Privacy Policy

A privacy policy written from what your site actually does - GDPR and CCPA sections included only where they apply.

100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.

Template, not legal advice. This produces a starting draft from standard clauses. It is not legal advice, and it cannot know everything your business does. Read every paragraph before you publish it - a policy that describes data collection you do not do is as much of a problem as one that omits collection you do.

Start from an example

Fills every answer with a worked example you can edit. Pick the one closest to your business.

0 of 5 details filled
Your business
GDPR expects a postal address, not just an email.
Who your visitors are

This decides whether the GDPR rights section, the California section, or both appear.

This decides which rights section is included. GDPR is the stricter of the two.
What your site actually does

Each of these adds or removes a section. Answer honestly - a policy claiming collection you do not do is as much of a problem as one that hides collection you do.

Who you share data with
Naming them is a GDPR requirement, and it is what makes a policy read as real rather than copied.

Privacy Policy

12 sections · 738 words · updates as you type

Privacy Policy

Last updated: 12 November 2026

Who we are

[Your business name] operates [your website] ("the site"). This policy explains what personal information we collect, why we collect it, and what you can do about it.

If you have any question about this policy, or about information we hold, contact us at [your contact email] or write to us at [your business address].

What we collect

We collect the following:

  • Usage data. Pages viewed, approximate location derived from your IP address, referring site, device type and browser. This is collected in aggregate to understand how the site is used.
  • Anything you send us. If you email us or use a contact form, we keep that correspondence so we can answer it.

We do not collect anything not listed here, and we do not sell personal information.

Why we collect it

  • To provide the site - so pages load, forms submit and the service works.
  • To understand what is used - so we can fix what is broken and improve what is not.

Under the UK GDPR and EU GDPR our lawful bases are: performance of a contract (running your account and taking payment), legitimate interests (keeping the site working and secure), legal obligation (financial records), and consent (marketing email and any non-essential cookies). Where we rely on consent you can withdraw it at any time.

Who we share it with

We share information with the service providers that run parts of this site for us - hosting, email delivery, and payment processing where relevant.

We require every provider to use the information only to deliver the service to us. We also disclose information where the law requires it, and if the business is sold, to the buyer as part of that sale.

Cookies

Analytics cookies tell us how the site is used, in aggregate.

Non-essential cookies are only set once you agree to them, and you can change or withdraw that choice at any time. You can also block or delete cookies in your browser settings.

How long we keep it

We keep personal information only as long as we need it:

  • Correspondence: kept while it is useful for support, then deleted.
  • Analytics: kept in aggregate; individual records expire according to our analytics provider settings.

Your rights

Under data protection law you have the right to ask us for a copy of the information we hold about you, to have it corrected, to have it deleted, to object to how we use it, to restrict our use of it, and to receive it in a portable format. Where we rely on your consent, you can withdraw that consent at any time.

To exercise any of these, email [your contact email]. We will respond within one month. If you are not satisfied with our response you can complain to your national data protection authority - in the UK that is the Information Commissioner's Office.

California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to request a copy of it, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information.

We do not sell personal information. To make a request, email [your contact email]. We will not treat you differently for exercising any of these rights.

Children

This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us at [your contact email] and we will delete it.

Security

We take reasonable technical and organisational measures to protect personal information, including encryption in transit and access controls on the systems that hold it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security - but if a breach affects your rights we will tell you and the relevant authority as the law requires.

International transfers

Some of our service providers are based outside the UK and the European Economic Area. Where personal information is transferred outside those areas, we rely on an adequacy decision or on standard contractual clauses approved for that purpose, so that your information keeps the same protection it has at home.

Changes to this policy

We may update this policy as the site changes or as the law does. The current version is always on this page, and the date below tells you when it last changed. If a change materially affects how we use your information, we will say so more prominently than a silent edit.

Generated from a template. Not legal advice - read it before you publish or sign it.

Other documents you can generate

Most sites need more than one. A privacy policy without terms, or terms without a refund policy, leaves the obvious gap.

