the scripts, so keep a clean way back.

  3. Fill in the lines under "About my business"

    Your legal name, where you are based, where your customers are, what you sell and how people pay and a contact email. Where your customers are decides which laws apply. If you do not know something, leave the bracket: Claude marks it [TO CONFIRM] instead of guessing.

  4. Go one step at a time

    The prompt tells Claude to show each change and wait for your OK. Twelve small reviews are easier than one giant change at the end.

A FIRST DRAFT AND A CHECKLIST, NOT LEGAL ADVICE The prompt gives you draft pages, fixes and a list of open questions. It cannot promise that your site complies with the law, and neither can this guide: rules change by country and state and depend on facts only you know. Before you rely on the pages, send them with Claude's summary to a lawyer who knows your market. With the draft done, that review is a short job instead of a project.
The prompt
Paste it into Claude Code inside your site's project. Replace everything in [BRACKETS] first.
THE LEGAL PAGES PROMPTCOPY EVERYTHING IN THIS BOX
I don't want my vibe coded website to get sued. Act as a careful web developer who knows the basics of privacy, consumer and accessibility law. Read the whole project first, then work through the steps below one at a time. Show me each change and wait for my OK before moving on. About my business Legal name: [BUSINESS LEGAL NAME] Based in: [COUNTRY AND STATE] Customers in: [e.g. US only / US and Canada / worldwide, EU and UK included] What we sell and how people pay: [e.g. courses via Stripe / bookings paid in person / nothing, just a lead form] Email for privacy and legal requests: [EMAIL] Address and company number to show: [ADDRESS, COMPANY NUMBER IF ANY] Never invent facts about my business. If something is not in the code or in the lines above, write [TO CONFIRM] and add it to the final list. 1. Privacy Policy: what personal data we collect (forms, accounts, cookies, analytics, payments), why, the legal basis where the law asks for one, who we share it with (name every third party tool you find in the code), how long we keep it, how people can see, correct or delete it, how we respond to Do Not Track signals, and the effective date. 2. Terms and Conditions: what we offer, who can use the site, our content and trademarks, limits of liability, payment, refund and cancellation terms, governing law and how disputes are handled. 3. Cookies: list every cookie, pixel, tag and local storage item and mark each one strictly necessary or not. Tell me if, for where my customers are, I need a consent banner. If yes, add one that blocks every non essential script until the visitor accepts, has a Reject button as easy to use as Accept, and lets people change their choice later. Write a Cookie Policy that matches the list. 4. Refunds: if we sell anything, add a Refund and Cancellation Policy (time limits, conditions, how to ask, who pays return shipping) and link it next to the buy or book button. If we sell to consumers in the EU, cover their 14 day right of withdrawal and the online withdrawal button. 5. Forms: keep only the fields we really need and tell me what you removed. Add a line under every form linking to the Privacy Policy. If a form also signs people up for emails or texts, add a separate checkbox for that, unticked by default. 6. Tracking and embeds: list every analytics, ads and tracking script (Google Analytics, Tag Manager, Meta Pixel and so on) and every embed (YouTube, Google Maps, Google Fonts, chat and booking widgets). For each one: what it collects, whether it needs consent, and whether the Privacy Policy names it. Use youtube-nocookie.com for videos and host fonts locally where you can. 7. Accessibility, aiming at WCAG 2.2 AA: alt text on every meaningful image, contrast of at least 4.5:1 for body text, every link, button and form usable with the keyboard alone with a visible focus, a label on every field, buttons that say what they do ("Book a call", not "Click here"), a skip to content link, captions on videos. Do not add an accessibility overlay widget. 8. Reviews and claims: flag every review, testimonial, rating, client logo, number and promise. Remove reviews I cannot trace to a real customer and claims I cannot prove ("guaranteed results", "#1 in town", made up stats, before and after promises). Explain the risk of each one and keep the real ones. 9. Business details: make sure the site shows who runs it: legal name and contact email, plus address, company number and VAT number where the law asks for them. 10. Images: list every image, video, font and icon with where it seems to come from (mine, stock, AI generated, unknown) and flag anything that looks copied from another site or brand. 11. The law: from where we are and where our customers are, tell me which privacy and consumer laws likely apply (for example GDPR, UK GDPR, CalOPPA, CCPA/CPRA and other US state laws, Brazil's LGPD, India's DPDP Act) and what the pages above still miss for them. Flag any other risk you notice. 12. Wrap up: link every policy page in the footer, add a "Last updated" date to each, then give me a one page summary: what you changed, every [TO CONFIRM], other risks you spotted, and the questions I should take to a lawyer.
What each step checks, and why
The checklist behind the prompt. Use it to read Claude's work, and to know which rows matter for where you sell.
STEPWHAT CLAUDE DOESWHY IT MATTERS
1. Privacy PolicyWrites it from what your code actually collects and who it shares it with.California's CalOPPA requires one on any commercial site that collects personal information from Californians, whatever its size. GDPR and Brazil's LGPD list what it must say.
2. TermsDrafts the rules of using your site and buying from you.Often not required by law, but it is where your refund, liability and dispute rules live when something goes wrong.
3. Cookies and bannerLists every cookie and tag, decides if you need a banner, blocks trackers until Accept.In the EU, cookies that are not strictly necessary need consent first, and a box ticked in advance does not count. In the UK, since February 2026, analytics used only to improve your own site can run without it if you say so and offer an opt out. Ad tracking still needs it.
4. RefundsWrites the policy and puts it next to the buy or book button.Stripe requires refund, cancellation and contact details on your site. EU shoppers get 14 days to withdraw, and since 19 June 2026 a "withdraw from contract" button.
5. FormsCuts extra fields, links the policy, adds a separate unticked box for marketing.GDPR says collect only what you need. Consent to marketing has to be an active choice, not a box ticked for the visitor.
6. Tracking and embedsLists every pixel, script and embed, what it collects and if it needs consent.A tracker you never disclosed is the classic privacy problem. In California, sites have been sued over pixels and chat widgets under the state's wiretap law. A German court awarded damages over Google Fonts loaded from Google.
7. AccessibilityAlt text, contrast, keyboard use, labels, clear buttons, captions.US website accessibility lawsuits run in the thousands a year, 1,037 in the first quarter of 2026 alone, and the same barriers come up again and again: missing alt text, low contrast, forms you cannot use with a keyboard. The FTC made an overlay widget maker pay $1 million for claiming its tool made sites compliant.
8. Reviews and claimsRemoves reviews you cannot trace and claims you cannot prove.The FTC's rule on reviews (since October 2024) bans fake reviews, AI written ones included, with penalties of up to $53,088 per violation. The FTC also expects proof before you make an objective claim.
9. Business detailsShows who runs the site and how to reach you.EU and UK rules ask business sites for the name, a geographic address, an email and, where you have them, company and VAT numbers.
10. ImagesFlags images, fonts and icons that may not be yours.In the US, a court can award up to $30,000 per work used without permission, and up to $150,000 if the copying was willful.
11. Your local lawMatches the pages to the laws where you and your customers are.GDPR also covers non EU businesses that sell to or track people in the EU. California's CCPA mainly applies from $26.6 million in yearly revenue or data on 100,000 Californians, and about 20 US states have similar laws. India's DPDP rules apply in full from May 2027.
After Claude is done: the 15 minute review
Claude can only see the code. These checks need you.

