Policy Pack

Changelog

• 1.0.0, 22 October 2026: first release

Policy Pack

Version 1.0.0

Most small businesses need the same few legal pages: a privacy policy, terms, a cookie notice, a refund policy and often an acceptable use policy. This pack gives you thorough fill-in templates for each, a guide to working out which ones you need, a checklist to map the personal data you actually handle, and a routine for keeping everything current. The templates are written to work alongside the main privacy and consumer laws in the EU, UK, US, Canada and Australia, in plain language your customers can read.

Who it's for

• Small businesses, shops and online services putting their legal pages together for the first time
• Founders replacing a copied or generated policy that no longer matches what they do
• Teams preparing a full draft so a lawyer review is quicker and better focused
• Developers and agencies who build sites for clients and need a solid starting point

How to use it in 5 minutes

1. Open which-policies-do-i-need.md and answer the decision table. It tells you which documents you need.
2. Start data-processing-checklist.md. List what personal data you collect, why, where it goes and how long you keep it.
3. Open privacy-policy.md and fill in the summary and section 2 from your checklist.
4. Pick a banner variant in cookie-notice.md and check your site loads no optional cookies before consent.
5. Put the next review date in policy-maintenance.md, then book a lawyer to review the finished drafts.

File map

A note on limits

These are starting points, not legal advice, and using them doesn't make you compliant with any law. Laws differ by country and state, change over time, and depend on facts about your business that a template can't know. Have a qualified lawyer review your final documents, especially if you handle sensitive data, data about children, or sell to consumers in several countries.

Licence

MIT License. See LICENSE.txt.

Acceptable use policy template

Starting point, not legal advice. What you must prohibit, and how you must handle reports and removals, depends on your service and where your users are. Some countries have specific online safety and content moderation rules. Have a qualified lawyer review your final policy before you rely on it.

How to use this template

• An acceptable use policy (AUP) sets out what people may not do with your service. Your terms of service make it binding.
• Keep the rules you can actually enforce. A long list you never act on weakens the ones that matter.
• Add rules specific to your product, for example limits on sending volume for an email tool, or rules about generated content for a creative tool.
• Decide in advance how you'll respond to breaches (section 6) and who makes the call. Write it down internally, not just in this policy.
• If users can post content others see, have a way to report it, and respond to reports in a reasonable time.

Everything below the line is the policy itself.

---

Acceptable use policy

Last updated: [22 October 2026]

This policy explains what you may not do when using [Product name] and other services run by [Company legal name] ("[Company name]", "we", "us") (the "Service"). It forms part of our [Terms of service, link]. If you break it, we may remove content or suspend or close your account.

It applies to everyone who uses the Service, including people you invite or allow to use your account.

1. Illegal and harmful activity

You may not use the Service to:

• Break any law that applies to you or to us.
• Plan, promote or carry out violence, terrorism or serious harm to people.
• Create, share or seek child sexual abuse material, or sexualise minors in any way. We report this to the relevant authorities.
• Harass, threaten, bully, stalk or intimidate anyone.
• Promote self-harm or suicide, except in a supportive or educational context.
• Sell or promote illegal goods or services, including weapons, drugs or stolen data, where illegal.
• Commit fraud, scams or other deceptive practices.
• Share someone's private information without their permission, including intimate images.

2. Rights of others

You may not:

• Upload or share content that infringes someone else's copyright, trademark, privacy or other rights.
• Impersonate any person or organisation, or misrepresent your connection to them.
• Collect personal data about other users without their consent and a lawful basis.

If you believe content on the Service infringes your rights, contact [[email protected]] with the details in section 7.

3. Hateful and abusive content

You may not post content that attacks or demeans people based on race, ethnicity, national origin, religion, disability, sex, gender identity, sexual orientation, age or another protected characteristic, or that promotes violence against them.

[Add your own rules on adult content, graphic violence, profanity or other material, depending on your audience.]

4. Security and integrity

You may not:

• Access, or try to access, accounts, systems or data you're not authorised to use.
• Probe, scan or test the vulnerability of the Service without our written permission. [If you have a vulnerability disclosure programme, link it here.]
• Get around or disable security, authentication, rate limits or usage limits.
• Upload viruses, malware or other harmful code.
• Interfere with or disrupt the Service, its servers or networks, including through denial-of-service attacks.
• Use bots, scrapers or other automated means to access the Service, except through our published API and within its limits [or as allowed by our robots.txt].
• Reverse engineer the Service, except where the law allows this despite this restriction.

5. Spam and misuse

You may not:

• Send unsolicited bulk messages, or messages to people who haven't agreed to receive them where the law requires consent.
• Use the Service to send messages that hide or falsify where they came from.
• Create accounts in bulk or by automated means, or create new accounts to get around a suspension.
• Manipulate ratings, reviews, rankings, referrals or engagement.
• Resell or share access to the Service, except as your plan allows.
• Use the Service in a way that puts an unreasonable load on it or affects other users.
• [Product-specific rules, for example sending limits, storage rules or rules for generated content.]

6. What happens if you break this policy

We'll take action proportionate to the breach. Depending on its seriousness, we may:

• Warn you and ask you to fix the problem.
• Remove or restrict access to specific content.
• Temporarily limit features or suspend your account.
• Permanently close your account.
• Report the matter to law enforcement or other authorities where the law requires or where we believe someone is at risk.

Where it's practical and lawful, we'll tell you what we did and why, and how you can ask us to reconsider. For serious breaches, such as illegal content or threats to safety, we may act without warning.

We aren't obliged to monitor all content, but we may review content and activity to enforce this policy and keep the Service safe.

7. Reporting a problem

If you see something on the Service that breaks this policy, tell us:

• Email: [[email protected]]
• In the Service: [use the Report option on content or profiles]

Please include where the content is (a link if possible), what the problem is, and your contact details if you'd like to hear back. For infringement claims, also include the work you believe is infringed, your contact details, and a statement that you believe in good faith that the use isn't authorised.

We review reports [within X working days]. If there's an immediate risk to someone's safety, contact the local emergency services first.

8. Appeals

If you think we made a mistake, reply to our notice or email [[email protected]] within [30] days. Tell us why. Someone who wasn't involved in the original decision will review it [where practical] and tell you the outcome.

9. Changes

We may update this policy. The "Last updated" date shows the latest version. If we make significant changes, we'll tell you [by email or in the Service] before they take effect.

10. Contact

Questions about this policy: [[email protected]].

