Effective Date: {Effective Date}
Last Updated: {Last Updated Date}
1. Introduction
{Company Name} ("we", "us", or "our") operates {Website URL} and provides the products and services described on that site (collectively, the "Service"). We are the entity responsible for determining how and why your personal information is processed.
Under the GDPR, we act as the "data controller" of your personal information.
Under the UK GDPR and the Data Protection Act 2018, we act as the "data controller" of your personal information.
Under US state privacy laws we are the "controller" of your personal information, or the "business" where the CCPA (as amended by the CPRA) applies.
This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it. It applies to anyone who uses the Service, regardless of where they are located.
If you do not agree with this Privacy Policy, please do not use the Service.
Definitions. For purposes of this Privacy Policy:
- "Personal information" (also "personal data") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined under applicable data protection law.
- "Sensitive personal information" is the subset of personal information that receives heightened protection under applicable law, as defined in Section 2.
- "Processing" means any operation or set of operations performed on personal information, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, transmission, dissemination, restriction, erasure, or destruction.
- "Service" has the meaning given in the opening paragraph of this Section.
- "You" means the individual whose personal information is described in this Privacy Policy.
Under the CCPA (as amended by the CPRA), "sale" means disclosing personal information for monetary or other valuable consideration, and "share" means disclosing it to a third party for cross-context behavioral advertising, with or without monetary consideration.
About this section
What's in this section
Anchors the policy to a specific legal entity. Regulators use the named entity, not the brand, to determine jurisdiction; users use it to determine whom to bring a claim against.
Why this section is here
Identifies you as the data controller and sets the policy's scope. Without this, an enforcement body has no way to attribute the policy to a specific entity, and users can't determine which legal regime applies.
Common mistake
Hiding behind a brand name. Use the legal entity name and the operating URL, the same names that appear in your terms of service and corporate filings.
2. Information We Collect
Notice at Collection. Consistent with the CCPA (as amended by the CPRA), we provide notice at or before the point of collection of the categories of personal information collected and the purposes for which they will be used. This Privacy Policy may form part of our notice at collection. Where required, we also provide additional just-in-time notices, cookie consent banners, or privacy-choices links at the specific point where personal information is collected. If we begin collecting additional categories or use personal information for materially different purposes, we will provide updated notice at the time of collection.
We collect the following categories of personal information:
Information you provide to us directly:
- Identity and contact information, including your name, email address, phone number, postal address, and similar identifiers.
- Account information, including your username, password, profile preferences, and account settings.
- Payment information, processed by our third-party payment processors. (Confirm whether you receive and store full payment card numbers on your own systems. If you do not, state so explicitly here; if you do, describe your PCI DSS-compliant protections.)
- Communications you send us, including support requests, survey responses, and content you submit through the Service.
Information we collect automatically:
- Device and connection information, including IP address, browser type, operating system, device identifiers, and language settings.
- Location information, including approximate location derived from your IP address (typically at the city or region level) and, where you grant permission, precise location data from your device's GPS or similar sensors.
- Usage information, including pages you visit, features you use, the time and duration of your visits, and the referring URL.
- Cookies and similar technologies, as described in Section 5.
If you use our mobile applications, we may collect additional information specific to mobile devices:
- Device advertising identifiers, including IDFA (Apple) or AAID (Google), where you have not opted out through your device settings.
- Permission-based data, such as access to your camera, microphone, contacts, calendar, photos, or files, only when you grant the relevant permission. You can revoke permissions through your device settings at any time.
- Precise location, only when you grant location permission. You can revoke this permission through your device settings at any time.
- Push notification tokens, used to deliver in-app and push notifications you have opted into. You can opt out through your device settings or in-app preferences.
- In-app activity and crash data, such as features used, content viewed, in-app purchases, and diagnostic reports used for troubleshooting.
- App version, operating system version, and device model, used for compatibility, performance optimization, and security.
This information is processed for the purposes described in Section 3 and is subject to the same rights, retention, and disclosure practices as other personal information.
Information we receive from third parties:
- Information from third-party authentication providers if you sign in using a service such as Google or Apple.