  1. Read the Privacy Policy as a customer

    Does it name every tool you pay for or log into, like Google, Meta, Stripe or your email tool? If not, tell Claude.

  2. Test the banner in a private window

    Open the browser's developer tools on the Network tab, click Reject and reload. You should see no requests to google-analytics.com or facebook.com/tr.

  3. Put the mouse away

    Use only Tab and Enter on your homepage and main form. You should always see where you are.

  4. Answer every [TO CONFIRM]

    Those are the facts Claude would not guess. Fill them in, then send everything to your lawyer.

  5. Set a reminder

    Review the pages whenever you add a new tool, and at least once a year.

What to do in the next hour
DO THIS TODAY LEAVE OUT
Run the prompt on a copy of your site and approve each step. Copying another company's privacy policy. It describes their tools, not yours.
Delete fake reviews and claims you cannot prove. That needs no lawyer. An accessibility overlay widget. It does not fix the site underneath.
Fix the alt text, contrast and keyboard issues Claude found. A banner with a hidden or greyed out Reject button.
Book the lawyer review and send Claude's summary ahead. Publishing [TO CONFIRM] placeholders on the live site.
WANT IT AS A CLAUDE CODE SKILL? After your first run, ask Claude Code: "Save the prompt I used in this conversation as a personal skill called legal-check, so I can run it on any of my sites." It lands in ~/.claude/skills/legal-check/SKILL.md, and next time you type /legal-check in any project and fill in the brackets.
WANT MORE LIKE THIS? Every week we take a job a small business usually pays for, run it with Claude and turn it into something you can use the same day. The rest of the free resources are in the Easy Hive community classroom, under Free Resources.