Terms and ConditionsTerms of service built around what you actually sell - goods, subscription, downloads or services.Cookie PolicyA cookie policy with a real table - each cookie named, with its purpose and how long it lasts.Cookie Consent BannerGenerates a working consent banner - blocks tagged scripts until consent, Google Consent Mode v2, no dark patterns.Refund and Return PolicyA refund policy customers can follow and payment processors accept - windows, exclusions and statutory rights in plain words.Website DisclaimerA disclaimer that names the actual risk your site carries, plus affiliate and sponsorship disclosures.Accessibility StatementA WCAG accessibility statement that states what you actually meet, names known issues, and gives people a route to report problems.Non-Disclosure AgreementA mutual or one-way NDA with a real purpose clause, standard carve-outs and a defined term.Freelance ContractAn independent contractor agreement that pins down scope, revisions, IP ownership and what happens when payment is late.Data Processing AgreementA GDPR Article 28 processor agreement with the eight mandatory clauses and a filled-in processing schedule.W-9 FormFills a substitute Form W-9 in your browser - your TIN is never uploaded, stored or sent anywhere.1099-NEC Contractor SummaryPrepares a 1099-NEC recipient statement and a payer summary - with a straight answer about what you can and cannot print yourself.Shipping PolicyA shipping policy Shopify and Amazon sellers can publish - origin, times, tracking, duties and who pays.DSAR Form GeneratorA data-delete and access request page you can host - GDPR and CCPA wording, no upload, no signup.

Jump to the next useful tool without leaving your flow.

See more

About this tool

Any website, app or online shop that collects personal data needs a privacy policy - and an IP address in a server log already counts. This generator writes one from your answers: which services receive visitor data, why you collect it, how long you keep it and how people use their rights. It handles GDPR and CCPA properly rather than with a region switch: GDPR needs a lawful basis for each purpose and a list of your processors, while CCPA needs a "do not sell or share" route and a promise not to retaliate. Clauses that do not apply to you are left out instead of padded in. Write it before launch, and update it whenever you add a tool that touches visitor data. Your answers are processed in your browser and are never uploaded.

How to use this tool

  1. Describe your site and contactEnter the business or site name, the address and the email people should use for privacy questions.
  2. Say what you collect and who receives itTick the data you collect and the services that process it - payments, email, analytics, ads - so each one is named.
  3. Publish it in the footerDownload the policy, read it through, and link it from your footer, checkout and app store listing.

What a privacy policy has to explain

Privacy laws such as the GDPR in the UK and EU and state laws such as California's CCPA/CPRA share a core idea: people must be told what personal data you collect, why, who you share it with, how long you keep it and what rights they have over it. A privacy policy is where that explanation lives.

Most of the work is being specific. "We may share data with partners" tells a reader nothing; "we use Stripe to take payments and Mailchimp to send our newsletter" tells them exactly where their details go. The questionnaire asks for those names so the finished policy describes your real setup.

Key features

  • Lists the actual services that receive personal data, such as payment, email and analytics providers.
  • Includes data-subject rights wording for visitors in the UK, EU and US states with privacy laws.
  • Covers retention, children's data and international transfers only when your answers make them relevant.
  • Ready to link from your footer, checkout and app store listing.

Common uses

  • Launching a website with a contact form, newsletter sign-up or analytics.
  • Publishing an app that the Apple App Store or Google Play requires a privacy policy URL for.
  • Opening an online shop where payment and delivery details are collected.
  • Updating an old policy after adding new tools such as a chat widget or ad pixel.

Tips for better results

  • Open your site’s developer tools and list every third-party script before you start - each one is a processor the policy should name.
  • Link the policy from every page footer and from any form that collects data.
  • Add the date of the last update at the top, so returning visitors can see when it changed.

Mistakes to avoid

  • Copying a policy from a bigger site and inheriting data practices you do not have - every untrue line is a misrepresentation.
  • Claiming GDPR and CCPA compliance without stating a lawful basis or a "do not sell or share" route.
  • Forgetting to update the policy after adding a chat widget, ad pixel or new email tool.

Frequently asked questions

If it collects any personal data - a contact form, newsletter sign-up, analytics cookies or an order - it generally does. Many third-party services, including Google Analytics and the app stores, also require one in their terms.

In the footer of every page, and next to any form that collects personal data, such as checkout, sign-up and contact forms. App stores also ask for a public URL to it.

Whenever you start collecting new data, add a new service that receives it or change how long you keep it - and review it at least once a year. Note the last-updated date at the top.

No. It assembles a draft from standard clauses, and every page says so above the preview. Beyond regulators, the practical cost is commercial: Apple and Google both refuse app submissions without a reachable policy URL, Google Ads disapproves accounts, and payment processors ask for it during onboarding.

Broadly, anyone running a website, app or shop that collects a single piece of personal information - and an IP address in a server log already counts. The best time to do it is before launch, and again whenever you add a tool that touches visitor data.

Copying a policy from a bigger site. You inherit their data practices on paper - the analytics they run, the payment processor they use, the children clause they need - and every line that is not true of you is a misrepresentation you published deliberately.

Most people need Cookie Policy and Terms and Conditions as well. They cover the gaps this one does not.

Related guides