Cookie notice and banner template

Starting point, not legal advice. Cookie rules differ by country. In the EU and UK, most cookies and similar technology that aren't strictly necessary need consent before they are set, and some countries allow limited exceptions. In the US, rules focus more on disclosure and opt-outs. Have a qualified lawyer review your banner and notice before you rely on them.

This file has four parts:

1. Banner wording you can copy, in three variants.
2. A preferences panel with categories.
3. The cookie notice page itself, with a cookie table template.
4. A checklist for setting it up properly.

"Cookies" here also covers similar technology: local storage, session storage, pixels, tags, SDKs in apps and device fingerprinting. The rules usually treat them the same way.

---

Part 1. Banner wording

Principles

• Accept and reject with equal weight. Same size, same style, same level, both visible on the first layer. Regulators in the EU and UK have said a reject option that is harder to find than accept isn't a valid choice.
• No non-essential cookies before a choice. Analytics, advertising and most embeds load only after consent.
• Closing the banner is not consent. If someone dismisses it, treat that as no choice yet, and keep non-essential cookies off.
• No pre-ticked boxes. Every optional category starts off.
• Plain words. Say what you use cookies for, not just "to improve your experience".
• Easy to change later. A "Cookie settings" link in the footer of every page.

Variant A: standard

Cookies on [Company name]

We use necessary cookies to make this site work. With your permission, we'd also like to use analytics cookies to understand how the site is used, and marketing cookies to measure our ads. You can change your choice at any time in Cookie settings.

[Accept all] [Reject all] [Manage settings]

[Read our cookie notice]

Variant B: short, for small screens

We use necessary cookies to run this site, and optional cookies for analytics and ads if you allow them.

[Accept all] [Reject all] [Settings]

Variant C: analytics only, no advertising

Help us improve [Product name]

We'd like to use analytics cookies to see which pages people use and where they get stuck. We don't use advertising cookies. Necessary cookies that keep the site working are always on.

[Allow analytics] [No thanks]

[Cookie notice]

If you use no optional cookies

You may not need a banner at all. Say so in your cookie notice instead:

We only use cookies that are strictly necessary for this site to work, such as keeping you signed in and remembering your cookie choice. We don't use analytics or advertising cookies.

US-focused variant (opt-out model)

Where your audience is mainly in US states that use an opt-out model, a notice plus clear opt-out links may be used instead of a consent banner. If you serve EU or UK visitors as well, use one of the variants above for them.

We and our partners use cookies for analytics and personalised advertising. You can opt out of the sale or sharing of your personal information, including through cookies, at any time.

[Do Not Sell or Share My Personal Information] [Cookie settings] [OK]

Honour browser opt-out signals such as Global Privacy Control where the law requires.

Wording to avoid

---

Part 2. Preferences panel

Show these categories, each with a short description. Only "Necessary" is on by default and can't be turned off.

Cookie settings

Choose which cookies we can use. You can change this at any time from the Cookie settings link at the bottom of every page.

Necessary - Always on

These make the site work: signing in, keeping your session secure, remembering items in your basket and remembering your cookie choice. The site can't work properly without them.

Preferences - Off

These remember choices such as language, region or display settings, so you don't have to set them each visit.

Analytics - Off

These help us understand how people use the site, which pages are visited and where errors happen, so we can improve it. [We use Analytics provider. Data is reported in aggregate.]

Marketing - Off

These are set by us and our advertising partners to measure how well our ads work and, where allowed, to show you relevant ads on other sites.

[Save choices] [Accept all] [Reject all]

Keep the category names the same in the banner, the panel, the notice and your consent tool so people can follow them.

---

Part 3. The cookie notice page

Everything below the line is the notice to publish, for example at /cookies.

---

Cookie notice

Last updated: [22 October 2026]

This notice explains how [Company name] uses cookies and similar technology on [example.com and the Product name app]. It should be read together with our [Privacy policy, link].

What cookies are

Cookies are small text files that a website stores on your device. Similar technology includes local storage, pixels (tiny images that report when a page or email is viewed) and software development kits in apps. We call all of these "cookies" in this notice.

Cookies set by us are "first-party" cookies. Cookies set by another company, such as an analytics or advertising provider, are "third-party" cookies.

Some cookies last only until you close your browser ("session cookies"). Others stay for a set period ("persistent cookies").

How we use cookies

We only set preferences, analytics and marketing cookies if you agree [or, in places where the law uses an opt-out model, until you opt out].

The cookies we use

We review this list [every quarter and whenever we add a new tool]. Third-party providers may change their cookie names; their own policies have the current details: [links to provider privacy or cookie pages].

Your choices

• Cookie settings: change your choice at any time using [Cookie settings, link in the footer].
• Your browser: most browsers let you block or delete cookies. Blocking necessary cookies may stop parts of the site from working.
• Opt-out signals: we [honour Global Privacy Control signals as an opt-out of sale and sharing where the law requires].
• Advertising opt-outs: [Industry opt-out tools, if relevant to your markets].
• Emails: [Our emails may contain pixels that tell us whether an email was opened. You can block these by turning off automatic image loading in your email app.]

Changes

We'll update this notice when we change the cookies we use. The date at the top shows the latest version. If a change needs your consent, we'll ask again.

Contact

Questions about cookies: [[email protected]].

---

Part 4. Setup checklist

• Scan every page and app screen for cookies, local storage and network calls to third parties. Do it with a fresh browser profile and no consent given.
• Fill in the cookie table from what you found, not from what you think you use.
• Confirm no optional cookies or tags fire before consent. Check with your browser's developer tools on first load.
• Confirm "Reject all" really stops them, including after a page reload.
• Confirm consent is stored and respected across pages and visits.
• Confirm withdrawing consent stops the cookies from then on, and deletes first-party optional cookies where possible.
• Ask again for consent after [6 to 12 months], or when you add a new purpose.
• Keep a record of each consent: when, what version of the banner, which categories.
• Embedded videos, maps and social widgets load only after consent, or use a privacy-enhanced mode or a click-to-load placeholder.
• Footer link to Cookie settings on every page.
• Banner works with a keyboard and a screen reader, and doesn't trap focus.
• Banner text and buttons meet colour contrast requirements.
• Mobile app consent prompts match the website categories.
• Review the setup [every quarter] and when you add any new tool.

