Privacy Policy Generator

The output has eight short sections: information collected, how it is used, cookies, third-party services, your rights, retention and security, changes, and contact. Your company name, website, contact email and effective date are filled in. The form also asks for a governing law, but the privacy policy text doesn't use it.

Several sentences are statements of fact about your site, and you must make sure each one is true before you publish:

• "We do not sell your personal data."
• That you collect names and emails directly, and IP address, browser type and pages visited through cookies and analytics.
• That you use analytics and advertising partners.
• That you keep data "only as long as necessary", which says nothing about how long that is.

If you run no ads, delete the advertising mention. If you sell products, the template says nothing about payment or delivery data, so you need to add it.

A privacy policy describes what you actually do, so start with an inventory, not the wording. One row for every place data enters your site:

Every row should appear somewhere in the finished policy. Plugins, embedded videos, chat widgets and form builders are the rows people most often forget.

GDPR can apply to you even if you are outside the EU, when you offer goods or services to people who are in the EU or monitor their behaviour there. The test is where the person is, not their nationality. If it applies, the template is missing the legal basis for each use of data, actual retention periods, a list of who receives data, and any transfers outside the EU.

CCPA applies to a for-profit business doing business in California that meets any one of these: annual gross revenue over $26,625,000 (the adjusted figure in force from 1 January 2025), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing personal information. Note the word "sharing". If your advertising partners use visitor data, ask a lawyer whether "We do not sell your personal data" is the full answer for you.

The generated policy is a template, not legal advice. Have a qualified lawyer review it if either law applies to you, or if you handle health, financial or children's data.

A compact policy organised around the inventory above, with retention periods and named recipients that the template leaves vague. Replace everything in [BRACKETS].