terms-of-use-privacy-review

Terms of Use & Privacy Policy Review

Matter context

Matter context. Check ## Matter workspaces in the practice-level CLAUDE.md. If Enabled is ✗ (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run /digital-ecommerce-legal:matter-workspace switch <slug> or say practice-level." Load the active matter's matter.md for matter-specific context and overrides. Write outputs to the matter folder at ~/.claude/plugins/config/claude-for-legal/digital-ecommerce-legal/matters/<matter-slug>/.

---

Purpose

Termos de Uso de plataforma digital (loja online, SaaS, marketplace) e sua Política de Privacidade devem estar alinhados com duas leis: o Marco Civil da Internet (Lei 12.965/2014) e a LGPD (Lei 13.709/2018). [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm; https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]

Esta skill revisa ambos os documentos contra esse framework. Identifica gaps, conflitos, e riscos regulatórios.

Jurisdiction assumption

Premissa de jurisdição (Brasil):

• Marco Civil (Lei 12.965/2014): Aplicável a "provedor de internet" (Art. 5º [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm]) — qualquer pessoa física ou jurídica que presta serviço de internet a usuários, incluindo lojas online e marketplaces. O Marco fixa responsabilidade civil dos provedores por conteúdo de terceiro (Art. 19 — isenção se cumprir seus Termos e Lei; Art. 20 — comunicação ao usuário responsável quando houver informações de contato [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm]; Art. 21 — responsabilidade subsidiária por violação da intimidade com cenas de nudez/atos sexuais privados quando, após notificação, o provedor deixar de indisponibilizar o conteúdo [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm]). Aplicável também guardar registros de conexão por 1 ano (Art. 13) e registros de acesso a aplicações de internet por 6 meses (Art. 15 [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm]). Direitos do usuário incluem privacidade (Art. 7º, I [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm]); Art. 9º trata de neutralidade de rede [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm].

• LGPD (Lei 13.709/2018): Aplicável a "controlador" (Art. 5º, VI [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]) e "operador" (Art. 5º, VII [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]). Loja online é controladora dos dados de cliente. Marketplace pode ser controlador ou operador dependendo do modelo. LGPD exige: base legal para cada finalidade (Art. 7º [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]), consentimento informado (Art. 8º [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]), transparência (Art. 9º [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]), direitos do titular (Art. 18 [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]), responsabilidade (Art. 42 [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]). Transferência internacional de dados pessoais exige cláusula-padrão contratual ou país com decisão de adequação (Art. 33 [verified: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709compilado.htm]).

No silent supplement. If a research query to the configured legal research tool (JusBrasil, Escavador) returns few or no results for a Marco Civil or LGPD requirement, report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking.

Load the playbook

Read ~/.claude/plugins/config/claude-for-legal/digital-ecommerce-legal/CLAUDE.md first. Any specific positions the team has on what constitutes acceptable Terms (e.g., limitation of liability approach, arbitration yes/no, user dispute handling) apply to this review.

The review

Part 1: Marco Civil Compliance

• Art. 19 — Safe harbor for user-generated content. Does the Terms say the platform is NOT liable for content posted by users unless the platform knew in advance and didn't remove it?
• Art. 20 — Notice to the responsible user. Does Terms explain communication to the user responsible for content when contact information is available?
• Art. 13 / Art. 15 — Logs and data retention. Does Terms say how long the platform keeps connection records and application access records? (Art. 13 = connection records for 1 year; Art. 15 = application access records for 6 months [verified: https://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm])
• Art. 7º, I — User privacy. Does the Terms respect user privacy? Does it disclose what monitoring happens?

Part 2: LGPD Compliance

• Art. 5º, VI/VII — Controller and operator. Who is the controller? Who is the operator? Is this clear?
• Art. 7º — Lawful basis for each purpose. For each data collection, is there a lawful basis (consent, contract, legal obligation, legitimate interest)?
• Art. 8º — Consent. If consent is the basis: is it informed? Separate from other contract terms? Can the user withdraw it?
• Art. 9º — Transparency. Does Terms disclose what data is collected, who it's shared with, and for how long?
• Art. 18 — Data subject rights. Does Terms acknowledge user's right to access, correct, delete, port, and object to data processing?
• Art. 33 — International transfers. If data goes to other countries, is that disclosed? Are there proper legal mechanisms?

Part 3: Marco Civil + LGPD alignment

• Does the Terms conflict with the Privacy Policy? (E.g., Terms says "we never share data" but Privacy Policy says "we share with partners.") 🔴 Blocking conflict.
• Does the Terms set Rules that violate LGPD? (E.g., "we reserve the right to delete your account without notice" — may violate Art. 18.) Flag for attorney judgment. [review]
• Is there a Data Processing Addendum (DPA)? (If users are businesses and platform processes data on their behalf, a DPA is needed under Art. 5º, VII.) If missing, flag.

Output

Format as a checklist summary + detailed findings. Highlight blocking issues (🔴), warnings (🟡), and clear items (✅).

What this skill does not do

• It doesn't review marketing claims for truthfulness.
• It doesn't audit code or data security.
• It doesn't negotiate with third-party vendors on your behalf.