Data processing checklist

Starting point, not legal advice. Record-keeping and contract duties differ by law and by the size and type of your business. This checklist helps you find out what personal data you handle so your policies can describe it accurately. Have a qualified lawyer review your conclusions before you rely on them.

Do this before you write or update your privacy policy. A policy written without it usually misses something, and the gaps are what get businesses into trouble.

Under the GDPR and UK GDPR, many organisations must keep a written record of their processing activities, and must have contracts with the service providers that process personal data for them. Even where those duties don't apply, the same record makes every other privacy task faster.

Business: ______________________ Completed by: ______________ Date: ____________

---

Part 1. Find the data

Work through each place personal data can enter your business. Tick each one that applies, then add it to the register in Part 2.

Website and app

• Sign-up and login forms
• Contact, quote or booking forms
• Newsletter sign-up
• Checkout and payment
• User profiles and uploaded content
• In-app messaging or comments
• Support chat widget
• Analytics tools
• Advertising pixels and tags
• Embedded videos, maps, fonts or social widgets that call third-party servers
• Error tracking and session recording tools
• Server and application logs, including IP addresses
• AI features that send user content to an outside provider

Business operations

• Customer database or CRM
• Email inboxes and shared mailboxes
• Invoicing and accounting software
• Spreadsheets with customer or supplier details
• Phone, video call and meeting recordings
• Marketing email platform
• Social media accounts and direct messages
• Shipping and fulfilment providers
• Staff and contractor records (often a separate register)
• Backups

Part 2. Processing register

One row per purpose. Copy this table into a spreadsheet if it gets long.

Notes on the columns:

• Lawful basis is one of: consent, contract, legal obligation, vital interests, public task or legitimate interests. Most small businesses use contract, legal obligation, legitimate interests and consent.
• Legitimate interests needs a short written balancing test: what is your interest, is the processing necessary for it, and do the person's rights outweigh it?
• Sensitive includes the GDPR special categories (such as health, biometric, racial or ethnic origin, religious beliefs, political opinions, sexual orientation) and categories that US state laws treat as sensitive, such as precise location and account login details.
• Retention must be a period or a rule, not "forever".

Part 3. Service providers (processors)

List every outside company that handles personal data for you.

For each provider:

• A data processing agreement (DPA) is in place. Most large providers include one in their terms or let you accept it in account settings. Download and file a copy.
• It covers the points the GDPR requires in Article 28, including acting only on your instructions, confidentiality, security, use of sub-processors, help with rights requests, deletion or return of data at the end, and audits.
• You know where they process data, and which transfer safeguard applies if it leaves the EU, EEA or UK.
• You've checked their security information: certifications, security page or questionnaire.
• You know how they'll tell you about a breach.
• You've subscribed to their sub-processor change notices, if they offer them.
• Only the data they need is sent to them.

Some providers act as independent controllers rather than processors for some data (payment providers often do for fraud prevention, for example). Note this in the register, and name them in your privacy policy's sharing section.

Part 4. Rights requests

• One email address or form receives all privacy requests, and someone checks it at least weekly.
• You know how to find all of a person's data across your systems, using the register above.
• You can export a person's data in a common format such as CSV or JSON.
• You can delete a person's data from each system, and you know how long backups keep it.
• You have a way to confirm identity that doesn't collect more data than needed.
• You log each request: date received, type, identity check, action taken, date closed.
• You know the deadlines that apply: usually one month under the GDPR and UK GDPR, and 45 days under CCPA/CPRA, with extensions allowed in some cases.

Part 5. Security basics

• Two-factor authentication on every account that can reach personal data: email, hosting, database, payments, CRM, domain registrar.
• Access limited to the people who need it, and removed when they leave.
• Data encrypted in transit (HTTPS everywhere) and at rest where the provider supports it.
• Backups taken, tested and protected.
• Laptops and phones that hold customer data have disk encryption and a screen lock.
• Personal data kept out of spreadsheets and email where a proper system exists.
• Test and development systems use fake data, not copies of real customer data.

Part 6. Breach plan

• Named person who decides what to do if a breach happens: [Name].
• Contact details for your hosting provider, payment provider and lawyer in one place.
• You know the deadlines: under the GDPR and UK GDPR, notifiable breaches must be reported to the regulator within 72 hours of becoming aware of them, and people must be told without undue delay when there is a high risk to them. US state breach laws and other countries have their own rules.
• A breach log for every incident, including ones you decide not to report, with the reasons.

Part 7. Do you need more?

Ask a lawyer whether any of these apply:

• Data protection officer: required under the GDPR for some organisations, for example those whose core activities involve large-scale monitoring or large-scale processing of sensitive data.
• EU or UK representative: usually needed if you're based outside the EU or UK and offer goods or services to people there.
• Data protection impact assessment: needed before processing that is likely to result in high risk, such as large-scale profiling or new technology used on sensitive data.
• ICO registration: most UK organisations that process personal data must pay a data protection fee to the Information Commissioner's Office unless exempt.
• Data processing agreement for your customers: if business customers put their own customers' data into your product, you're likely their processor and they will need a DPA from you.

Part 8. Next steps

• Update privacy-policy.md from the register: sections 2 to 7 map directly to Parts 2 and 3 here.
• Update the cookie table in cookie-notice.md from the website and app items in Part 1.
• Set a review date in policy-maintenance.md: [Date].

Policy maintenance

Starting point, not legal advice. Notice periods and the way you must tell people about changes depend on the law where your users are and on what your own terms promise. Have a qualified lawyer review significant changes before you publish them.

Publishing a policy is the start, not the end. A privacy policy that described your business accurately last year may be wrong today because you added an analytics tool, launched in a new country or started a newsletter. This file gives you a routine, a log and notice templates.

---

1. When to update

Update straight away when you

• Add, remove or replace a service provider that handles personal data.
• Add a new tracking, analytics, advertising or session recording tool.
• Start collecting a new type of personal data, especially sensitive data.
• Use existing data for a new purpose, such as AI features, profiling or advertising.
• Start selling or sharing personal data, or stop.
• Move data to a new country or region.
• Launch in a new country or start actively targeting customers there.
• Launch a new product, plan type, subscription or payment model.
• Change prices, renewal terms, refund rules or cancellation methods.
• Let users post content or message each other for the first time.
• Change your company name, address, owner or contact details.
• Are acquired, merge or sell part of the business.
• Have a breach or incident that shows the policy was inaccurate.

