Privacy Policy Generator

What this tool is used for

• Producing a starting policy for a small site that currently has none.
• Documenting which third-party services actually receive data from your site.
• Getting a structure that covers the sections such policies normally contain.
• Listing the lawful basis for each data type before a review, rather than after one.
• Refreshing a policy that no longer matches what the product does.

Frequently Asked Questions

Am I legally required to have one?

Almost certainly, if you collect anything identifying. GDPR applies to anyone processing EU residents' data regardless of where the company is, CCPA to businesses over certain thresholds serving Californians, and both Apple and Google require a policy URL before an app is listed at all.

What must a policy actually disclose?

What data is collected, why, on what legal basis, who it is shared with, how long it is kept, where it is stored, and how a user exercises their rights — access, correction, deletion, portability, objection. Contact details for whoever is accountable are required, not optional.

Does analytics count as collecting personal data?

Under GDPR, yes — an IP address and a cookie identifier are personal data even without a name attached. That is what makes cookie banners a legal requirement rather than a design fashion, and why "we don't collect personal information, we just use Google Analytics" is not a defensible sentence.

Is a generated policy enough on its own?

It is a scaffold that names the sections you need to answer. The answers have to be true of your system, and a policy describing practices you do not follow is a documented misrepresentation — worse in an enforcement action than a shorter policy that is accurate.

How often should it be reviewed?

Whenever the data flow changes — a new analytics tool, a new processor, a new region — and at least annually otherwise. Keep the effective date current and, for material changes, notify users rather than silently editing, because consent given to an older version does not carry forward.

Common errors and gotchas

• Treating generated text as legal advice, shipping it unreviewed and hoping it fits your jurisdiction.
• Listing data types the product does not collect, or omitting ones it does — which is the part that actually matters.
• Naming services you have since removed, or missing analytics and error reporting that are still live.
• Contradicting the cookie banner, which regulators read alongside the policy.
• Publishing the policy and never linking it from the footer or the signup flow.