- Information from analytics, advertising, and fraud-prevention services that help us operate and improve the Service.
Inferences:
We may derive inferences from the personal information described above, such as predicted preferences, behavior patterns, or product affinities. Where applicable law treats inferences as a separate category of personal information, we treat them as personal information for purposes of this Privacy Policy.
Sensitive personal information:
We collect sensitive personal information only where specifically disclosed in this Policy and only where necessary for the relevant purpose, with your consent where required by applicable law. Sensitive personal information has overlapping but not identical definitions across jurisdictions.
"Special categories" of personal data (Article 9) include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation.
Under the CCPA (as amended by the CPRA) and similar US state privacy laws, "sensitive personal information" includes the categories above and may additionally cover government-issued identifiers, account log-in and financial account credentials, precise geolocation, contents of mail and communications, and certain other categories defined by the relevant law.
Where the categories already described above include sensitive personal information (for example, account credentials used for authentication, payment information you provide, or precise location when you grant permission), we process that information only as necessary to deliver the Service, for the limited purposes for which it was provided, and with the additional protections required by applicable law. Where applicable law provides this right, you may request that we limit our use of sensitive personal information as described in Section 7.
Sources of personal information. The categories of sources from which we collect personal information are:
- Directly from you, when you create an account, make a transaction, communicate with us, or otherwise interact with the Service.
- Automatically from your device and use of the Service, including through cookies, SDKs, server logs, and other tracking technologies.
- From third-party authentication providers (such as Google or Apple) when you choose to sign in using their service.
- From service providers and processors, including analytics platforms, advertising networks, payment processors, and fraud-prevention services.
- From publicly available sources, where permitted by applicable law.
- From other users, where applicable (for example, when another user refers you, sends you content, or names you in their account).
Some personal information is required by law or under our contract with you, such as the information needed to create an account, complete a purchase, or meet tax and accounting rules. Where information is required and you do not provide it, we may be unable to provide the Service or complete the relevant transaction.
About this section
What's in this section
The section regulators scrutinize most. The split between data you ask for, data you capture passively, and data you derive is what tells them whether your disclosures match your actual practice. Generic categories invite enforcement; specific ones do not.
Why this section is here
Required under GDPR Art. 13(1)(c), CCPA §1798.100(a), and parallel provisions in LGPD, PIPEDA, and APPI. Regulators expect specific category disclosure, not generic terms.
Common mistake
Marketing terms like 'your information' or 'usage details.' Use regulator-recognized categories: identity, financial, device, location, communications.
CCPA category disclosure →3. How We Use Your Information
We use the personal information we collect for the following purposes:
- To provide, operate, and maintain the Service, including processing transactions, fulfilling orders, and providing customer support.
- To create and manage your account.
- To communicate with you about your account, the Service, and any changes to our terms or policies.
- To send you marketing communications, where permitted by applicable law and subject to your preferences.
- To improve the Service, develop new features, and conduct research and analytics.
- To detect, investigate, and prevent fraud, security incidents, and other prohibited or illegal activities.
- To comply with our legal obligations, enforce our agreements, and protect our rights and the rights of others.
We rely on one or more of the following legal bases to process your personal information:
- Performance of a contract, for providing and operating the Service, processing transactions, creating and managing your account, and providing customer support.
- Consent, for sending marketing communications and for any processing that requires your specific, informed agreement under applicable law. You can withdraw consent at any time as described in Section 7.
- Legitimate interests, for improving the Service, developing new features, conducting research and analytics, detecting and preventing fraud, and securing our systems, where these interests are not overridden by your rights and freedoms.
- Legal obligation, for complying with applicable laws, responding to lawful requests from authorities, and meeting our regulatory and tax obligations.
- Vital interests, only in limited circumstances where processing is necessary to protect a person's life or health. (Add "or public interest" as a separate basis here only if your service is operated by or on behalf of a public authority performing a task in the public interest under GDPR Article 6(1)(e); most commercial services should not include it.)
Where we rely on legitimate interests, you can request information about our balancing assessment by contacting us.