Review on a schedule

• Every quarter: run a cookie and tag scan, and compare it with the cookie table.
• Every six months: check the processor list against your actual tools and bills.
• Every year: read every policy end to end, check it against the data register, and ask your lawyer whether any law affecting you has changed.

Next scheduled review: [Date]. Owner: [Name].

2. Major or minor change?

When unsure, treat a change as significant.

3. Notice periods

Changes required by law, or needed urgently for security, can take effect sooner. Explain why in the notice.

4. How to notify users

Use more than one channel for significant changes.

• Email to active users, with a plain summary of what changed and a link to the new version. Send it as a service message, not marketing, with no promotions in it.
• In-product notice such as a banner or modal on next sign-in.
• Updated "Last updated" date and a short "What changed" box at the top of the policy for at least [60] days.
• Re-acceptance for terms changes, where your lawyer advises it: a checkbox on next sign-in or before the next purchase.
• Business customers: notice by email to the account owner, and to the contact named in any contract.

Email template: significant change

Subject: Changes to our [privacy policy / terms of service] from [date]

Hi [first name],

We're updating our [privacy policy / terms of service]. The changes take effect on [date].

What's changing

- [Plain summary of change 1]

- [Plain summary of change 2]

What this means for you

[One or two sentences. For example: "You don't need to do anything." Or: "If you don't want your data used for X, you can turn it off in Settings > Privacy."]

You can read the full updated [policy / terms] at [link], and compare it with the previous version at [link].

If you don't agree with the changes, you can [close your account / cancel your plan] before [date] [and we'll refund any unused prepaid period].

Questions? Reply to this email or contact [[email protected]].

[Company name]

In-product notice

We've updated our [privacy policy / terms]. [One-line summary.] Changes take effect on [date]. [Read what changed]

"What changed" box for the top of the policy

Updated [date]. We [added Provider type to our list of service providers / clarified how long we keep support messages / added a section on AI features]. [See previous version.]

5. Version history

Keep every published version. Store a dated copy (PDF or the page source) each time you publish, so you can show what someone agreed to and when.

Version numbering

• Major number (2.0) for significant changes that needed notice.
• Minor number (1.1) for minor changes.

Records of acceptance

For terms of service and anything people accept actively, record for each user:

• Which version they accepted.
• When (date and time, with time zone).
• How (sign-up checkbox, checkout, re-acceptance prompt).

For cookie consent, record the banner version and the categories accepted.

6. Publishing checklist

• Legal review done for significant changes.
• "Last updated" and "Effective from" dates set.
• Old version archived with its dates.
• Links checked in the footer, checkout, sign-up form and emails.
• Policies consistent with each other: the privacy policy, cookie notice and terms describe the same tools, periods and contact details.
• Translations updated at the same time, if you offer them.
• App store listings updated where they link to or summarise the policy, including privacy questionnaires.
• Notices scheduled and sent.
• Version history table updated.

Privacy policy template

Starting point, not legal advice. Privacy laws differ by country and, in the US and Canada, by state and province. This template is written to work alongside the GDPR, UK GDPR and CCPA as amended by CPRA, but it doesn't make you compliant on its own. Have a qualified lawyer review your final policy before you rely on it.

How to use this template

• Fill in data-processing-checklist.md first. This policy should describe what that record shows, nothing more and nothing less.
• Replace every [bracketed field]. Delete sections that don't apply, and say so where silence would confuse, for example "We do not sell personal information."
• Keep the "Summary" short and true. Many people only read that part.
• The sections marked EU and UK, California and Other US states only apply if those laws apply to you. Remove them if not, but check first (see which-policies-do-i-need.md).
• Write in plain language. If a sentence needs a lawyer to understand it, rewrite it or ask your lawyer to.
• Publish the policy at a stable address such as /privacy, link it from every page footer and from every form that collects personal data.

Everything below the line is the policy itself.

---

Privacy policy

Last updated: [22 October 2026] Effective from: [22 October 2026]

Summary

• [Company name] collects [the personal data you give us when you create an account, buy something or contact us, and basic technical data about how you use our site].
• We use it to [provide our service, process payments, support you and improve the product].
• We [do not sell your personal information / do not share it for cross-context behavioural advertising].
• We share it only with service providers who help us run [Product name], and with authorities where the law requires.
• You can ask to see, correct, export or delete your data by emailing [[email protected]].

The rest of this policy explains each point in detail.

1. Who we are

[Company name] ("we", "us", "our") runs [the website at example.com and the Product name app] (together, the "Service").

• Legal name: [Company legal name]
• Registered address: [Address, country]
• Company number: [Number, if applicable]
• Contact for privacy questions: [[email protected]]

For the purposes of the GDPR and UK GDPR, [Company name] is the controller of the personal data described in this policy, except where section 12 says otherwise.

[If you have appointed one:] Our data protection officer is [Name or firm], who can be reached at [[email protected]].

[If required, because you are outside the EU or UK but offer goods or services to people there:] Our representative in the EU is [Name, address, email]. Our representative in the UK is [Name, address, email].

2. The personal data we collect

Data you give us

Data we collect automatically

Data we receive from others

Sensitive data

[Choose one:]

• We do not intentionally collect sensitive data such as health, biometric, racial or ethnic origin, religious, political or sexual orientation data. Please don't send it to us.
• We collect [describe sensitive data] for [purpose]. We do this only [with your explicit consent / because describe legal condition], and we protect it with [describe extra safeguards].

3. How we use your data and our lawful bases

We use personal data only for the purposes below. If you are in the EU, EEA or UK, the law requires us to have a lawful basis for each purpose. The table shows which one we rely on.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that assessment, and you can object (see section 8).

Where we rely on consent, you can withdraw it at any time. Withdrawing doesn't affect anything we did before.

Where we need data to perform a contract with you and you don't provide it, we may not be able to provide the Service.

[If applicable:] Automated decisions. We [do not make decisions about you based solely on automated processing that have legal or similarly significant effects / use automated processing to describe what, for example fraud screening at checkout. You can ask for a person to review the decision by contacting us].

[If applicable:] AI features. When you use [feature name], the content you submit is sent to [provider type, e.g. "a third-party model provider"] to produce a result. [It is / is not] used to train models. It is kept for [period]. [Explain any opt-out.]

4. Who we share your data with

We don't share personal data except as described here.

These service providers act on our instructions under written contracts that require them to protect your data and use it only to provide services to us. [An up-to-date list is available at link.]

