≈2.6k tokens on demand. Your agent reads this file only when SKILL.md points to it.
Legal Document Checklists
Purpose: Clause-coverage checklists for legal document review.
Read when: Verifying clause coverage during the SCAN phase.
Terms of Service (利用規約) Checklist
Required Clauses
| # |
Clause |
Risk (if missing) |
Statute (Japan) |
| T-01 |
Service definition and scope |
Medium |
- |
| T-02 |
Eligibility and age restrictions |
High |
民法 第5条 (minor's legal acts) |
| T-03 |
Account registration and management responsibility |
Medium |
- |
| T-04 |
Fees and payment terms |
High |
特商法 第11条 |
| T-05 |
Prohibited conduct |
Medium |
- |
| T-06 |
Intellectual property ownership |
High |
著作権法 |
| T-07 |
User-generated content (UGC) handling |
High |
著作権法・プロバイダ責任制限法 |
| T-08 |
Disclaimers and limitation of liability |
High |
消費者契約法 第8条・第10条 |
| T-09 |
Service change, suspension, and termination |
Medium |
- |
| T-10 |
Procedure for amending the terms |
High |
民法 第548条の4 (amendment of standard-form contracts) |
| T-11 |
Contract termination and withdrawal |
Medium |
消費者契約法 |
| T-12 |
Governing law |
Low |
法の適用に関する通則法 |
| T-13 |
Dispute resolution (jurisdiction / ADR) |
Low |
民事訴訟法 |
| T-14 |
Anti-social-forces exclusion clause |
Medium |
各都道府県暴力団排除条例 |
| T-15 |
Severability clause |
Low |
- |
Recommended Clauses
| # |
Clause |
When applicable |
| T-16 |
Third-party service integrations |
APIs / external integrations exist |
| T-17 |
Beta / experimental-feature disclaimer |
New-feature rollouts |
| T-18 |
Data export / portability |
SaaS / subscription |
| T-19 |
SLA (service-level agreement) |
B2B SaaS |
| T-20 |
Force Majeure |
Recommended for all services |
Privacy Policy Checklist
Japan (Act on Protection of Personal Information / 個人情報保護法)
| # |
Clause |
Risk (if missing) |
Statute |
| P-01 |
Name and contact of the handling business operator |
High |
個情法 第32条 |
| P-02 |
Specification and notice of purpose of use |
High |
個情法 第17条・第21条 |
| P-03 |
Categories of personal information collected |
High |
個情法 第21条 |
| P-04 |
Third-party provision: whether and under what conditions |
High |
個情法 第27条 |
| P-05 |
Joint use: scope and purpose |
Medium |
個情法 第27条第5項第3号 |
| P-06 |
Provision to contractors / processors |
Medium |
個情法 第25条 |
| P-07 |
Handling disclosure and similar requests from data subjects |
High |
個情法 第33条 |
| P-08 |
Outline of safety management measures |
Medium |
個情法 第23条 |
| P-09 |
Use of cookies / external transmission |
High |
電気通信事業法 第27条の12 |
| P-10 |
Retention period of personal information |
Medium |
- |
| P-11 |
International data transfers |
High |
個情法 第28条 |
| P-12 |
Handling of sensitive personal information (要配慮個人情報) |
High |
個情法 第20条第2項 |
| P-13 |
Children's personal information |
Medium |
- |
| P-14 |
Notice procedure for policy changes |
Medium |
- |
Additional GDPR Requirements
| # |
Clause |
Risk (if missing) |
Reference |
| G-01 |
Lawful basis for processing (Art. 6) |
High |
GDPR Art. 6 |
| G-02 |
List of data-subject rights |
High |
GDPR Art. 12–22 |
| G-03 |
DPO (Data Protection Officer) information |
Medium |
GDPR Art. 37–39 |
| G-04 |
Right to data portability |
High |
GDPR Art. 20 |
| G-05 |
Right to erasure ("right to be forgotten") |
High |
GDPR Art. 17 |
| G-06 |
Automated decision-making and profiling |
Medium |
GDPR Art. 22 |
| G-07 |
Data-breach notification (within 72 hours) |
High |
GDPR Art. 33 |
| G-08 |
Safeguards for international transfers (SCC, etc.) |
High |
GDPR Art. 46 |
Additional CCPA / CPRA Requirements
| # |
Clause |
Risk (if missing) |
| C-01 |
Opt-out right for "sale of personal information" |
High |
| C-02 |
"Do Not Sell My Personal Information" link |
High |
| C-03 |
Disclosure of information categories from the last 12 months |
Medium |
| C-04 |
Non-discrimination against consumers |
Medium |
| C-05 |
Distinction between "sharing" and "selling" of information |
Medium |
Tokushoho Notation Checklist (特定商取引法に基づく表記)
| # |
Item |
Required / Recommended |
Reference |
| S-01 |
Business operator's name (company or individual) |
Required |
特商法 第11条第1号 |
| S-02 |
Name of representative or responsible person |
Required |
特商法 第11条 |
| S-03 |
Address |
Required |
特商法 第11条第2号 |
| S-04 |
Telephone number |
Required |
特商法 第11条第3号 |
| S-05 |
Email address |
Recommended |
- |
| S-06 |
Selling price (tax-inclusive display) |
Required |
特商法 第11条第4号 |
| S-07 |
Shipping fees and handling charges |
Required |
特商法 第11条第4号 |
| S-08 |
Payment methods and timing |
Required |
特商法 第11条第5号 |
| S-09 |
Product / service delivery timing |
Required |
特商法 第11条第6号 |
| S-10 |
Return and cancellation policy |