Marketing communications. Where we send you marketing communications, we obtain consent or rely on legitimate interests as permitted by applicable law. You can opt out of marketing communications at any time by:
- Clicking the "unsubscribe" link in any marketing email,
- Adjusting your communication preferences in your account settings, or
- Contacting us using the details in Section 13.
Opting out of marketing communications does not affect transactional or service-related communications about your account or the Service.
AI and machine-learning use.
- Training of AI models. We do not use your personal information to train our own AI or machine-learning models. (If you do, replace "do not" with "do" and describe what categories of data are used, how the data is protected, for example by anonymization or pseudonymization, and which categories from Section 2 are used as inputs.)
- AI service providers. We do not share personal information with third-party AI service providers, such as large language model vendors used for product features. (If you do, replace "do not" with "do" and describe the providers, the contractual restrictions on their use of the data, and any user consent required.)
- Significant automated decisions. We do not use automated tools to make decisions about you that produce legal or similarly significant effects. (If you do, replace "do not" with "do" and apply the controls described under "Automated decision-making and profiling" below.)
Automated decision-making and profiling. We may use automated processing, including profiling, to support certain purposes described above (for example, fraud detection, content personalization, advertising optimization, and security). If we make any decision based solely on automated processing that produces legal or similarly significant effects on you (such as eligibility for a service, pricing, or access decisions), we will tell you in advance, provide meaningful information about the logic involved, and offer a way to request human review. If you are in the EU, UK, or another jurisdiction with similar protections, you have the right to object to such decision-making under applicable law.
About this section
What's in this section
Ties each data point to a purpose. The legal-basis paragraph at the end is what makes the section compliant in the EU and UK; without it, the rest is notice without a lawful ground for processing.
Why this section is here
Purpose specification is mandatory under GDPR Art. 5(1)(b) and a 'categories of business purposes' requirement under CCPA. Vague purposes are the single most common reason a privacy policy fails an audit.
Common mistake
Filler purposes like 'to improve our service.' Be specific about operational uses: analytics, fraud detection, marketing communications, account servicing.
4. How We Share Your Information
We share personal information with the following categories of recipients:
- Service providers and processors who perform operational services on our behalf, such as hosting, payment processing, email delivery, customer support, and security infrastructure. These providers act only on our documented instructions and are contractually required to protect personal information.
- Third parties and independent controllers with whom we share personal information for purposes beyond pure service delivery, such as analytics platforms, advertising networks, social media plugins, and fraud-prevention partners. These parties may process the data for their own purposes consistent with their own privacy policies.
- Business partners and affiliates where necessary to provide a product or service you have requested.
- Legal and regulatory authorities where required by law, court order, or to protect our legal rights, the safety of our users, or the public.
- Acquirers or successors in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets.
- With your consent or at your direction, including when you authorize us to share information with a third party.
Disclosures in the preceding 12 months. In the 12 months before the Effective Date of this Privacy Policy, we may have disclosed the categories of personal information described in Section 2 to the categories of recipients listed above for the purposes described in Section 3. (Confirm before publishing whether you have "sold" or "shared" personal information as those terms are defined in the CCPA/CPRA. If you have not, state so explicitly here. If your service uses advertising pixels, behavioral ad networks, ad SDKs, or similar third-party tracking, your disclosures likely qualify as a "sale" or "share"; in that case, state that you do "sell" and/or "share" personal information and describe the categories sold/shared and the categories of recipients.) To the extent any of our disclosures qualify as a "sale" or "share" under the CCPA (as amended by the CPRA), we provide an opt-out as described in Section 7.
We may also disclose aggregated or de-identified information that cannot reasonably be linked back to you for research, benchmarking, or other business purposes. This information is not treated as personal information under most privacy laws.
Third-party links and services. The Service may contain links to, or be integrated with, third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to those third-party services. We do not control the privacy practices of those third parties, and we encourage you to review their privacy policies before providing any personal information to them.
Current service providers. (Include this paragraph only if you maintain a public vendor list; otherwise delete.) A current list of the key service providers and processors with whom we share personal information is available at {Vendor List URL}.
About this section
What's in this section
Surfaces who else touches the data. The CCPA's broad definition of 'sale' and 'share' is the most-litigated point: if your service uses Meta Pixel, Google Ads, or any advertising tag, the section must acknowledge that, even when no money changes hands.