We may also share personal data:

• With professional advisers such as lawyers, accountants and auditors, under confidentiality duties.
• With authorities when the law requires it, or when we believe in good faith it's necessary to protect someone's safety, investigate fraud or respond to a lawful request.
• In a business transfer, if [Company name] is involved in a merger, acquisition or sale of assets. We'll tell you before your data becomes subject to a different privacy policy.
• With your consent or at your direction, for example when you connect a third-party integration.

We [do not] sell personal information, and we [do not] share it for cross-context behavioural advertising, as those terms are defined in California law. [If you do, say so here and describe your opt-out in section 8.]

5. How long we keep your data

We keep personal data only as long as we need it for the purposes in section 3, then delete or anonymise it.

6. How we protect your data

We use technical and organisational measures appropriate to the risk, including [encryption in transit and at rest, access controls with two-factor authentication for staff, least-privilege access, regular backups, logging and monitoring, and staff confidentiality obligations].

No system is completely secure. If a breach affects your personal data in a way that is likely to put you at risk, we'll tell you and the relevant regulator where the law requires.

7. International transfers

[Company name] is based in [country]. Our service providers process data in [countries or regions]. This means your data may be transferred to and stored in countries with different data protection laws from your own.

EU, EEA and UK. When we transfer personal data out of the EU, EEA or UK, we make sure it is protected by one of the following:

• An adequacy decision, meaning the destination country has been found to provide adequate protection. For transfers to the United States, this may include recipients certified under the EU-US Data Privacy Framework and its UK Extension.
• Standard contractual clauses approved by the European Commission, together with the UK International Data Transfer Addendum or the UK International Data Transfer Agreement for UK data.
• Another safeguard or condition allowed by the law.

You can ask us for a copy of the safeguards we rely on by emailing [[email protected]].

8. Your rights and how to use them

Everyone

Wherever you are, you can:

• Ask what personal data we hold about you and get a copy.
• Ask us to correct data that is wrong.
• Ask us to delete your data.
• Unsubscribe from marketing emails at any time, using the link in each email or by contacting us.
• Close your account in [Settings > Account].

We'll answer every request, and we won't treat you differently for using your rights.

EU, EEA and UK

Under the GDPR and UK GDPR you have the right to:

• Access your personal data.
• Rectification of inaccurate data.
• Erasure in certain circumstances.
• Restriction of processing in certain circumstances.
• Data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another controller, where processing is based on consent or contract and carried out by automated means.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects, with some exceptions.
• Withdraw consent at any time, where we rely on it.
• Complain to a supervisory authority. In the UK this is the Information Commissioner's Office. In the EU it is the data protection authority where you live, work or think the problem happened. We'd appreciate the chance to address your concern first.

California

If the CCPA as amended by CPRA applies to us, California residents have the right to:

• Know what personal information we collect, use, disclose, sell and share, and to access it.
• Delete personal information we collected from you, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. [We do not sell or share personal information. / Use the "Do Not Sell or Share My Personal Information" link at link.]
• Limit the use and disclosure of sensitive personal information to what is needed to provide the Service. [We only use sensitive personal information for those purposes. / Use the "Limit the Use of My Sensitive Personal Information" link at link.]
• Not be discriminated against for using these rights.

We [honour / will honour] opt-out preference signals such as Global Privacy Control as a valid request to opt out of sale and sharing for that browser [and any account linked to it].

In the past 12 months we collected the categories of personal information listed in section 2, from the sources listed there, for the purposes in section 3, and disclosed them for business purposes to the categories of recipients in section 4. [We have not sold or shared personal information in the past 12 months.]

You can use an authorised agent to make a request on your behalf. We may ask the agent for proof of authorisation and ask you to confirm your identity directly.

Other US states

Several US states give residents rights similar to those above, such as access, correction, deletion, portability and opting out of targeted advertising, sale and certain profiling. If one of these laws applies to you, use the contact details below. If we decline your request, you can appeal by replying to our decision with the subject line "Appeal". [If the law in your state requires it, add how to contact the state attorney general if the appeal is denied.]

Canada and Australia

If you are in Canada, you have rights of access and correction under PIPEDA or the applicable provincial law, and you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. If you are in Australia, you can access and correct your information under the Privacy Act 1988 and complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.

How to make a request

• Email [[email protected]] with the subject "Privacy request", or use [the form at link / Settings > Privacy].
• Tell us what you'd like us to do and which email address or account the request relates to.
• We'll confirm your identity before acting, usually by asking you to reply from the email address on your account. We'll only ask for what we need to confirm it's you.
• We'll respond within the time the law requires, usually [one month (EU and UK) or 45 days (California)], and tell you if we need longer and why.
• Requests are handled at no cost, unless they are clearly unfounded or excessive, where the law allows us to charge a reasonable fee or refuse.

9. Cookies and similar technology

We use cookies and similar technology such as local storage and pixels to [keep you signed in, remember your preferences, understand how the Service is used and measure marketing]. Some are strictly necessary. Others are only set if you agree.

You can change your choices at any time in [Cookie settings, link in the footer]. Full details, including a list of the cookies we use, are in our [Cookie notice, link].

10. Children

The Service is [not directed at children under 13 / 16 / 18] and we don't knowingly collect personal data from them. If you believe a child has given us personal data, contact [[email protected]] and we'll delete it.

[If your service is aimed at or likely to be used by children, replace this section with advice from a lawyer. Rules such as COPPA in the US, the age of digital consent under GDPR Article 8, and the UK Age Appropriate Design Code may apply.]

11. Links to other sites

The Service may link to websites and services we don't control. Their own privacy policies apply, not this one.

12. When we process data for our business customers

[Delete if not applicable.] When a business uses [Product name] to process personal data about its own customers or staff, that business is the controller and we act as its processor. Our [Data processing agreement, link] governs that processing. If your data is in a workspace run by an organisation, please contact that organisation first.

13. Changes to this policy

We'll update this policy when our practices or the law change. The "Last updated" date at the top shows when it last changed. If we make a significant change, we'll tell you [by email or with a notice in the Service] at least [30] days before it takes effect, unless the change is required sooner by law. Previous versions are available [at link / on request].

14. Contact us

• Email: [[email protected]]
• Post: [Company legal name, address, country]
• [Data protection officer: Name, email]
• [EU representative: Name, address, email]
• [UK representative: Name, address, email]
• [Phone number for California requests, if the law requires one for your business: number]

Refund and cancellation policy template

Starting point, not legal advice. Consumer law differs by country and state, and some customer rights can't be removed by any policy. This template includes wording for common statutory rights, but you need to check which apply to you. Have a qualified lawyer review your final policy before you rely on it.

