Legal Text Engine
Legal Text Engine replaces a cookie-cutter GDPR policy generator with a small Cloudflare Workers app where every processing activity — what tool, what purpose, what legal basis, what data — is a structured record in D1, not hand-written prose. Three documents render from that same data:
- Privacy policy (public, Art. 13 GDPR) — DE + EN
- Cookie notice (public)
- RoPA — Verzeichnis von Verarbeitungstätigkeiten (internal, Art. 30 GDPR)
Cookie-cutter policy generators work from a checklist of services you pick, not from what’s actually running. That drifts from reality the moment a tool changes — a dropped processor, a new SaaS subscription — and nobody notices until an audit or a client asks. Legal Text Engine’s source of truth is the same structured data across all three documents, so a single edit to one processing activity keeps the public policy, the cookie notice, and the internal RoPA consistent with each other and with what’s actually in use.
How it works
Section titled “How it works”- D1 holds
businesses,domains,processors,processing_activities, and supporting lookup tables (legal bases, data categories, TOMs). - A publish gate blocks any activity still at
draftorlawyer-flaggedfrom reaching a public document — onlyself-reviewedorlawyer-confirmedactivities render. - The RoPA is stricter than the public documents: it reflects every activity regardless of review status (Art. 30 expects current reality, not “as of the last time someone remembered to publish”), and a fresh timestamped snapshot writes to R2 on every activity edit, not only on publish.
- A preview endpoint renders the full future-state document — draft activities included, each one tagged with its status — without ever touching the publish gate or the live route. It’s a review aid, not a publish.
Status
Section titled “Status”Built and deployed; not yet publishing live content. Every activity starts
at draft and stays there until reviewed — the publish gate exists
specifically so that step can’t be skipped.