Why this section is here
Discloses processors and third-party recipients. GDPR Art. 13(1)(e) and CCPA §1798.115(a) both require this. It is the basis on which users exercise objection and opt-out rights.
Common mistake
Listing 'service providers' without categories. Name the business purpose (analytics, payments, support) so users understand what each recipient actually does.
When to sign a DPA with a processor →5. Cookies and Tracking Technologies
We and our service providers use cookies, pixels, software development kits (SDKs), and similar technologies to operate the Service, remember your preferences, measure performance, and personalize content.
- Strictly necessary cookies are required for the Service to function and cannot be disabled in our systems.
- Functional cookies remember your preferences and improve your experience.
- Analytics cookies help us understand how the Service is used so we can improve it.
- Advertising cookies may be set by us or by third parties to measure the effectiveness of advertising campaigns or to deliver relevant ads.
You can manage your cookie preferences through {Cookie Settings Link}. You can also configure your browser to refuse some or all cookies, though doing so may affect Service functionality.
(Include the following sentence only if your Service uses third-party advertising networks; otherwise delete.) For more information on online advertising opt-outs, you can visit the Network Advertising Initiative (https://www.networkadvertising.org/) or the Digital Advertising Alliance (https://www.aboutads.info/).
Global Privacy Control (GPC). (Include this paragraph only if your website is technically configured to detect and honor recognized opt-out signals such as GPC.) Some browsers and browser extensions send a Global Privacy Control signal that automatically communicates an opt-out of the sale or sharing of personal information. Where required by applicable law (including California, Colorado, Connecticut, Oregon, Texas, and other US states where the law recognizes GPC as a valid opt-out signal), we treat a recognized GPC signal received from your browser or device as a valid request to opt out of the sale or sharing of personal information for that browser or device.
Do Not Track (DNT). Some browsers offer a Do Not Track setting that sends a signal asking websites not to track your activity. Because there is no industry-standard interpretation of DNT signals, we do not currently respond to DNT signals. We honor the Global Privacy Control signal described above, which offers more durable protection. You can also use browser-level controls (such as blocking third-party cookies) for additional protection.
Cookie consent (EU). Where the Service is offered to users in the EU, we obtain affirmative prior consent for non-essential cookies through a consent banner or consent-management platform, as required by the ePrivacy Directive (as implemented in each member state) read alongside the GDPR consent standard. The banner lists our cookie vendors, lets you withdraw consent as easily as you gave it, and records your consent. (List your CMP, link to your cookie list, and link to your consent-records process if available.)
Cookie consent (UK). Where the Service is offered to users in the UK, we obtain affirmative prior consent for non-essential cookies through a consent banner or consent-management platform, as required by the Privacy and Electronic Communications Regulations (PECR), read alongside the UK GDPR consent standard. The banner lists our cookie vendors, lets you withdraw consent as easily as you gave it, and records your consent. (List your CMP, link to your cookie list, and link to your consent-records process if available.)
About this section
What's in this section
Where the policy and your consent banner connect. Cookies are the only data category that often requires affirmative consent before collection, not just disclosure after. The Global Privacy Control commitment turns the section from a passive notice into an enforceable opt-out.
Why this section is here
EU and UK users need cookie consent under the ePrivacy Directive before non-essential cookies are set. This section explains what trackers you use and points to your consent tool.
Common mistake
Treating cookies as a privacy disclosure only. They are also an ePrivacy compliance topic and typically require prior, informed consent, not a notice-only treatment.
6. Data Retention
We retain personal information for as long as necessary to provide the Service, to comply with our legal and contractual obligations, to resolve disputes, and to enforce our agreements. The retention period for each category of personal information is determined by the purpose for which it was collected, applicable legal or regulatory requirements, and, where neither applies, the criteria below.
Retention schedule. (Replace the example periods with the periods your service actually uses.)
- Account profile and credentials are retained for the duration of your account, plus 30 days for backups and account-recovery requests.
- Transaction and billing records are retained for 7 years, or longer where required by applicable tax, accounting, or financial regulations.
