Website Trust Kit

Changelog

• 1.0.0, 21 October 2026: first release

Website Trust Kit

Version 1.0.0

People decide whether to trust a website in seconds, and then check the details before they pay, sign up or get in touch. This kit helps you get those details right: who you are, how to reach you, what things cost, what happens if something goes wrong and how you handle their data.

Who it's for

• Small businesses, freelancers and shops with their own website
• Indie makers selling software, courses or digital products
• Anyone reviewing a site before a relaunch

No technical background needed, except for the email authentication guide and security.txt, which you may want to hand to whoever manages your domain.

How to use it in 5 minutes

1. Open trust-checklist.md and tick what you already have. The gaps are your to-do list.
2. Open footer-checklist.md and compare it with your site's footer. It's the quickest visible win.
3. Pick the template for your biggest gap from templates/ and fill in the square brackets.
4. Send email-authentication.md to whoever manages your domain, or follow it yourself.
5. Book an hour to go through page-review-sheet.md with a fresh pair of eyes.

File map

Important

The policy templates are starting points to help you write clearly. They are not legal advice and may not cover the laws that apply to you. Have a qualified professional review your policies, especially if you sell to customers in several countries, handle sensitive data or work with children.

Licence

MIT License. See LICENSE.txt.

Email authentication: SPF, DKIM and DMARC

Three DNS records tell inbox providers which services are allowed to send email for your domain. With them in place, your messages are more likely to reach the inbox, and it's much harder for someone to send email pretending to be you.

Large inbox providers now expect these. Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, and Microsoft introduced similar rules for high-volume senders to Outlook addresses in 2025. Even if you only send a few emails a day, set them up.

You'll need access to your domain's DNS settings (at your registrar, or wherever your DNS is hosted, such as Cloudflare). All examples use example.com. Replace it with your domain.

---

Step 1: list everything that sends email as you

Before touching DNS, write down every service that sends from an @example.com address.

Each service's help pages will give you the exact SPF value and DKIM records. Use theirs rather than guessing.

Step 2: SPF

SPF lists the servers allowed to send for your domain. It's one TXT record on the root of the domain.

Common includes (check each provider's current documentation, since these can change):

Combining two services:

v=spf1 include:_spf.google.com include:[newsletter-provider-include] ~all

Rules that catch people out:

• Only one SPF record per domain. Two records starting with v=spf1 break SPF. Merge them into one.
• Ten lookup limit. Each include, a, mx and redirect counts towards a limit of 10 DNS lookups. Go over it and SPF fails. Remove services you no longer use.
• Ending. ~all (soft fail) is a safe start. -all (hard fail) is stricter, and fine once you're sure every sender is listed.
• Domains that never send email should say so, to stop spoofing:

  v=spf1 -all

Step 3: DKIM

DKIM adds a signature to each message, which receivers check against a public key in your DNS. Each sending service gives you its own record, usually created from its dashboard.

DKIM records look like one of these:

The part before ._domainkey is called the selector. Each service uses its own, so you can have several DKIM records side by side.

Tips:

• Use 2048-bit keys where the service offers a choice.
• Some DNS panels split long TXT values into several quoted strings. That's normal.
• After adding the record, go back to the service and click its "verify" or "authenticate" button.

Step 4: DMARC

DMARC tells receivers what to do when a message fails SPF and DKIM checks, and where to send reports. It's one TXT record at _dmarc.

Start by watching, without affecting delivery:

After two to four weeks of reports showing all your real email passes, tighten it in stages:

v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected]
v=DMARC1; p=quarantine; rua=mailto:[email protected]
v=DMARC1; p=reject; rua=mailto:[email protected]

Tips:

• DMARC reports are XML files and arrive in large numbers. Use a dedicated mailbox, or a DMARC reporting service, to read them.
• If the report address is on a different domain, that domain needs an extra record to accept them. Keeping it on your own domain avoids this.
• For DMARC to pass, at least one of SPF or DKIM must pass and match your From domain. DKIM alignment is the more reliable of the two, since SPF often fails when email is forwarded.

