The product looks finished. Checkout works. Then someone asks where your privacy policy is, or a payment processor wants a public refund policy, or a customer in the EU asks which subprocessors see their email. The question this page is for is narrow: in a business the AI built, who writes and owns the legal pages — and what has to stay true when the product changes?
Most AI build tools optimize for screens and routes, not for the documents strangers read before they pay you. Terms, privacy, cookies, and refunds are still your commitments. AI can draft them quickly; it cannot absorb liability, pick your governing law, or keep prose aligned with production analytics you added last Tuesday.
This page is not legal advice. Laws and processor rules depend on where you sell, what you collect, and how you market. Have a qualified lawyer review anything you publish before you take money from the public.
It compares four paths founders use today: an AI code editor you drive (Cursor, Windsurf, and similar), a prompt-to-app builder (Lovable, Bolt, and similar), an agency or freelancer, and an AI company operator such as Empyre. The broader post-build inventory — hosting, support, marketing, spend — lives in what happens after AI builds my app (read 2026-10-27). Customer contact and escalation are in who answers customers in an AI-built business (read 2026-10-28). Path choice before launch is solo founder: launch a SaaS without engineers (AI) (read 2026-10-26). What kills products when policy pages are missing or wrong is part of the story in why AI-generated apps die three weeks after launch. How a CLO role fits a staffed agent org is AI workforce that runs your company. Ship versus operate as a buyer frame is AI business builder that operates the company.
Why legal pages are a product surface, not boilerplate
Legal pages describe what your live product actually does: what data you collect, how long you keep it, who you share it with, how refunds work, and what users agree to when they click sign up or pay. When the app adds Google Analytics, a new auth provider, or Stripe Billing, the privacy policy and terms often need the same release notes the engineering team would write — even if nobody filed a ticket for "legal."
AI-generated templates fail in predictable ways: they mention cookies you never installed, promise GDPR rights your delete button does not implement, name subprocessors from last year's example, or copy refund language from a SaaS you do not run. Customers and processors compare the words on /privacy to the behavior in the app.
Ownership is separate from authorship. A builder may emit a privacy route; an operator's legal agent may draft terms; a lawyer may rewrite both. The founder (or the company entity behind the product) remains responsible for what is published.
Pages a small AI-built product often needs
Exact requirements depend on your market and counsel. This list is a practical starting point for SaaS, marketplaces, and booking tools — not a jurisdiction checklist:
Terms of service (or terms of use)
Rules for using the product: accounts, acceptable use, limitations of liability, dispute process, and how changes are notified.
Privacy policy
What personal data you collect, why, legal bases where relevant, retention, user rights requests, contact for privacy questions, and subprocessors that process data on your behalf.
Cookie or analytics notice
When you use cookies, local storage, or similar tracking beyond strictly necessary operation — including common analytics and ad pixels. Often paired with a consent banner where required.
Refund, cancellation, and billing policy
What happens when someone pays: trial rules, renewal, refunds, chargebacks, and how to cancel. Should match checkout, your payment processor settings, and what support is allowed to promise.
Imprint or business identification (where relevant)
Some markets require a visible legal entity name, address, and contact on consumer-facing sites — separate from a generic support form.
Marketplace or user-generated content add-ons
If strangers sell or post on your platform, terms often need seller rules, prohibited content, and takedown paths — beyond a single-product SaaS template.
What must stay in sync with the live product
Treat these as linked data — when the product changes, scan the legal pages before you announce the feature:
Data you collect
Sign-up fields, profile data, uploads, payment metadata, support threads, logs, and any new database columns. Privacy prose should name categories you actually store.
Payment processor and billing model
Stripe, Paddle, or other checkout: subscription versus one-time, trials, taxes, who is merchant of record, and refund windows configured in the dashboard — not only in marketing copy.
Subprocessors and infrastructure
Hosting, email, auth, analytics, error tracking, AI APIs, and customer-support tools. Privacy policies typically list vendors that receive personal data; add new ones when you wire them in production.
Cookies and client-side scripts
Every script that sets cookies or reads device identifiers belongs in your cookie notice and consent flow if you use one. Removing a pixel is also a legal-page update.
Authentication and third-party login
Google, Apple, or OAuth providers change what data you receive at sign-in; terms and privacy should reflect current scopes.
Age, geography, and industry
Children's products, health/finance adjacency, or country-specific rules may require sections templates do not include — counsel decides, not the build tool.
Support and marketing promises
If the homepage guarantees a refund the terms deny, or support email in the footer does not match the privacy contact, you have a product bug and a legal one.