How to use this template

1. Decide which of the four variants below you need: digital goods, subscriptions, physical goods and services. Many businesses need two or more.
2. Copy the shared opening and closing sections, then add the variant sections you need.
3. Make your checkout match the policy. The digital content wording in particular only works if the checkout asks for it (see "Checkout wording" below).
4. Publish the policy at a stable address such as /refunds, link it from the footer, the checkout page and your order confirmation emails.

Statutory rights you can't override

Your policy can be more generous than the law, never less. Some of the rules that often apply:

Business-to-business sales are often outside these consumer rules, but your contract terms still apply.

Checkout wording for digital content and services

If you sell digital downloads, online access or services that start straight away to consumers in the EU or UK, and you want the 14-day withdrawal right to end once access begins, the checkout needs an active step. A common pattern:

- [ ] I want access to start immediately. I understand that I lose my right to withdraw from this purchase once the download or streaming has started.

Then confirm it in the order email:

You asked for immediate access to [product] and acknowledged that your right to withdraw ends once access begins. Access started on [date and time].

For services:

- [ ] Please start the service now. I understand that if I cancel within 14 days I may have to pay for the part of the service already provided, and that I lose the right to cancel once the service has been fully provided.

The box must not be pre-ticked. Without these steps, the normal 14-day right usually applies even if the customer has already downloaded the product.

Everything below the line is the policy itself. Keep the sections you need.

---

Refund and cancellation policy

Last updated: [22 October 2026]

This policy explains how cancellations and refunds work for purchases from [Company legal name] ("[Company name]", "we", "us") through [example.com / the Product name app].

The short version

• [Digital products: refunds within 14 days if you haven't downloaded the product, or if it doesn't work as described.]
• [Subscriptions: cancel any time. You keep access until the end of the period you've paid for.]
• [Physical products: return unused items within 30 days.]
• [Services: cancel up to 48 hours before a booking for a full refund.]
• Faulty or not as described? Contact us and we'll put it right.
• This policy doesn't affect your statutory rights.

How to ask for a refund

Email [[email protected]] [or use the form at link] with:

• Your order number or the email address you used to buy.
• What you bought.
• Why you're asking for a refund (optional for a withdrawal within the legal cancellation period, but it helps us improve).

[EU and UK customers can also use the withdrawal function at link, or the model withdrawal form below.]

We'll reply within [2 working days].

Digital products

This covers [downloads, templates, e-books, software licences, online courses and other digital content].

• Before you download or access it: you can cancel within 14 days of purchase for a full refund.
• After you download or access it: if you're in the EU or UK and you asked for immediate access at checkout, acknowledging that your right to withdraw would end once access began, the 14-day withdrawal right no longer applies.
• Our own promise: [Optional, more generous than the law. For example: "If the product doesn't work for you, email us within 14 days and we'll refund you, no questions asked." Or: "Because digital products can't be returned, we don't offer refunds after download, except where the product is faulty or not as described."]
• Faulty or not as described: if the product doesn't work or isn't what we described, we'll fix it, replace it or refund you.
• Licence keys and access: when we refund a digital product, we'll [deactivate the licence / remove access].

Subscriptions

This covers [monthly and annual plans for Product name].

• Cancel any time in [Settings > Billing] or by emailing [[email protected]]. Cancelling stops the next renewal. You keep access until the end of the period you've already paid for.
• Monthly plans: we don't refund the current month after it has started, [except where required by law].
• Annual plans: [if you cancel within 14 days of the first payment or of a renewal, we'll refund that payment in full / we'll refund the unused months on a pro-rata basis / we don't refund unused time].
• EU and UK withdrawal: when you first subscribe, you have 14 days to withdraw. If you asked us to start the service straight away, we may deduct a proportionate amount for the time you used.
• Renewals: we'll remind you before an annual plan renews [7 days / 30 days] in advance.
• Trials: if you cancel before your trial ends, you won't be charged.
• Price changes: we'll tell you at least [30] days before a price change applies to your plan, so you can cancel first if you prefer.
• Downgrades: take effect at the next renewal. [We don't refund the difference for the current period.]

Physical products

• Change of mind: you can return unused items in their original condition within [30] days of delivery for a refund of the item price. [EU and UK customers have at least 14 days to cancel and a further 14 days to send the goods back.]
• Delivery costs: if you cancel within the legal cancellation period, we'll refund the standard delivery charge you paid. [You pay for return delivery unless the item is faulty or we sent the wrong item.]
• Items we can't take back for change of mind: [personalised or made-to-order items, perishable goods, sealed hygiene products that have been unsealed, sealed audio, video or software that has been unsealed]. This doesn't affect your rights if they're faulty.
• Faulty, damaged or wrong items: contact us within [30] days of delivery with a photo if you can. We'll [repair, replace or refund] and cover return postage.
• How to return: email us first for a returns address [and label]. Pack items securely. We recommend a tracked service.
• Condition: we may reduce a refund if the item has been handled more than needed to check it, in the same way you could in a shop.

Services

This covers [consultations, bookings, projects, classes and other services].

• Cancelling a booking: cancel at least [48 hours] before the start time for a full refund. Cancellations with less notice [are charged at 50% / are not refunded / can be moved once at no charge].
• If we cancel: you get a full refund or a new date of your choice.
• Projects: [deposits of X% are non-refundable once work has started / work completed up to the cancellation date is charged at the agreed rate].
• EU and UK withdrawal: you have 14 days from booking to cancel. If you asked us to start within that period, you'll pay for the part already provided. Once the service is fully provided at your request, the right to cancel ends.
• Not done with reasonable care and skill: tell us and we'll [redo the work or refund an appropriate amount].

When you'll get your refund

• We'll refund you within [14] days of agreeing the refund, or of receiving your cancellation within the legal cancellation period.
• For physical goods returned after a change of mind, we may wait until we receive the goods back, or you send proof of return, whichever is first.
• We refund to the original payment method. Your bank or card provider may take a few more days to show it.
• [We don't charge fees for refunds.]

Chargebacks

If something is wrong, please contact us first. We can usually sort it out faster than a card dispute. You keep any right you have to raise a dispute with your card issuer.

Model withdrawal form (EU and UK)

Customers can use this, or any other clear statement, to cancel within the legal period.