Step 5: check it works

1. Wait for DNS to update. Usually minutes, sometimes up to a day or two.
2. Send an email from each service to a Gmail address. Open it, choose "Show original" and check SPF, DKIM and DMARC all say PASS.
3. Use any public DNS lookup tool to confirm the records are visible.
4. Read your first DMARC reports and look for legitimate senders that fail.

A complete example

For a business using Google Workspace for mail and one newsletter tool:

example.com.                  TXT    "v=spf1 include:_spf.google.com include:[newsletter-include] ~all"
google._domainkey.example.com TXT    "v=DKIM1; k=rsa; p=[public key from Google Admin]"
[selector]._domainkey         CNAME  [value from newsletter tool]
_dmarc.example.com.           TXT    "v=DMARC1; p=none; rua=mailto:[email protected]"

Also worth doing

• Bulk email extras. If you send marketing email in volume, the major inbox providers also expect a one-click unsubscribe link and a low spam complaint rate. Check their current sender guidelines.
• Parked domains. For domains you own but don't use for email, add v=spf1 -all, a DMARC record with p=reject, and no MX record. Scammers love unused domains.
• MTA-STS and TLS reporting are optional extras that make sure mail to you travels encrypted. Worth a look once the basics are done.
• BIMI can show your logo next to your emails in some inboxes, once DMARC is at quarantine or reject. Some providers also require a paid certificate for it.

Footer checklist

The footer is where careful visitors go to check you're real. Most of them are looking for one of four things: who you are, how to contact you, your policies, and whether the site is looked after.

Must have

• Business or trading name
• Copyright line with the current year, for example © 2026 Your Business Ltd
• Link to the contact page (or the email address itself)
• Link to the privacy policy
• Link to the terms (terms of service, terms of sale or terms of use)
• Link to the refund or returns policy, if you sell anything

Should have

• Link to the about page
• Link to the accessibility statement
• Cookie settings link, if you use a consent tool, so visitors can change their choice later
• Physical address, if you have premises customers visit
• Company registration and VAT numbers, where required or expected in your country
• Link to an imprint or legal notice page, where required (for example, Germany and Austria)
• Link to your status page, if you run an online service

Nice to have

• Links to two to four active social profiles, using simple drawn icons with text labels for screen readers
• Newsletter sign-up with a clear note on what you'll send and how often
• Payment method logos, only for methods you actually accept
• A short line about what you do, for visitors who scrolled straight down

Leave out

• Long lists of keyword links meant for search engines
• Badges or seals you haven't earned or that don't link to a real verification
• Links to empty or abandoned social accounts
• Out-of-date copyright years
• Contact details that go to an inbox no one checks

Quick checks

• Every footer link works and goes to the right page.
• The footer is the same on every page, including checkout and blog pages.
• Text in the footer has enough contrast. Footers are often pale grey on grey.
• Links are big enough to tap on a phone, with space between them.
• Policy links show "Last updated" dates on the pages they open.

Example layout

Your Business                Company          Help              Legal
A short line about           About            Contact           Privacy policy
what you do.                 Blog             Help centre       Terms of service
                             Careers          Status            Refund policy
                                                                Accessibility
                                                                Cookie settings

© 2026 Your Business Ltd. Registered in [country], company no. [number].
[Street, City, Postcode]

Page-by-page review sheet

Review your site the way a cautious first-time visitor would. Do it on a phone first, then on a computer. If you can, ask someone who has never seen your site to do it while you watch without helping.

For each page, tick what passes and write down what doesn't.

Site: ______________________ Reviewer: ______________ Device: ______________ Date: ____________

---

Every page

Check these once on a few sample pages:

• Loads in under three seconds on a mobile connection
• No layout jumps while loading
• Logo links to the home page
• Navigation works on a phone
• Footer is complete (see footer-checklist.md)
• Page title in the browser tab describes the page
• Link preview looks right when pasted into a chat app

Home page

• Within five seconds, a visitor can tell what you do, who it's for and what to do next.
• The main button says what happens ("Book a call", "See pricing"), not just "Learn more".
• There's a reason to believe you: real customers, a short story, numbers you can back up, or examples of work.
• No claims you can't support.
• Contact or support is reachable in one tap.

