Free privacy policy template

1. Introduction

[Your Company Name] ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website [yourwebsite.com], use our mobile application, or engage with our services.

Please read this Privacy Policy carefully. By accessing or using our services, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy.

2. Information We Collect

We collect information in the following ways:

Personal Information You Provide:

• Name, email address, phone number, and mailing address
• Account credentials (username and password)
• Payment and billing information (credit card numbers, billing address)
• Profile information (profile picture, preferences, settings)
• Communications you send to us (support requests, feedback)

Information Collected Automatically:

• IP address, browser type, and operating system
• Device identifiers and mobile device information
• Pages visited, links clicked, and time spent on our website
• Referring URL and search terms used to find our site
• Cookie identifiers and similar tracking technologies

Information from Third Parties:

• Social media profiles (when you log in via social accounts)
• Analytics providers (Google Analytics, etc.)
• Advertising partners and data brokers
• Public databases and data aggregators

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our services
• To process transactions and send related information
• To send you technical notices, updates, security alerts, and support messages
• To respond to your comments, questions, and customer service requests
• To communicate with you about products, services, offers, and events
• To monitor and analyze trends, usage, and activities
• To detect, investigate, and prevent fraudulent transactions and abuse
• To personalize and improve your experience
• To comply with legal obligations and enforce our terms

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds under GDPR Article 6:

• Consent (Art. 6(1)(a)): You have given us clear, affirmative permission to process your data for specific purposes. You may withdraw consent at any time by [describe how, for example by emailing privacy@yourcompany.com or adjusting account settings]. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Contract (Art. 6(1)(b)): Processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract (e.g., processing your order, managing your account).
• Legitimate Interest (Art. 6(1)(f)): Processing is necessary for our legitimate business interests, such as fraud prevention, network security, and direct marketing to existing customers, provided those interests are not overridden by your fundamental rights and freedoms.
• Legal Obligation (Art. 6(1)(c)): Processing is necessary to comply with a legal obligation to which we are subject (e.g., tax reporting, responding to lawful government requests).
• Vital Interest (Art. 6(1)(d)): In rare cases, processing may be necessary to protect someone's life.
• Public Interest (Art. 6(1)(e)): Processing may be necessary for tasks carried out in the public interest.

For special categories of personal data (e.g., health data, biometric data), we rely on [explicit consent / other applicable basis under GDPR Article 9].

You have the right to request information about which legal basis applies to each processing activity. Contact us at [privacy@yourcompany.com] for details.

5. Information Sharing and Disclosure

We may share your information in the following situations:

• Service Providers: We share data with third-party vendors who perform services on our behalf (hosting, analytics, payment processing, email delivery).
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Protection of Rights: To protect our rights, privacy, safety, or property, and that of our users and the public.
• With Your Consent: We may share your information for any other purpose with your consent.

We do not sell your personal information to third parties.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your activity on our services.

Types of cookies we use:

• Strictly Necessary Cookies: Required for the website to function properly (session management, security).
• Analytics Cookies: Help us understand how visitors use our website (Google Analytics, Mixpanel).
• Functional Cookies: Remember your preferences and settings (language, region).
• Marketing Cookies: Track your activity across websites to deliver targeted advertising.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our services. For more details, see our Cookie Policy at [link to cookie policy].

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

• Account data: Retained for the duration of your account plus [30/60/90] days after deletion.
• Transaction data: Retained for [7] years for tax and accounting purposes.
• Analytics data: Retained for [26] months.
• Marketing data: Retained until you unsubscribe or withdraw consent.

When data is no longer needed, we securely delete or anonymize it.

8. Your Privacy Rights

Depending on your location, you may have the following rights:

GDPR Rights (EU/EEA residents):

• Right of access: request a copy of your personal data
• Right to rectification: request correction of inaccurate data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to restrict processing: request limitation of processing
• Right to data portability: receive your data in a portable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: withdraw consent at any time

CCPA Rights (California residents):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

To exercise any of these rights, contact us at [privacy@yourcompany.com].

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• Binding Corporate Rules for intra-group transfers
• Your explicit consent where appropriate

10. Children's Privacy

Our services are not directed to children under the age of [13/16]. We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.

