Reads the privacy notice in your repo against 16 rules from GDPR Articles 13 and 14, flags template placeholders, and tells you when the notice itself has gone stale. Runs entirely in your browser — nothing is uploaded.
Sweep the whole workspace and keep the report — $29 once
$29 once · one licence key per person or CI seat · Counsel reviewing one notice bills about €250 an hour.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
VS Code MarketplacenpmMCP server (npx)Docker Hubext install ReadyStack.gdpr-privacy-notice-lint npx @readystack/gdpr-privacy-notice-lint <file> npx @readystack/gdpr-privacy-notice-lint --mcp
Team? One key for every ReadyStack linter, 5 seats, $149 once
Sweeping every notice in the workspace in one pass and writing a dated evidence report you keep
One payment, one licence key for this tool. The key is shown right after payment.
A law firm reading one privacy notice against Articles 13 and 14 bills about €250 an hour; this runs in about a second.
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.
Six disclosures that GDPR Articles 13 and 14 require were missing from the privacy.md of a two-person SaaS shipping to EU users: no legal basis, no retention period, no route to a supervisory authority, no Article 46 safeguard, five of the six data subject rights never named, and [Your Company] still sitting in paragraph three.
That file is not unusual. It is the file most small teams have: someone asked an assistant for a privacy policy in the first week of the company, pasted the answer into the repository, and shipped. It reads well, with headings that sound right — Information We Collect, How We Use Information, Sharing, Security. It is also the first document a supervisory authority asks for when a user complains.
GDPR Privacy Notice Lint is a VS Code extension and a free web page that read that file the way the article text reads it: as a list of disclosures that are either present or absent. Sixteen rules, each carrying its article number. Open the notice, run the command, and every missing disclosure lands in the Problems panel on a line you can click.
Run it against the policy shipped as the dirty fixture and it returns 17 findings: 11 errors and 6 warnings. No controller is named as a legal entity and no address or mailbox is given, both required by Article 13(1)(a). There is no legal basis anywhere in the file, which Article 13(1)(c) requires for every purpose. Retention says the company keeps data "as long as necessary", which is not the period Article 13(2)(a) asks for. The rights section offers account access and a contact form; rectification, erasure, restriction, portability and objection are absent, so five of the six rights under Articles 15 to 21 are missing, and nobody is told they may withdraw consent or complain to a supervisory authority under Article 77.
The warnings are the ones a reader skims past. No data protection officer contact, and no statement that none was designated. No mention that data leave the EEA, and no Article 46 safeguard for the partners who "help us operate our website". Nothing about automated decision-making. And the header: last updated 3 March 2021, which the date rule reports as 2020 days old, past the 730-day mark. The clean fixture returns 0 findings, so green means something.
Ask a chatbot to review the same file and it will rewrite the prose. It will not count the six rights, because counting is not what it is doing, and it cannot compare the date in your header to today. Sixteen deterministic rules give the same answer twice, with an article number and a line number attached.
Why now: infringements of Articles 12 to 14 sit in the higher tier of Article 83(5), up to €20 million or 4% of total worldwide annual turnover, whichever is higher. And the clock is not yours. Once a person asks about their data, Article 12(3) gives you one month to answer, counted from the day the mail arrives — and the first thing that answer gets measured against is the notice you published.
Checking the file open in your editor is free, forever: all 16 rules, every finding, no key, no run limit. The licensed command cuts on a different axis — scope and ownership. It sweeps every notice in the workspace in one pass and writes a dated evidence report you keep, $29 once, one key per person or CI seat. A law firm reading one notice against Articles 13 and 14 bills about €250 an hour, for one version of one file.
It is a checklist, not a lawyer. It cannot tell you whether the legal basis you chose is the right one. It can tell you, in about a second, that you never wrote one down.
It reads a privacy notice in your repository and checks it against 16 rules drawn from GDPR Articles 13, 14, 22, 46 and 77. Each missing disclosure appears in the Problems panel with its article number and a line. On the assistant-written fixture shipped with it, the engine returns 17 findings: 11 errors and 6 warnings.
Solo founders and small engineering teams shipping a SaaS, app or docs site to EU users, who keep privacy.md in the repository beside the code. It is for the person who pasted an assistant-written policy into that file two years ago and has not opened Article 13 since.
A chatbot rewrites the prose. It does not count the six rights that Article 13(2)(b) requires, and it cannot compare the date in your header to today, so it will not tell you a notice is 2020 days old. These 16 rules are deterministic: same file, same findings, with article numbers attached.
Checking the notice open in your editor is free forever: all 16 rules, every finding, no key and no run limit. The licensed command works on a different axis, scope and ownership. It sweeps every notice in the workspace in one pass and writes a dated evidence report you keep, for $29 once.
A law firm reading one notice against Articles 13 and 14 bills at counsel's hourly rate, about €250 an hour, and gives you an answer for that one version of that one file. The exposure behind it is Article 83(5): up to €20 million or 4% of total worldwide annual turnover.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. GDPR Privacy Notice Lint checks the file you open against 16 rules, each naming its legal or official basis, from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →