Privacy Policy – Product name

Template only – not legal advice. Have a qualified lawyer review before publishing, especially for regulated markets (EU/CA/BR). Structure follows GDPR/CCPA disclosure conventions.

Effective date: YYYY-MM-DD · Last updated: YYYY-MM-DD

1. Who we are

Controller identity: legal name, contact, jurisdiction.

2. What we collect

Data	Source	Purpose	Legal basis
Account data	you provide	service delivery	contract
Usage data	automatic	improvement	legitimate interest / consent
Cookies	automatic	list purposes	consent where required

State plainly what you do not collect – it is the most-read part.

3. How we use data

• Purpose one – linked to legal basis
• Purpose two

4. Storage & retention

• Where data lives (region, providers)
• How long kept, deletion schedule

5. Sharing

Recipient	What	Why	Safeguard
Processor	data type	hosting	DPA
None other	–	–	–

"We do not sell personal data." – required statement for CCPA.

6. Your rights

Depending on jurisdiction: access, rectification, erasure, portability, objection, withdrawal of consent, complaint to authority. How to exercise: [contact].

7. Cookies & tracking

• What is used, what each is for
• How to opt out
• Global Privacy Control (GPC) honored: yes/no

8. Security

Measures in general terms (never detail exploitable specifics).

9. Children

Age floor and policy.

10. International transfers

Mechanism if data crosses borders (SCCs, adequacy).

11. Changes

How users are notified of updates.

12. Contact

Privacy contact, DPO if applicable, supervisory authority note (EU).