Updated:
A privacy policy template is a ready-made notice about personal data. It lists what your website or app collects, why you collect it, and who receives it. Small businesses, bloggers and app makers use it before they publish a sign-up form.
This page explains each part of a privacy policy, shows a short example, and walks you through filling out the Formspal template for your own site or app.
Build Your Document
Answer a few simple questions to make your document in minutes
Save and Print
Save progress and finish on any device, download and print anytime
Sign and Use
Your valid, lawyer-approved document is ready
A privacy policy is a public notice on a website or app that tells visitors which personal information the business collects, how it uses that information, who it shares it with, and how visitors can control it.
The policy speaks to your visitors, not to your staff. It sits on its own page, and every form that asks for personal details links back to it. A clear policy lets a visitor decide whether to sign up, buy or leave before handing over an email address.
A template gives you the usual sections in a sensible order. You keep the parts that match your business, rewrite the parts that differ, and delete the parts that do not apply. A policy only helps you when every line in it describes what your site or app really does.
Personal information is any detail that identifies a person on its own or together with other details. Common examples are:
A privacy policy belongs on any website or app that collects personal information from visitors, whether through a sign-up form, a checkout page, a contact form, analytics cookies or an advertising tool.
Whether a policy is a legal duty for your site depends on where your visitors live, what you collect and how large your business is: no single rule covers every site.
That covers most online businesses. A newsletter box, a coupon offer or a free account all ask for an email address, and from that moment the site holds personal data. Typical owners who need a policy include:
A small business template works for a sole trader as well as a larger company. Size can decide which privacy laws reach you: the California Consumer Privacy Act applies only to for-profit businesses that do business in California and meet at least one of its thresholds for revenue or for the volume of California residents' personal information (California Attorney General, CCPA). Visitors also expect a policy: a site without a policy gives them no way to check what happens to their details.
A privacy policy usually includes the information you collect, how you collect it, why you use it, who you share it with, how long you keep it, how visitors can access or delete it, how they can contact you, and the date the policy took effect.
Every policy differs because every business collects different things. The sections below appear in most policies, and the Formspal template has a place for each of them. Many policies also say how the site responds to a browser's Do Not Track signal and whether other companies can track visitors across sites. Some privacy rules ask for more than this list, so check the ones that reach your visitors (see Privacy Rules to Check Before You Publish).
This section lists every type of personal information the business gathers, from names and email addresses to payment data and IP addresses. The more exact the list, the fewer misunderstandings you will have with customers later.
This section explains the ways personal information reaches your business, both from visitors directly and from tools running on your pages. Some collection is visible to the visitor, such as a contact form or a checkout page. Some happens in the background, such as cookies, server logs and analytics tags.
This section tells visitors what the business does with their information and why each use needs the data it asks for. Common uses are:
This section names the kinds of outside companies that receive personal information, such as payment processors, hosting providers, email services, analytics tools and ad networks. If you never sell personal information, say so plainly.
This section describes the security measures you use, such as HTTPS, encrypted storage, access limits for staff or anonymized analytics data. Describe what you really have in place and avoid promises of perfect security.
This section explains what visitors can do about their own information: see it, correct it, delete it, unsubscribe from emails, or refuse cookies. Give the exact steps, for example a link in every email or a setting in the account page.
This section says whether your site or app is meant for children and whether you knowingly collect information from them. Sites for adults usually add a short line that they do not knowingly collect children's data and delete it when they find it.
This section tells visitors how they will hear about updates to the policy, for example by email or a notice on the site, and shows the date of the latest version.
This section says what happens to personal information if the business is sold or merged. A typical clause says that customer data passes to the new owner, who then keeps the same promises.
This section gives a short note on how the business handles privacy complaints and where a visitor can raise a disagreement about their data. The full rules for disputes usually belong in your Terms and Conditions, and the privacy policy can point there.
This section gives visitors a direct way to reach the person or team who answers privacy questions, requests and complaints. A dedicated email address for privacy matters makes requests easy to find and answer.
An example shows how the sections of a privacy policy read once they are filled in. The sample below is for an imagined online shop, with the business details in brackets for you to replace.
Sample privacy policy (example only)
Who we are. [Shop Name] sells handmade candles at [website address]. You can reach us at [privacy email].
What we collect. When you place an order, we collect your name, email address, shipping address and payment details. When you browse the site, our analytics tool collects your IP address, browser type and the pages you visit.
How we use it. We use your details to ship your order, send order updates, and, if you sign up, send our newsletter.
Who we share it with. We share order details with our payment processor and our delivery company. We do not sell your personal information.
Your choices. You can unsubscribe from the newsletter with the link in any email, and you can ask us to see or delete your data by writing to [privacy email].
Changes. We post every update on this page and show the date of the latest version at the top.
Your own policy will be longer if you run ads, offer accounts or use more outside services. Use the example to check the tone: short sentences, plain words, and no promise you cannot keep.
To create a privacy policy with the Formspal template, describe the data you collect, explain how you use and share it, set out user choices, then add your security measures and contact details.
Write in plain English for a customer, not for a specialist. Before you start, list every form, tool and plugin on your site or in your app, because each of them may collect personal data.
Start with a list of the personal data types your website or app gathers, grouped by where the data comes from:
Next, match each type of data to a purpose, so visitors can see why you need it.
Then explain which other people and companies see the information, and for what reason they receive it.