To: [Company legal name, address, email]

I hereby give notice that I withdraw from my contract for the sale of the following goods / for the supply of the following service or digital content:

Ordered on / received on:

Name:

Address:

Date:

Contact

• Email: [[email protected]]
• Post: [Company legal name, address, country]

This policy doesn't affect your statutory rights as a consumer.

Terms of service template

Starting point, not legal advice. Contract and consumer law differ by country and state, and some clauses here, such as limits on liability, may not be enforceable against consumers in every place you sell. Have a qualified lawyer review your final terms before you rely on them.

How to use this template

• Replace every [bracketed field] and delete clauses that don't fit what you offer.
• Clauses marked Subscriptions, User content or Business customers only apply if you have those things.
• Consumer protection laws in the EU, UK, Australia and elsewhere give customers rights your terms can't remove. Clause 14 says so plainly. Keep it.
• Ask people to agree to the terms actively, for example with an unticked checkbox or a clear "By creating an account you agree to..." line next to the button, and keep a record of which version each person agreed to.
• Keep the terms consistent with your privacy policy, refund policy and acceptable use policy. Link to them rather than repeating them.

Everything below the line is the terms themselves.

---

Terms of service

Last updated: [22 October 2026]

These terms ("Terms") are an agreement between you and [Company legal name] ("[Company name]", "we", "us"), a company registered in [country] under number [number], with its address at [address]. They cover your use of [the website at example.com, the Product name app and related services] (the "Service").

Please read them carefully. By [creating an account / buying / using the Service] you agree to these Terms. If you don't agree, don't use the Service.

If you use the Service on behalf of an organisation, you confirm you have authority to accept these Terms for it, and "you" includes that organisation.

1. Summary

This summary is for convenience. The full Terms below are what apply.

• You need to be at least [18 / the age of majority where you live] to use the Service.
• Keep your account secure. You're responsible for what happens in it.
• Paid plans renew automatically until you cancel. You can cancel at any time in [Settings > Billing].
• You keep ownership of your content. You give us the permission we need to run the Service.
• Don't misuse the Service. Our [Acceptable use policy] explains what that means.
• We may suspend accounts that break these Terms.
• The Service is provided as it is, within the limits the law allows.

2. Other documents that apply

These Terms include the following documents:

• [Privacy policy, link], which explains how we handle personal data.
• [Acceptable use policy, link], which sets out what you may not do with the Service.
• [Refund and cancellation policy, link].
• [Any plan-specific terms, service level agreement or data processing agreement, link].

If these documents conflict, [these Terms apply / the more specific document applies].

3. Eligibility

You may use the Service only if you are at least [18] years old, or the age of majority where you live if higher, and you're not barred from using it under any applicable law.

4. Your account

• Give accurate information when you sign up and keep it up to date.
• Keep your password secure and don't share your account. [Team plans allow separate logins for each member.]
• Turn on two-factor authentication if the Service offers it.
• Tell us straight away at [[email protected]] if you think someone has accessed your account without permission.
• You're responsible for activity in your account unless it results from our failure to keep the Service secure.

5. Using the Service

We grant you a personal, non-exclusive, non-transferable, revocable right to use the Service for [your personal use / your internal business purposes] in line with these Terms.

You agree to follow our [Acceptable use policy]. In particular, you won't:

• Break the law or infringe anyone's rights.
• Try to get around usage limits, security measures or access controls.
• Copy, resell or rent the Service, except as these Terms allow.
• Reverse engineer the Service, except where the law allows this despite this restriction.
• Use automated means to access the Service in a way that puts an unreasonable load on it, except through our published API within its limits.

6. Plans, payments and renewals

Prices and taxes

Prices are shown [on our pricing page, link] and at checkout. [Prices include / exclude] [VAT / sales tax / GST], which [is added at checkout where applicable].

Payment

Payments are processed by [payment provider]. By giving us a payment method you authorise us to charge it for the plan you choose, including renewals.

Subscriptions

[Delete this section if you don't sell subscriptions.]

• Paid plans renew automatically at the end of each [month / year] at the then-current price until you cancel.
• You can cancel at any time in [Settings > Billing] or by emailing [[email protected]]. Cancellation takes effect at the end of the current billing period, and you keep access until then.
• We'll remind you before an annual plan renews [at least 7 days / the period required by law] in advance.
• If we change the price of your plan, we'll tell you at least [30] days before the change takes effect. The new price applies from your next renewal after that notice. If you don't want to pay it, you can cancel before then.

Trials

[Delete if not applicable.] If you start a trial that converts to a paid plan, we'll tell you the price and the date the first charge happens before you start, and [remind you before it ends]. Cancel before the trial ends to avoid being charged.

Failed payments

If a payment fails, we'll tell you and try again. If it still fails after [14] days, we may downgrade or suspend your account until payment is made.

Refunds

Refunds are covered by our [Refund and cancellation policy, link]. Nothing in these Terms affects any statutory right you have to cancel or to a refund.

7. Our intellectual property

The Service, including its software, design, text, graphics and trademarks, belongs to [Company name] or our licensors and is protected by law. These Terms don't give you any rights in it except the right to use the Service as described in clause 5.

If you send us feedback or suggestions, we may use them without any obligation to you.

8. Your content

[Delete this section if users can't upload or create content.]

"Your content" means anything you upload, post, create or store in the Service.

• You keep ownership. We don't claim ownership of your content.
• Licence to us. You give us a worldwide, non-exclusive, royalty-free licence to host, store, copy, process, display and transmit your content only as needed to provide, secure and improve the Service for you, and for any other purpose you ask us to. This licence ends when you delete your content or your account, except for copies in backups that are deleted on our normal schedule, and content you've shared with others that they have kept.
• Public content. If you choose to make content public, you also allow other users to view and share it within the Service [describe any wider licence, for example for publicly shared templates].
• Your responsibility. You confirm you have the rights needed to upload your content and to grant this licence, and that it doesn't break the law or our Acceptable use policy.
• Removal. We may remove content that we reasonably believe breaks these Terms or the law. Where the law requires and it is practical, we'll tell you why and how to challenge the decision.
• Back up your content. We take care of your data, but you should keep your own copies of important content.

[Optional, for AI features:] We [do not] use your content to train machine learning models. [Describe any opt-in or opt-out.]

9. Third-party services

The Service may let you connect to services run by other companies. Your use of those services is governed by their terms, and we're not responsible for them.

