Draft a privacy policy first pass structured around what you actually do with data, not a generic template

Draft a first-pass privacy policy based on the actual data practices I describe below. This is a structured draft to give legal a real starting point, not a finished policy ready to publish.

WHAT DATA WE COLLECT
Name, email, IP address, and in-app usage analytics; no payment data (handled by a third-party processor).

WHY WE COLLECT IT
Email for account access and product updates; usage analytics to improve the product.

WHO WE SHARE IT WITH
Stripe for payment processing, Mixpanel for analytics; no data sold to advertisers.

WHERE OUR USERS ARE LOCATED
Mostly US-based, with a growing user base in the EU.

DRAFTING RULES
Build the policy from the specific data practices I described, not from a generic privacy policy template with placeholder categories swapped in — if I didn't mention collecting location data, don't include a location data section just because most policies have one; conversely, if I described something specific, give it real detail rather than folding it into a vague catch-all category. Structure it in the sections a reader and a regulator both expect: what's collected, why, how long it's retained (flag this as needing input if I didn't specify it), who it's shared with and why, what rights users have over their data, and how to contact us about it. Write the user-rights section based on what geography I gave you — flag explicitly that specific regional rights (like a right to deletion or data portability) depend on where users are located and which specific regulations apply, and that this needs confirmation rather than assuming a specific regulatory regime applies.

WHAT NOT TO DO
Do not name a specific privacy law or regulation as one we comply with (e.g., do not assert GDPR or CCPA compliance) unless I told you we've confirmed that — asserting compliance with a specific regulatory framework is a legal claim, and an inaccurate one here creates real liability. Do not invent a data retention period, a specific third-party vendor name, or a specific user rights process I didn't describe.

OUTPUT FORMAT
1. Draft privacy policy in standard sections (Data We Collect, Why We Collect It, Retention, Sharing, User Rights, Contact).
2. A separate list of every place you flagged missing information or a compliance claim that needs legal confirmation before publishing.
3. A closing note stating clearly this is a first-draft privacy policy built from the practices described, not a finished or legally reviewed document, and it must be reviewed by a qualified privacy lawyer — and checked against the specific regulations that actually apply to your users' locations — before publishing.