Notes: ____________________________________________________________

About page

• Names real people, or explains clearly who is behind the business.
• Says why you do this, in your own words.
• Includes a real photo of the team, workspace or product if you can.
• Gives a location, at least the city or country.
• Ends with a next step (contact, see work, shop).

Notes: ____________________________________________________________

Products, services or features

• Each one says what it is, who it's for and what the result is.
• Photos or screenshots show the real thing.
• Specifications, sizes, requirements or limits are listed.
• Stock status or availability is accurate.

Notes: ____________________________________________________________

Pricing page

• Every price is visible, or the quote process is explained.
• Tax, delivery and currency are clear.
• Recurring prices say per month or per year, and when billing starts.
• Trial terms say what happens at the end.
• Refund policy is linked.
• A frequently asked questions section covers cancellation, upgrades and payment methods.

Notes: ____________________________________________________________

Contact page

• At least one direct contact method that a person reads.
• Response time stated.
• Contact form tested: message received, confirmation shown and emailed.
• Address and hours, if you have premises.
• Links to help articles for common questions.

Notes: ____________________________________________________________

Sign-up or checkout

• Asks only for what's needed.
• Total price, including tax and delivery, shown before payment.
• Terms, privacy policy and refund policy linked.
• No pre-ticked boxes for extras or marketing email.
• Payment handled by a recognised provider's checkout or payment fields.
• Clear confirmation page and confirmation email.
• Test purchase made this month, and refunded.

Notes: ____________________________________________________________

Testimonials, reviews and case studies

• Every one passes the honesty rules in trust-checklist.md, section 11.
• Each has a name, initials or company, used with permission.
• Rewards or relationships are disclosed.

Notes: ____________________________________________________________

Blog or news

• Most recent post date is not so old that the site looks abandoned. If it is, hide dates or remove the blog from the menu.
• Author names shown.
• No broken images or embeds.

Notes: ____________________________________________________________

Privacy policy

• Matches the tools and services the site actually uses today.
• Shows a "Last updated" date.
• Gives a contact for privacy questions.
• Linked from every form that collects personal data.

Notes: ____________________________________________________________

Terms and refund policy

• Written in plain language.
• Shows a "Last updated" date.
• Matches what you actually do when someone asks for a refund.

Notes: ____________________________________________________________

Accessibility statement

• Says what standard you aim for.
• Lists known issues honestly.
• Gives a way to get help or report a problem.

Notes: ____________________________________________________________

Error and empty pages

• The 404 page is friendly, explains what happened and links back to useful pages.
• Form error messages say what to fix.
• Empty search results suggest what to try next.

Notes: ____________________________________________________________

---

Top five fixes

Next review date: ____________

Trust checklist

Visitors trust a site when it's clear who runs it, what it costs, how to reach a person and what happens when something goes wrong. Work through each section and tick what's done. Anything left unticked is your to-do list.

Site: ______________________ Checked by: ______________ Date: ____________

---

1. The basics

• The whole site loads over HTTPS, and http:// addresses redirect to https://.
• There are no browser warnings about mixed content or certificates on any page.
• www and non-www both work and redirect to one version.
• Your SSL certificate renews automatically, or the expiry date is in your calendar.
• Your domain is set to auto-renew, and the expiry date is in your calendar.
• The site has a favicon, so it's recognisable in browser tabs and bookmarks.
• There are no broken links, placeholder text ("Your text here", sample paragraphs) or stock template pages left over.
• Copyright year and "last updated" dates are current.

2. Who you are

• Your business or trading name is on every page, usually in the footer.
• There's a real about page with the names or faces of the people behind the site, or an honest explanation if you prefer to stay private.
• Where local law requires it, your legal business name, registered address and registration or VAT number are published (for example, the imprint page required in Germany and Austria, or company details for UK limited companies).
• Social profiles you link to are active and match your branding.

3. How to reach you

• A contact page that's easy to find from every page.
• At least one direct contact method: an email address that a person reads, a phone number or a contact form. Ideally more than one.
• Expected response time stated ("We reply within one working day").
• If you have a physical location, the address and opening hours.
• Contact form tested this week: the message arrives and the sender gets a confirmation.