This part tells visitors what they can do about the personal data your website or app holds about them.
Finish with the security measures, transfer details and contact points that make the policy complete for a visitor.
The Formspal privacy policy template shows what this document can look like. Create it, add your business name and other details, and use the finished policy on your website or in your app.
Other businesses may use the same template, so your policy could look similar to theirs. A generic policy is a starting point only: edit every section until it describes your own business, your own tools and your own contact details.
Before you publish your privacy policy, read it once from a visitor’s point of view. Check that every statement matches what your business really does with personal data.
A privacy policy for a site that uses Google Analytics or Google AdSense should say that the tool is in use, that it relies on cookies, what data it gathers, and how visitors can opt out.
Outside tools collect data on your pages even though you never see it yourself. A visitor reading your policy should still learn about them, because the data leaves your site and goes to the tool's provider.
Google Analytics tracks how visitors move through a site: which pages they view, how long they stay, and where they came from. A Google Analytics privacy policy section usually covers:
Google publishes its own terms for each of these tools. Read the current version in your Google account and match your policy to the features you really use.
Google AdSense shows ads from other advertisers on your pages and uses cookies to pick ads based on a visitor's earlier browsing. A policy for a site with AdSense usually says so, names the cookies involved, and explains how visitors can turn off personalized ads in Google's ad settings.
Cookie consent is a visitor's active choice to accept or refuse cookies, usually given in a banner or pop-up when they first arrive. A clear banner offers both choices, such as "I agree" and "Decline", and links to your policy for details.
An app privacy policy and a website privacy policy share the same core sections, but an app often collects more device data, such as location, contacts, camera access or push notification tokens.
Many businesses start from the same core text for both and then add a section per platform. For an app, list each phone permission you ask for and what you do with it. Link to the policy from the app's store listing and from a menu inside the app, so users can reach it after they install.
For a website, put the link in the footer of every page and next to each form that asks for personal details.
A privacy policy covers personal data only, while terms and conditions set the rules for using your site and a cookie policy lists the cookies the site places in more detail.
Small sites often fold the cookie details into the privacy policy. Larger sites keep the documents apart and link them to each other.
| Document | What it covers | Who it speaks to |
|---|---|---|
| Privacy policy | What personal data you collect, why, who receives it, and visitor choices | Every visitor and customer |
| Terms and conditions | Rules for using the site, payments, refunds, account closure, disputes | Users who buy or open an account |
| Cookie policy | Each cookie by name, its purpose, its provider and how to refuse it | Visitors who want the cookie details |
| Disclaimer | Limits on what visitors can expect from your content or advice | Readers of your content |
If a visitor asks "what do you do with my email address?", the answer belongs in the privacy policy. If they ask "can I get a refund?", it belongs in the terms.
The most common privacy policy mistake is a copied text that does not match the site: it names tools the business never used and leaves out the ones it does use.
Check your draft against this list before you publish:
A short, accurate policy serves visitors better than a long policy full of borrowed clauses. When you change your site, change the policy at the same time.
Privacy rules differ by country and by the kind of data you handle, so check which of them reach your visitors before you publish your policy.
Names you are likely to meet include:
This page does not explain what each of them asks for, and the Formspal template is not tailored to any of them. Check the rules where your visitors live as well. If your site is aimed at children, handles student data, or serves many visitors in Europe, have a professional review your policy before it goes live.
Post your policy on its own page, link it from the footer of every page, and update it whenever you start collecting new data or add a new tool.
Most sites link to it from the footer, so it appears on every page. You can also link to it next to sign-up forms and checkout pages, where visitors share personal details.
Each update should change the date at the top of the policy. Tell users about larger changes by email or with a notice on the site, and keep a copy of every version so you can see what changed over time.
The Formspal template is a ready-made privacy policy with the standard parts already laid out. You add your own business details and remove anything that does not apply to your website or app.
Select Create My Document, answer the questions about your business and your website or app, and review the result. Save your progress if you need a break, then download and print the finished document.
A generic privacy policy is a fine starting point, but publish it only after you edit it to match your business. A policy that names tools you do not use, or misses tools you do use, misleads your visitors.
There is no difference in everyday use: privacy policy, privacy notice and privacy statement all name the same public document. Some businesses use "privacy notice" for the public text and keep "privacy policy" for internal staff rules.
A disclaimer and a privacy policy do different jobs on a website, so many sites publish both and link them from the footer. The privacy policy covers personal data, while a disclaimer limits what visitors can expect from your content, and terms and conditions set the rules for using the site.
Often yes: a commercial website or app that collects email addresses from people in California must conspicuously post a privacy policy under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575). Elsewhere a policy may be a legal duty or simply good practice, depending on the rules where you and your subscribers are. A good policy for a list says what you send, how often, and how subscribers unsubscribe. Link to the policy from the sign-up box.
US law on commercial email asks for something different from a policy: under 15 U.S.C. 7704, each commercial email must contain a clearly displayed working unsubscribe link or reply address and a valid physical postal address of the sender. Under 15 U.S.C. 7704, you must stop sending commercial email to a subscriber within 10 business days after they opt out. 15 U.S.C. 7704 does not itself ask for a privacy policy.
Add your business name and contact details, then publish the policy on your site and link to it where visitors share information. Keep a copy of each version in a tool such as Google Docs or Microsoft Word, so you can see what changed over time.
General information, not legal or tax advice.