- Support and communication history is retained for 2 years after your last interaction with us.
- Usage, analytics, and product telemetry is typically retained for 14 to 26 months, unless aggregated or anonymized.
- Marketing consent and preference records are retained until you withdraw consent, plus a reasonable period to evidence the basis for past processing.
- Cookies and online identifiers are retained as described in Section 5; expiration varies per cookie.
- Security and fraud-prevention logs are retained for up to 12 months from the event, unless a longer period is necessary to investigate or comply with a legal obligation.
- Legal-hold records are retained for the duration of any legal hold imposed by a regulator, court, or in-house legal team.
When personal information is no longer required, we delete or anonymize it so it can no longer be associated with you. Where deletion is not technically feasible (for example, in encrypted backups), we isolate the data and prevent any further processing until deletion is feasible.
About this section
What's in this section
Storage limitation has become a leading enforcement vector under GDPR. The retention table is the section's anchor: it turns vague 'as long as necessary' commitments into something a regulator can actually verify.
Why this section is here
Storage limitation is a core GDPR principle (Art. 5(1)(e)). Users and regulators expect concrete retention periods or, at minimum, the criteria you use to determine them.
Common mistake
'For as long as necessary' with no further detail. Provide periods tied to purpose: 7 years for tax records, 30 days for support logs, etc.
7. Your Rights
Depending on where you live, you have some or all of the following rights over your personal information.
If you are in the European Union (GDPR):
- Access - confirmation that we process your personal information and a copy of it.
- Rectification - correction of inaccurate or incomplete information.
- Erasure - deletion of your personal information in the circumstances set out in Article 17.
- Restriction - to limit how we process your information in certain cases.
- Portability - to receive your information in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible.
- Objection - to object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent - where processing relies on consent, at any time, without affecting processing already carried out.
- Not be subject to solely automated decisions that produce legal or similarly significant effects, and to request human review.
- Lodge a complaint with your national supervisory authority (your local Data Protection Authority).
We respond to requests within one month, extendable by two further months for complex or numerous requests.
If you are in the United Kingdom (UK GDPR):
- Access - confirmation that we process your personal information and a copy of it.
- Rectification - correction of inaccurate or incomplete information.
- Erasure - deletion of your personal information in the circumstances set out in Article 17.
- Restriction - to limit how we process your information in certain cases.
- Portability - to receive your information in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible.
- Objection - to object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent - where processing relies on consent, at any time, without affecting processing already carried out.
- Not be subject to solely automated decisions that produce legal or similarly significant effects, and to request human review.
- Lodge a complaint. We encourage you to contact us first at {Email Address} so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
We respond to requests within one month, extendable by two further months for complex or numerous requests.
If you are in the United States (CCPA/CPRA and similar state laws):
- Know and access - the categories and specific pieces of personal information we collected, the sources, the purposes, and the categories of third parties we disclose to.
- Delete - deletion of personal information we collected from you, subject to legal exceptions.
- Correct - correction of inaccurate personal information.
- Opt out of sale or sharing - to direct us not to sell or share your personal information, including for cross-context behavioral advertising.
- Limit the use of sensitive personal information - to restrict use of sensitive data (such as precise geolocation, health information, or account credentials) to what is needed to provide the Service.
- Non-discrimination - we will not deny service, charge different prices, or provide a different quality of service because you exercised a right.
- Appeal - if we deny a request, you may appeal; we respond within the time your state law allows. This right applies in Colorado, Connecticut, Virginia, and other US states.
We respond within 45 days, with one 45-day extension where reasonably necessary. We offer at least two methods to submit requests and may verify your identity first.
Privacy choice links. (Include only the links you actually operate; delete the rest.) You can exercise these choices directly:
- Do Not Sell or Share My Personal Information: {Do Not Sell Link}
- Limit the Use of My Sensitive Personal Information: {Limit Sensitive PI Link}
- Your Privacy Choices: {Privacy Choices Link}
- Cookie Settings: {Cookie Settings Link}
To exercise any right, contact us through the designated channels in Section 13. We may need to verify your identity before responding, and you may authorize an agent to submit a request on your behalf.