Who writes and owns legal pages on each path
| Path | What the tool usually generates | Who owns publication and updates | Typical limits |
|---|---|---|---|
| AI editor you drive (Cursor, Windsurf, …) | Markdown or React routes when you prompt for them; generic templates unless you specify your stack and data flows | You (founder or your lawyer); you commit and publish | No scheduled legal review; drift when you add analytics or payments without revisiting copy |
| Prompt-to-app builder (Lovable, Bolt, …) | Often includes starter /privacy and /terms routes or exportable pages; quality varies by platform | You remain liable; export may leave pages behind when you leave the platform | Templates may not match your processor, subprocessors, or refund rules without manual edits |
| Agency or freelancer | Deliverable pages or copy doc if scoped; sometimes omitted from fixed-price MVPs | You publish; agency updates only under retainer or change order | Handoff without a "when product changes, update legal" runbook causes stale policies |
| AI company operator (e.g. Empyre) | Published copy describes a CLO role that drafts terms, privacy, and contract review for the product; pages ship toward launch with the build | You approve substance; entity behind the product remains responsible | Niche compliance, cross-border programs, and bespoke contracts still need human counsel; AI drafts are starting points |
Practical checklist before strangers pay you
Run this after the product works in production, before you widen access or turn on ads:
Inventory the live stack
List auth, database, hosting, email, analytics, payments, and AI vendors that touch user data in production — not only on a architecture diagram.
Match privacy to behavior
Walk sign-up, checkout, and account settings; every field and email should appear in the privacy policy or be removed from the product.
Match refunds to checkout
Refund policy linked from pricing and receipt emails; amounts and windows align with processor configuration and what support may grant.
Terms cover what you sell
Subscription terms, acceptable use, and limitation sections reflect your actual product — not a generic marketplace template.
Cookie notice matches scripts
View source or tag manager inventory; banner text and opt-out paths match what runs for logged-out visitors.
Footer links work
/terms, /privacy, and support or legal contact reachable without signing in; dates or version notes optional but helpful internally.
Lawyer review
Send drafts with your data inventory and processor agreements; publish only after counsel signs off for your markets.
Change process
Named owner (you, counsel, or operator workflow) for legal updates when you ship features that collect new data or change billing.
Limits — what AI and operators do not remove
Draft speed is not compliance. Models produce plausible prose; they do not know your Stripe Connect setup, your DPA with a host, or whether you sell to businesses only versus consumers in a specific country.
Translation multiplies risk. A brief in one language and legal pages in another need counsel in both if customers rely on them — product copy may be native while legal text still needs professional review.
Processor and ad platform enforcement is separate from your feelings about fairness. Accounts can be held until refund and privacy URLs exist and look consistent with the application — another reason to verify live pages, not only repository files.
Who answers customers covers privacy deletion requests and legal mail in the support queue; this page covers the published policies those threads must cite.
How this differs from the post-build checklist
What happens after AI builds my app lists legal pages as one row among hosting, auth, payments, support, and marketing. Use that page for week-one and month-one calendars; use this page when you are drafting, publishing, or updating terms and privacy specifically.
AI workforce that runs your company explains how a CLO fits eight executive roles and handoffs to engineering when policy must match a new feature. This page does not redraw the org chart — it stays on documents and ownership by build path.
Where Empyre fits (published capabilities only)
Empyre positions itself as an AI company operator with eight executive roles on schedules. Published copy on empyre.dev describes a CLO that handles terms, privacy policy, contract review, and e-signature for the legal surface a real product needs — alongside engineering that publishes code and a CSO that answers customers.
That is drafting and iteration inside an operated company, not a law firm retainer. You still choose what to sell, which markets to enter, and which drafts to publish after review. Empyre's published product copy also states that a brief written in a given language produces a product in that language — including legal pages and meta descriptions — written natively rather than machine-translated; identifiers in code stay English.
Public pricing on empyre.dev/pricing read 2026-10-29 lists Starter at $49 per month or $490 per year, Growth at $149 per month or $1,490 per year, Empyre at $299 per month or $2,990 per year, pay-as-you-go top-ups from $10, and copy stating customers pay into the company's own account with Empyre not taking a share of what the business earns. Legal drafting is part of that operator model; verifying behavior still requires reading the live pages on your company's address and counsel review for your situation.
If you are on an editor or builder path, Empyre is one alternative in the operator column — not a requirement. Honest limits apply: regulated industries, enterprise procurement, and cross-border programs need lawyers; no product removes founder liability for published terms.
Common questions
Does the AI that built my app also write my terms and privacy policy?
Sometimes it adds generic routes if you ask or if the builder includes templates. Accuracy and ongoing updates remain your job unless you hired counsel or bought an operator that schedules legal drafts — and even then you approve what ships.
Can I copy legal pages from another startup?
Risky. Their data practices, processors, and refund rules are not yours. Use drafts as structure only; have a lawyer adapt them to your live product.
When must legal pages exist?
Before you take money from the public is the practical bar — and many processors ask for URLs during onboarding. Free betas with accounts still collect personal data; privacy should exist before you widen access.
How is this different from what happens after AI builds my app?
That article is the full post-build checklist. This page is legal pages only — who writes them on each path, sync with product and payments, checklist, and limits.
What did you verify on 2026-10-29?
Empyre plan prices and no-revenue-share copy on empyre.dev/pricing; CLO and legal-page claims from published empyre.dev product positioning read 2026-10-29. No search volumes, difficulty scores, customer counts, or jurisdiction-specific legal conclusions stated. Competitor pricing not quoted on this page.
Try Empyre free for 3 days
Describe a business in plain words and watch eight AI agents build and deploy it. Starter is free for the first 3 days.
Related
Last updated 2026-10-29. Competitor descriptions reflect each product's publicly documented capabilities at that date; they change often, so check the source before relying on a detail.