If you believe a child has provided us with personal data, please contact us at [privacy@yourcompany.com].

11. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication mechanisms
• Regular security assessments and penetration testing
• Employee training on data protection practices
• Incident response procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Do Not Track / Global Privacy Control

"Do Not Track" (DNT) is a privacy preference that users can set in their web browsers. Additionally, "Global Privacy Control" (GPC) is a browser-level signal that communicates a user's privacy preferences to websites.

Our Response to DNT Signals:

[Your Company Name] [does / does not] currently respond to DNT signals. There is no universally accepted standard for how companies should respond to DNT signals, and the technology and policy landscape continues to evolve. We will update this section if a uniform standard for responding to DNT signals is established.

Our Response to GPC Signals:

We [do / do not] honor GPC signals as a valid request to opt out of the sale or sharing of personal information under applicable privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). When we detect a GPC signal from your browser, we will [describe how you respond, for example: treat it as a valid opt-out request and cease selling or sharing your personal data / limit tracking to strictly necessary cookies].

• GPC is supported by browsers such as Firefox, Brave, and DuckDuckGo
• You can enable GPC by visiting globalprivacycontrol.org and following the instructions for your browser
• We process GPC signals on a per-browser and per-device basis; to opt out across all devices, you must enable GPC on each browser and device you use
• If you have an account with us and submit a GPC signal, we will also apply your opt-out preference to your account where technically feasible

13. California Shine the Light

Under California Civil Code Section 1798.83, also known as the "Shine the Light" law, California residents who have an established business relationship with [Your Company Name] may request information about whether we have disclosed personal information to any third parties for the third parties' direct marketing purposes during the preceding calendar year.

To make such a request, please send an email to [privacy@yourcompany.com] or write to us at:

[Your Company Name]

Attn: California Shine the Light Request

[Your Company Address]

Your request must include:

• Your full name and current California mailing address
• A statement that you are a California resident
• A clear request for our "Shine the Light" disclosure

We will respond to your request within 30 days of receipt. Please note that we are only required to respond to one request per customer per calendar year. We are not required to respond to requests made by means other than through the email address or mailing address provided above.

Categories of information we [may / do not] share with third parties for direct marketing purposes include: [list categories, e.g., name, email address, purchase history, or state "We do not share personal information with third parties for their direct marketing purposes."]

14. AI and Automated Processing

[Your Company Name] may use artificial intelligence (AI), machine learning, and other automated decision-making technologies in connection with our services. We are committed to transparency about how these technologies are used and how they may affect you.

How We Use AI and Automated Processing:

• Content Personalization: We may use AI algorithms to personalize the content, recommendations, and advertisements you see based on your browsing behavior, preferences, and interactions with our services
• Customer Support: We may use AI-powered chatbots or virtual assistants to help answer your questions and provide support
• Fraud Detection: We use automated systems to detect and prevent fraudulent activity, unauthorized access, and other security threats
• Content Moderation: We may use AI tools to review user-generated content for compliance with our community guidelines and Terms of Service
• Analytics: We use automated tools to analyze usage patterns, improve our services, and generate aggregated insights
• [Content Generation: Some content on our platform may be generated or assisted by AI tools. Such content is reviewed by humans before publication where applicable]

Your Rights Regarding Automated Decisions:

Under certain privacy laws (including GDPR Article 22), you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. If you believe an automated decision has been made about you, you may:

• Request human review of the decision by contacting us at [privacy@yourcompany.com]
• Express your point of view and contest the decision
• Request an explanation of the logic involved in the automated decision

We implement appropriate safeguards, including regular audits of our AI systems, to ensure fairness and prevent discrimination.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website with a revised "Last Updated" date
• Sending an email notification to registered users
• Displaying a prominent notice on our website

We encourage you to review this Privacy Policy periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

[Your Company Name]

Email: [privacy@yourcompany.com]

Address: [Your Company Address]

Phone: [Your Phone Number]

Data Protection Officer (if applicable):

Email: [dpo@yourcompany.com]

For EU residents, you also have the right to lodge a complaint with your local data protection supervisory authority.