About this section
What's in this section
The section regulators inspect first when a complaint reaches their desk, and the one users actually exercise. The rights listed must match the user's jurisdiction. CCPA rights and GDPR rights are not interchangeable, and listing the wrong set is treated as a substantive failure.
Why this section is here
GDPR, CCPA, LGPD, and others all grant data subjects specific rights (access, deletion, portability, opt-out). The policy must list each applicable right and how to exercise it.
Common mistake
Listing only GDPR rights and ignoring CCPA's 'right to know,' 'right to delete,' and 'right to opt-out' for US users. Adapt the rights list to each user's jurisdiction.
Data subject rights under GDPR →8. International Transfers
We are based in {Country/State} and may process the personal information we collect in countries other than your own. This means your information may be transferred to and processed in jurisdictions whose data protection laws differ from those of your home country.
Because we operate in the United States, we store and process personal information there and in other countries where our service providers operate. We protect that information consistent with this Privacy Policy and require our service providers to apply comparable safeguards, wherever the information is processed.
Where we transfer personal information out of the European Economic Area, we rely on one or more of the following safeguards. (Include only the safeguards your business actually has in place. Do not claim adequacy without an applicable adequacy decision for the destination country.)
- Adequacy decisions issued by the European Commission, where the destination country is recognized as providing an essentially equivalent level of data protection.
- EU Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA.
- EU–U.S. Data Privacy Framework (DPF) for transfers to U.S. recipients that have self-certified to the DPF. The European Commission's adequacy decision for the EU–U.S. DPF has been in effect since July 2023. (Verify the recipient's current certification at https://www.dataprivacyframework.gov/ before relying on this mechanism.)
- Binding Corporate Rules approved by the relevant supervisory authority, where applicable to our corporate group.
- Explicit consent, or another derogation permitted under Article 49 of the GDPR, where appropriate.
Consistent with the Schrems II ruling, we assess the legal regime and practical safeguards in the destination country before transferring personal information and, where necessary, apply supplementary measures. You may request a copy of the relevant SCCs by contacting us using the details in Section 13.
Where we transfer personal information out of the United Kingdom, we rely on one or more of the following safeguards. (Include only the safeguards your business actually has in place. Do not claim adequacy without applicable UK adequacy regulations for the destination country.)
- UK adequacy regulations made by the UK Government, where the destination country is recognized as providing adequate protection.
- The International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs, for restricted transfers out of the UK.
- The UK Extension to the EU–U.S. Data Privacy Framework for transfers to U.S. recipients certified under the UK Extension. (Verify the recipient's current certification at https://www.dataprivacyframework.gov/ before relying on this mechanism.)
- Binding Corporate Rules approved by the Information Commissioner's Office, where applicable to our corporate group.
- Explicit consent, or another derogation permitted under Article 49 of the UK GDPR, where appropriate.
Before making a restricted transfer we carry out a transfer risk assessment (TRA) as expected by the ICO and, where necessary, apply supplementary measures. You may request a copy of the relevant IDTA or UK Addendum by contacting us using the details in Section 13.
About this section
What's in this section
Schrems II made this section legally hazardous: naming the right mechanism is not enough if the destination country's surveillance laws would override it. The Transfer Impact Assessment commitment is what shows a regulator you have done the analysis, not just picked a label.
Why this section is here
GDPR Chapter V restricts transfers outside the EU or UK without an adequate safeguard. The policy must name the mechanism: adequacy decision, EU–U.S. Data Privacy Framework, Standard Contractual Clauses, or Binding Corporate Rules.
Common mistake
Hand-waving with 'we may transfer data internationally.' Name the mechanism, and where known, identify the data importer or its category.
GDPR international transfers →9. Children's Privacy
The Service is not directed at children under the age of {Minimum Age}, and we do not knowingly collect personal information from children below that age. If we become aware that we have collected personal information from a child without verifiable parental consent, we will delete that information promptly. If you believe a child has provided personal information to us, please contact us at {Email Address}.
(Keep the next paragraph only if your Service is directed at children or knowingly collects personal information from them; otherwise delete the next paragraph entirely.)