10. Changes to the Service

We're always working on the Service and may add, change or remove features. If we remove a feature that is a significant part of a paid plan, we'll give you reasonable notice and, if you cancel because of it, a pro-rata refund for any prepaid period you can't use.

11. Suspension and termination

By you

You can stop using the Service and close your account at any time in [Settings > Account]. Closing your account doesn't by itself cancel a paid plan you've already paid for unless our refund policy says otherwise.

By us

We may suspend or end your access to the Service if:

• You seriously or repeatedly break these Terms or our Acceptable use policy.
• You don't pay amounts due after reminders.
• We're required to by law.
• Your use creates a security risk or legal risk for us or others.

Where reasonable, we'll warn you first and give you a chance to fix the problem. If we end your access without you being at fault, for example because we close the Service, we'll give you at least [30] days' notice where possible and a pro-rata refund for any prepaid period.

After termination

We'll keep your content for [30] days after your account closes so you can export it, unless the law requires otherwise or we closed the account because of a serious breach. After that we delete it as described in our Privacy policy. Clauses that by their nature should survive, including 7, 12, 13, 15 and 16, continue after termination.

12. Disclaimers

We work hard to keep the Service available and accurate, but we provide it "as is" and "as available". To the extent the law allows, we don't make any promises that it will be uninterrupted, error-free or fit for a particular purpose, beyond what these Terms expressly say.

This clause doesn't affect your statutory rights as a consumer (see clause 14).

13. Limitation of liability

Nothing in these Terms limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that can't be limited or excluded by law.

Subject to that:

• We're not liable for losses that weren't reasonably foreseeable when you accepted these Terms.
• Business customers: we're not liable for loss of profits, revenue, business, goodwill or data, or for indirect or consequential loss. Our total liability arising from these Terms in any 12-month period is limited to [the amount you paid us in that period / a fixed amount].
• Consumers: we only provide the Service for domestic and private use. We're not liable to you for any loss of profit, loss of business, business interruption or loss of business opportunity.

[Ask your lawyer to review this clause for each market you sell in. Courts and consumer laws in many countries limit how far it can apply.]

14. Your statutory rights

If you're a consumer, you have legal rights under the laws of the country where you live that these Terms can't take away. Nothing in these Terms affects those rights. For example, consumers in the EU and UK usually have a right to cancel certain online purchases, and consumers in Australia have automatic rights under the Australian Consumer Law. See our [Refund and cancellation policy] for details.

15. Indemnity

[Business customers only. Delete or limit for consumers after advice.] If you use the Service for business, you agree to compensate us for reasonable losses and costs arising from a third-party claim that your content, or your use of the Service in breach of these Terms, infringes their rights or breaks the law.

16. Governing law and disputes

These Terms are governed by the law of [country / state]. Disputes will be dealt with by the courts of [place], except that:

• If you're a consumer living in [the EU, the UK or another country whose law gives you this right], you can also bring proceedings in the courts where you live, and you keep the protection of the mandatory laws of that country.
• [Optional:] Before starting formal proceedings, we both agree to try to resolve the dispute informally by contacting [[email protected]] and allowing [30] days to reach a solution.

[If you are considering arbitration clauses or class action waivers, get specific advice. Their enforceability varies widely, and some consumer laws prohibit them.]

17. Changes to these Terms

We may update these Terms to reflect changes in the Service, our business or the law. We'll tell you about significant changes [by email or in the Service] at least [30] days before they take effect, unless a change is required sooner by law or is needed to address a security risk. If you keep using the Service after the change takes effect, the new Terms apply. If you don't agree, you can close your account before then [and receive a pro-rata refund for any prepaid period].

18. General

• Entire agreement. These Terms and the documents in clause 2 are the whole agreement between us about the Service.
• Transfer. We may transfer our rights and obligations to another organisation, for example in a sale of our business. We'll tell you if this happens and make sure your rights aren't reduced. You may not transfer your rights without our written consent.
• Severability. If a court finds part of these Terms unenforceable, the rest still applies.
• No waiver. If we don't enforce a right straight away, we can still enforce it later.
• Events outside our control. We're not responsible for delays or failures caused by events outside our reasonable control.
• Notices. We'll send notices to the email address on your account. You can send notices to [[email protected]].
• Language. [If you offer translations:] If there's a conflict between versions, the [English] version applies, unless local law requires otherwise.

19. Contact

• Email: [[email protected]]
• Post: [Company legal name, address, country]

Which policies do I need?

Starting point, not legal advice. Laws differ by country, and in the US and Canada by state and province. This guide helps you work out which documents to prepare and what to ask a lawyer. Have a qualified lawyer review your final documents before you rely on them.

Answer the questions below for your business as it is today and as you expect it to be in the next year. Each "yes" points to a document in this pack and to the sections in it that matter most.

Business: ______________________ Completed by: ______________ Date: ____________

---

Step 1. Quick decision table

Almost every online business needs at least a privacy policy. A contact form or a mailing list is enough to make it necessary.

Step 2. Where are your customers?

Laws usually follow where your customers or users are, not only where your company is based. Tick every region where you have, or are aiming for, real customers.

If you tick more than one region, write your documents to meet the strictest standard that applies, then add region-specific sections where the rules differ. The templates in this pack are set up that way.

Step 3. Questions that change what your documents say

Answer yes or no. A "yes" means a specific section needs extra care.

Step 4. Your document list

Copy the outcome here so it becomes a plan.

Step 5. Before you write a word

Policies describe what you actually do. If you write them from a template without checking, they will be wrong, and a wrong policy can be worse than a short honest one.

1. Fill in data-processing-checklist.md first. It tells you what data you hold, why, where and for how long.
2. Check your website and app for every tag, pixel, script and embed. Your browser's developer tools show the cookies and network requests on each page.
3. List every outside service that touches personal data.
4. Then draft the documents in this order: privacy policy, cookie notice, terms, refund policy, acceptable use policy.
5. Book the lawyer review once the drafts are complete, not before. You will get better advice on a full draft.

What to ask your lawyer

• Which laws apply to us, given where our customers are and what we sell?
• Do we meet any thresholds that bring us under CCPA/CPRA or other US state privacy laws?
• Which lawful basis fits each purpose in our data table?
• Is our cookie banner compliant in our main markets?
• Are our limitation of liability and governing law clauses enforceable against consumers where we sell?
• Does our refund policy respect the statutory rights that can't be removed?
• Do we need to appoint an EU or UK representative, or a data protection officer?