Apache-2.0GeneralData protection
Tracks and monitors US state privacy legislation across all 50 states, DC, and territories. Covers enacted comprehensive privacy laws (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and subsequent enactments), pending bills, effective dates, and key requirement differences. Keywords: state privacy law, CCPA, CPRA, VCDPA, CPA, CTDPA, UCPA, multi-state.
Apache-2.0GeneralGeneral practice
Cross-jurisdictional analysis engine for the US state consumer privacy law patchwork (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, FDBR, MCDPA, ICDPA, INCDPA, TIPA, DPDPA, NJDPA, NHDPA, NDPA, KCDPA, MODPA, MCDPA-MN, RIDTPPA, and emerging laws). Use this skill whenever the user asks anything involving applicability of US state privacy laws, CCPA/CPRA compliance, multi-state privacy compliance, consumer rights requests (DSARs/access/deletion/correction/opt-out/appeal), notice-at-collection, sensitive personal information, sale or sharing of personal information, targeted advertising, profiling, automated decision-making at the state level, universal opt-out mechanisms (Global Privacy Control), risk assessments under state privacy laws, data broker registration, kids' or teens' privacy at the state level, employee/HR data privacy, B2B data privacy, gap analysis or remediation roadmaps for a US business, or drafting state-compliant privacy notices and disclosures. Trigger broadly whenever a US business asks 'do I need to comply with [state] privacy law?', 'what do I do about [right]?', 'how do I handle a consumer request from [state]?', or any variation. Also use when a federally-regulated entity (HIPAA covered entity / business associate, GLBA-regulated financial institution, COPPA-subject service, FERPA-regulated educational institution or ed-tech vendor, FCRA-touching consumer reporting agency or furnisher) asks how state privacy law overlays the federal regime — see `references/federal-overlays.md`. Do NOT use this skill for HIPAA / GLBA / COPPA / FERPA / FCRA standalone analysis (use a sectoral resource), GDPR-only questions, or non-US privacy regimes.
MITGeneralFinance
Use when drafting a non-binding term sheet for a priced VC investment round (Seed, Series A, or later). Covers all standard VC term sheet provisions including share type, pre-money/post-money mechanics, option pool, anti-dilution, liquidation preferences, protective provisions, board composition, ROFR/co-sale/drag, information rights, founder vesting, and the no-shop. Marks binding vs non-binding sections explicitly. Notes that DIFC and ADGM are increasingly the preferred jurisdictions for MENA tech VC rounds in preference to onshore UAE or KSA.
Apache-2.0GeneralData protection
Review vendor AI terms — agreement, addendum, or ToS AI provisions — against your governance positions; flag training-on-data, liability, model changes, and AI policy consistency. Use when user says "review this AI agreement", "check OpenAI terms", "what did we agree to with [vendor]", "vendor sent an AI addendum", "is this AI contract okay", or attaches vendor AI terms.
MITGeneralContracts
Checks the LEGAL/CONTRACTUAL paperwork status of agreements with a specific vendor across CLM, CRM, email, and document storage — what's signed, what's missing, what's expiring, what surviving obligations remain. Pulls together MSA, DPA, SOW, NDA, BAA, COI, SOC 2, pen-test attestation, sub-processor list, and addenda. Use when the user says what's our agreement status with [vendor], do we have an MSA/DPA with [vendor], what's signed with [vendor], when does [vendor]'s contract expire, what's missing in our [vendor] paperwork, audit our paperwork with [vendor], or onboarding/renewing a vendor and need a consolidated view. Tie-breaker vs operations:vendor-review — this skill answers "WHAT do we have signed?" (backward-looking, paperwork inventory). vendor-review answers "SHOULD we use them?" (forward-looking, buy/use decision). Both can be chained for renewal/onboarding. Do NOT use for cost analysis, TCO comparison, vendor-fit evaluation, or buy/replace decisions.
MITGeneralData protection
Use when a company needs to attach a data protection addendum (DPA) to a vendor or supplier agreement where the vendor may access, process, or store personal data on behalf of the company. Covers processor obligations, security requirements, sub-processing restrictions, audit rights, cross-border transfer mechanisms, and breach notification. Especially important for MENA entities subject to UAE PDPL, KSA PDPL, Egypt PDPL, or GDPR, where a written data processing agreement is legally mandatory.
Apache-2.0GeneralContracts
Use when the user has a vendor's published privacy policy (URL, PDF, or pasted text) and wants a fast triage assessment to decide whether deeper diligence is warranted. Produces a short structured report covering what the policy says about key data practices (collection, use, sharing, retention, transfers, rights) plus identification of red flags that warrant escalation to deeper review. Explicitly a first pass, not a full privacy assessment, DPA negotiation, or compliance certification.
Apache-2.0GeneralContracts
Draft and fill NVCA model documents — stock purchase agreement, certificate of incorporation, investors rights agreement, voting agreement, ROFR, co-sale, indemnification, management rights letter. Series A and venture financing contract templates. Produces signable DOCX files. Use when user says "Series A documents," "NVCA," "stock purchase agreement," "investors rights agreement," "voting agreement," or "venture financing docs." Includes lawyer-reviewed practice guides; see openagreements.org/editors.
MITGeneralCorporate
Use when drafting a vesting schedule for founder shares, employee options (ISO/NSO), or RSUs. Covers the standard 4-year monthly with 1-year cliff structure, alternative schedules (quarterly, annual, performance-based, hybrid), acceleration triggers (single vs double trigger), good-leaver/bad-leaver treatment, and the documentation chain (option plan, grant letter, exercise notice). Includes MENA-specific tax considerations (UAE 9% corporate tax, KSA, no income tax), US 83(b) election timing, and UK EMI/non-EMI treatment.