Where the Service is directed at or intended to be used by children under the age threshold that applies in your jurisdiction, we collect personal information from a child only after obtaining verifiable parental consent. We use commercially reasonable verification methods consistent with applicable law, limit the information we collect from a child to what is reasonably necessary for the child to participate in the Service, do not condition a child's participation on the disclosure of more personal information than is reasonably necessary, and give parents the right to review their child's personal information, to direct us to delete it, and to refuse further collection or use of it by contacting us at {Email Address}.
About this section
What's in this section
The section enforcement actions cite when a service is fined for collecting children's data unknowingly. The 'we do not knowingly collect' line is a defense only if you have an actual detection and deletion mechanism behind it; without one, the line is decorative.
Why this section is here
COPPA prohibits collecting personal information from US children under 13 without verifiable parental consent. GDPR sets the minimum at 16, or 13–16 by Member State.
Common mistake
A blanket 'we don't knowingly collect data from children' with no actual age verification or parental consent flow when the service plausibly reaches families.
10. Security
We implement reasonable technical and organizational measures designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. Examples of the measures we maintain include encryption of personal information in transit and at rest, role-based access controls, multi-factor authentication for administrative access, regular security awareness training for personnel, vendor due diligence, and incident response procedures.
If we become aware of a personal data breach affecting your personal information, we will notify the relevant authorities and affected individuals as required by applicable law, without undue delay and within the timeframes the law prescribes.
Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (Article 33), and where it is likely to result in a high risk we will also notify affected individuals without undue delay (Article 34).
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly of any unauthorized access to your account.
About this section
What's in this section
A double-edged section. Strong language attracts users; the same language exposes you to enforcement if a breach reveals the reality did not match. The 72-hour notification commitment is the highest-risk sentence on the page. Make sure the team can actually meet it.
Why this section is here
GDPR Art. 32 requires technical and organizational measures appropriate to the risk. Disclosing them is both a compliance signal and a contractual commitment to users.
Common mistake
Overstating security ('bank-level encryption,' '100% secure'). Regulators have brought enforcement actions against companies whose stated security did not match reality.
FTC enforcement on security claims →11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make non-material changes (such as clarifying language, correcting typographical errors, or updating internal references), we will update the "Last Updated" date at the top of this Policy without separate notice.
When we make material changes (including new categories of personal information collected, new processing purposes, new categories of recipients, expanded data sharing, or changes that affect your rights), we will provide notice through one or more reasonable methods, such as: (a) prominent in-product banners or modals, (b) email to the address associated with your account, (c) login-time clickwrap re-acceptance, or (d) other channels reasonably calculated to bring the change to your attention. We will give you at least 30 days' advance notice of material changes before they take effect, unless a shorter period is required by law or the change is required to address an urgent legal or security matter.
Your continued use of the Service after the effective date of a change constitutes your acceptance of the revised Policy, except where applicable law requires us to obtain your fresh consent, in which case continued use alone is not sufficient and we will seek your active re-acceptance.
Prior versions of this Policy are available on request by contacting us using the details in Section 13.
About this section
What's in this section
Material changes reset the contract. Without active re-acceptance, courts have refused to enforce new terms against existing users. The 30-day advance notice is what gives users a meaningful chance to object before the change takes effect, and what gives you the evidentiary record if they don't.
Why this section is here
Material changes to data practices typically require active notice to users, not just a footer date update. Both GDPR and FTC enforcement guidance reinforce this.
Common mistake
Treating every change as a 'minor update' without notifying users. Material changes (new purposes, new third parties, expanded sharing) warrant clickwrap re-acceptance.
Re-acceptance after updates →12. Additional Jurisdictional Provisions
The provisions below apply only to residents of the jurisdictions named. Delete any subsection that does not apply to your operations before publishing.
Canada. If you are located in Canada, our processing of your personal information complies with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy laws (including Quebec's Law 25). We rely on express consent for most processing, and on implied consent or other PIPEDA-permitted bases in limited circumstances (such as where collection is clearly in your interest and consent cannot be obtained in a timely way). You have the right to access your personal information, challenge its accuracy, and lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/) or the relevant provincial commissioner.
