Privacy Policy Generator
Generate a privacy policy from the data you actually collect, the purposes you process it for and the third parties you share it with.
What is Privacy Policy?
A privacy policy generator. It asks what data you collect, why you process it, who you share it with and how long you keep it, then assembles the twelve sections a privacy policy is expected to contain. Categories are chosen from lists rather than written from scratch, because the phrase “we collect identifiers, commercial information and internet activity” is what a regulator and a reader both expect to see.
How it works
Every checkbox maps to a clause in the document: the categories you tick become the collection section, the purposes become the use section, and the processors you select become the sharing section. The retention rule and the minimum age are taken verbatim from your inputs. Fields you leave empty render as a visible marker so an unfinished policy cannot be mistaken for a finished one, and the whole document is generated in the page — no data leaves your browser.
- Fill in the details the document needs. Business name, jurisdiction, dates, the clauses that apply to you. Nothing is uploaded and no account is created — the form is the only input, and the document is assembled in the page.
- Watch the blanks, not just the text. Any field you leave empty appears in the document as [[a highlighted marker]], and the panel above the output lists exactly which blanks are left. A half-finished policy should never look finished.
- Copy or download, then have it reviewed. Copy the document to the clipboard or download it as a .md file named for what it is. Every page states the same thing: this is a template, and it needs a qualified lawyer's eye before you publish or sign it.
Examples
A privacy policy for a side project
A solo developer shipping a newsletter signup needs a policy that says what is collected, why, and how to ask for deletion. Selecting the categories actually collected — rather than copying a competitor's list — takes two minutes and produces a document that is true.
Terms of service with a real liability cap
The liability clause is written from a number you supply instead of being left as "our total liability is limited to [amount]". A cap that is never filled in is a clause no one can rely on.
A DMCA notice a provider will actually action
A takedown that is missing the URL of the original work, or the statement under penalty of perjury, is one the service provider is entitled to ignore. Every required element appears in the generated letter, in the order the statute describes.
A DPA for a new vendor
Processors, security measures, breach notification window, transfers and audit rights as one document, with the subprocessor and SCC clauses switched on because this vendor uses both.
Common mistakes
Publishing a template without reading it
A policy that promises something you do not do — deleting data on request within 30 days, or never sharing data with third parties — is worse than no policy, because it is a documented misstatement. Read every clause against what actually happens and cut the ones that do not apply.
Assuming one document covers every jurisdiction
A privacy policy written for the UK does not automatically satisfy California, Brazil or Canada, and an employment clause that is standard in one country can be unenforceable in another. Name the jurisdiction you are actually writing for, and check the rules that follow from it.
Bundling consent and calling it consent
A single "I agree" covering marketing, analytics, photographs and treatment is not valid consent under most regimes, because consent has to be specific and separately given. Use one form per purpose, and never pre-tick the optional boxes.
Leaving the blanks in after generating
The marker can be more subtle to spot in a document than on the page — search the pasted text for the bracket characters before publishing, or use the missing-field list to confirm it is empty.
Frequently asked questions
Do I need a privacy policy if I do not have customers yet?
If the site collects anything at all — analytics, a contact form, server logs tied to an IP address — then yes, most data protection regimes require you to say so. Publicly listing a policy is also the simplest way to satisfy the transparency obligation.
How much should the policy promise about retention?
Only what you can actually do. A specific rule such as "24 months after account closure" is defensible and useful; "as long as necessary" is vague but at least true. A specific number you never enforce is the one that creates a problem.
Is this policy enough for the GDPR?
It covers the information an Article 13 or 14 notice has to give, but a policy is only one of several obligations. You also need a lawful basis recorded for each purpose, a record of processing, and a process for handling the rights the policy describes.