Required |
特商法 第15条の3 |
| S-11 |
Application withdrawal and termination conditions |
Required |
特商法 第11条 |
| S-12 |
Operating environment (digital content) |
Conditionally required |
特商法 第11条 |
Review Result Template
Use this Japanese template when producing the review output:
## 条項網羅性チェック結果
**文書:** [文書名]
**チェックリスト:** [使用チェックリスト名]
**日付:** YYYY-MM-DD
| # | 条項 | 状態 | リスク | コメント |
|---|------|------|--------|---------|
| T-01 | サービスの定義 | ✅ 充足 | - | - |
| T-02 | 利用資格 | ⚠ 不十分 | Medium | 年齢制限の明記なし |
| T-03 | アカウント管理 | ❌ 欠落 | High | 条項の追加が必要 |
**充足率:** X/Y (Z%)
**High リスク欠落:** N件
Dangerous Clause Patterns
Flag any of the following patterns as High risk:
| Pattern (source phrase) |
Problem |
Recommended fix |
| 「一切の責任を負わない」 |
Likely invalid under 消費者契約法 第8条 |
Limit liability to a reasonable scope |
| 「当社の判断で自由に変更」 |
May conflict with 民法 第548条の4 |
Specify amendment procedure and notice period |
| 「すべての権利を譲渡」(UGC) |
Copyright concern and user pushback |
Switch to a license-grant model |
| Third-party provision without consent |
Violates 個情法 第27条 |
Obtain consent or document an exempting ground |
| No cookie notice |
Violates 電気通信事業法 第27条の12 |
Add a banner aligned with the external-transmission rule |
| No governing-law / jurisdiction clause |
Uncertainty in disputes |
Add an explicit governing-law / jurisdiction clause |
Recipe Behavior Detail (SKILL.md excerpt)
| Recipe |
Subcommand |
Default? |
When to Use |
Read First |
| DPA Review |
dpa |
|
Data Processing Agreement review. Identify role pairing (controller/processor/sub-processor) and transfer geography first. Walk Art. 28(3) mandatory clauses, SCC module selection, Schrems II Transfer Impact Assessment, audit-rights scope. Hand implementation gaps (sub-processor list page, breach SLA pipeline, encryption-key custody) to Cloak; framework mapping (SOC2 vendor management, ISO 27001 supplier relationships, HIPAA BAA equivalence) to Canon[regulatory]; codebase verification of DPA-promised controls to Canon. |
reference/dpa-review.md |
| EULA Review |
eula |
|
End User License Agreement review. Identify license type (perpetual / subscription / SaaS / embedded SDK / OSS / dual) and governing-law jurisdiction first. Walk grant scope, restrictions (including AI-training clauses), IP ownership, warranty/indemnity, OSS notices. Apply jurisdiction-specific enforceability tests (US unconscionability, EU UCTD/Software Directive Art. 6 interoperability carve-out, Japan Consumer Contract Act). Hand telemetry implementation to Cloak; OSS-license codebase audit to Canon; license-key/audit-log endpoints to Builder. |
reference/eula-review.md |
| Cookie Consent |
cookie |
|
Cookie banner and cookie policy review (ePrivacy, GDPR consent, IAB TCF v2.2, categorization). Identify target jurisdictions (EU/UK/CH/CA/CO/JP/etc.) and CMP/TCF participation first. Walk banner UX (equal Reject-All prominence, no pre-ticked, no cookie wall, withdraw path), per-cookie categorization (strictly necessary / functional / analytics / marketing), policy-vs-scanner diff. Verify per-jurisdiction logic (EU opt-in, US-state opt-out + GPC honoring, JP APPI personally-referable-info rule). Hand CMP integration and conditional script loading to Cloak; runtime verification to Canon gdpr; banner copy plain-language pass to Prose. |
reference/cookie-consent.md |
| App Store Disclosures |
appstore |
|
Mobile app store disclosure review covering DSA Trader / DMA Anti-Steering / 5.1.2(i) third-party-AI consent / Sign in with Apple / Google Play AI labeling / EAA accessibility statement. Identify target stores (iOS / Android), jurisdictions (EU triggers DSA + DMA + EAA), feature scope (third-party AI usage / external purchase / IAP / generative content). Walk: (1) DSA Trader Status alignment between App Store Connect / Play Console and ToS operator; (2) DMA external-purchase wording and CTF disclosure for EU iOS; (3) 5.1.2(i) third-party-AI consent screen — must be provider-named (e.g., "OpenAI"), describe shared data, offer explicit accept/decline; on-device inference (Foundation Models / Gemini Nano) exempt; (4) Sign in with Apple language when third-party SSO present (Guideline 4.8); (5) Google Play AI-Generated Content visible-label policy alignment and in-app reporting/flag mechanism; (6) EAA accessibility statement wording. Hand consent-UI implementation to Native via Cloak; flow-level legal text plain-language pass to Prose; codebase verification to Canon[regulatory] / Canon. Cite specific deadlines (2025-11-13 5.1.2(i), 2025-02-17 DSA enforcement, 2026-01-01 CTF unification, 2025-06-28 EAA). |
reference/legal-checklists.md |