Brazil. If you are located in Brazil, our processing of your personal information complies with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, or "LGPD"). We process your personal information on one or more of the legal bases set out in LGPD Article 7 (and Article 11 for sensitive personal data). You have the rights set out in LGPD Article 18, which substantially overlap with those described in Section 7, plus the additional right to anonymization and to information about the entities with whom we share your data. You have the right to lodge a complaint with the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, or "ANPD"; https://www.gov.br/anpd/).
Australia. If you are located in Australia, our processing of your personal information complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). On request, we will provide you with access to the personal information we hold about you and an opportunity to correct it, in accordance with APPs 12 and 13. If a personal information breach is reportable under the Notifiable Data Breaches scheme, we will notify you and the Office of the Australian Information Commissioner ("OAIC"; https://www.oaic.gov.au/) as required by law. You have the right to lodge a complaint with the OAIC.
South Africa. If you are located in South Africa, our processing of your personal information complies with the Protection of Personal Information Act, 2013 ("POPIA"). We process your personal information in accordance with the eight conditions for lawful processing set out in POPIA, including the conditions of accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. You have the right to lodge a complaint with the Information Regulator of South Africa (https://inforegulator.org.za/).
Other US states. In addition to the rights described above for California, Colorado, Connecticut, and Virginia, where required by applicable state law, residents of other US states with comprehensive privacy laws (including Texas, Oregon, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Indiana, Iowa, Tennessee, Montana, and similar jurisdictions) may have some or all of the following rights: to access, correct, delete, and port personal information; to opt out of certain processing such as targeted advertising, the sale of personal information, or profiling that produces legal or similarly significant effects; and to appeal a denied request. The specific scope of these rights varies by state law. You may lodge a complaint with the Attorney General of your state.
California "Shine the Light." (Include only if you share personal information with third parties for their own direct-marketing purposes; otherwise delete.) California residents may request, once per year and free of charge, information about the categories of personal information we disclosed to third parties for their direct-marketing purposes in the preceding calendar year, along with the names and addresses of those third parties. To make a request, contact us using the details in Section 13. We do not share personal information with third parties for their own direct marketing unless you have opted in.
About this section
What's in this section
Each subsection signals to a foreign regulator that you have considered their law. If you actually serve users in that country, including the relevant subsection puts the right complaint authority in front of them. If you do not, leaving it in creates exposure to enforcement under a law you never analyzed. The safe default is to delete every subsection you cannot back up.
Why this section is here
Different jurisdictions impose overlapping but distinct privacy obligations. Naming the applicable regulator and statutory framework signals that you have considered the local law, not just GDPR and CCPA. It also gives users a concrete escalation path.
Common mistake
Keeping every jurisdiction the template ships with regardless of whether you serve users there. Empty claims of compliance with laws you do not actually follow create enforcement exposure that did not exist before publishing the policy.
Browse all privacy laws in the legal hub →13. Contact Us
If you have questions about this Privacy Policy or our privacy practices, or to exercise any of the rights described in Section 7, please contact us at:
{Company Name}
{Mailing Address}
Email: {Email Address}
California toll-free number (if required by law for your business): {Toll-Free Number}
Data Protection Officer / Privacy Lead (if applicable): {Data Protection Officer or Privacy Lead Contact, if applicable}
EU Representative (if required by GDPR Article 27): {EU Representative}
UK Representative (if required by UK GDPR Article 27): {UK Representative}
We will acknowledge receipt of your request and respond within the statutory deadlines described in Section 7.
(If a contact above does not apply to your operations, remove the corresponding line before publishing.)
About this section
What's in this section
Privacy requests have statutory clocks. This section is the entry point that starts them. A generic info@ address goes to whoever pulls the short straw that day; route requests instead to a team with the authority to act and the data access to honor them in time.
Why this section is here
GDPR requires a contact point for data subjects (and the DPO's contact, where applicable). CCPA requires large businesses to provide a toll-free number alongside the email address.
Common mistake
A generic info@ address with no SLA. Privacy requests have statutory deadlines (45 days for CCPA, 1 month for GDPR). Route them to a team that can actually meet those windows.
CCPA contact requirements →