4. Clear pricing

• Prices are on the site, or you explain clearly how pricing works and how to get a quote.
• It's clear whether prices include tax and delivery.
• Recurring charges say how often they happen, and when the first charge is.
• Free trials state what happens when they end, and how to cancel before being charged.
• No surprise fees appear only at checkout.
• The currency is shown.

5. Refunds and cancellations

• A refund policy in plain language, linked from the footer and near the buy button.
• It says how to ask for a refund, how long it takes and any conditions.
• Subscriptions can be cancelled online, without a phone call or a maze of screens. Some places now require this by law.
• You've checked the consumer rules where your customers are. For example, in the EU and UK consumers usually have a 14-day cancellation right for online purchases, with specific rules for digital content.

Template: templates/refund-policy.md

6. Privacy and cookies

• A privacy policy that matches what your site actually does, linked from the footer and from every form that collects personal data.
• It lists the services that receive visitor data (hosting, email, analytics, payments, chat widgets, embedded video).
• Forms ask only for what you need.
• Cookie choices only when needed. If you only use cookies that are strictly necessary (for example, a login session or a shopping cart), many sites don't need a consent banner. If you use analytics, advertising or tracking cookies or similar storage, visitors in the EU and UK usually need to agree first, with a real "Reject" option that's as easy as "Accept". Check what your scripts actually set before deciding.
• If you use a consent banner, nothing non-essential loads until the visitor agrees.

Template: templates/privacy-policy.md

7. Terms

• Terms of service or terms of sale, linked from the footer and at checkout or sign-up.
• They cover what you provide, payment, cancellation, acceptable use and how disputes are handled.
• The date they were last updated is shown.

8. Security you can see

• A security.txt file at /.well-known/security.txt so researchers know how to report problems (see templates/security.txt).
• Login, sign-up and checkout pages use HTTPS and your payment provider's hosted checkout or payment fields.
• Your domain sends email with SPF, DKIM and DMARC in place (see email-authentication.md). This protects your customers from emails pretending to be you.
• Admin accounts for your site, domain and email use two-factor authentication.
• Your site's software, theme and plugins are up to date.

9. Accessibility

• The site can be used with only a keyboard, and the focus outline is visible.
• Text has enough contrast against its background.
• Images that carry meaning have alt text.
• Form fields have visible labels.
• Videos have captions.
• An accessibility statement that says what you support, what you know isn't perfect yet and how to ask for help.
• You've checked whether accessibility laws apply to you. For example, the European Accessibility Act applies to many businesses selling certain products and services to EU consumers since 28 June 2025, with exemptions for some very small businesses.

Template: templates/accessibility-statement.md

10. Uptime and status

• An uptime monitor checks your site every few minutes and alerts you.
• If people depend on your service, a status page or a known place where you post updates during outages.
• You know how to reach your host's support quickly.

11. Testimonials and reviews: honesty rules

Reviews persuade because people believe they're real. Keep it that way. Fake or misleading reviews are illegal in many places. In the US, the FTC's rule on consumer reviews and testimonials took effect in October 2024. In the UK, fake reviews are banned under consumer law that took effect in April 2025. Check the rules where you trade.

• Every testimonial is from a real customer who agreed to it being published.
• Quotes are their words. You can shorten them, but you don't change the meaning.
• You use real names or initials and a location or role only with permission.
• You haven't written reviews yourself, or had friends, family or staff post them as if they were customers.
• If a reviewer got something in return (a discount, a free product, payment), that's disclosed next to the review.
• You don't hide or delete negative reviews on your site just because they're negative.
• Ratings and counts ("4.8 from 230 reviews") are current and link to where people can see them.
• Results claims ("doubled my sales") are typical, or clearly marked as not typical.
• Logos of clients or press ("as seen in") are real and you have permission to use them.
• Stock photos aren't presented as customers.
• You keep a record of each testimonial's source and permission.

12. Tone and polish

• Spelling and grammar checked on every main page.
• No pressure tactics: fake countdown timers, false "only 2 left" messages or pre-ticked add-ons.
• Claims are specific and true. "Used by 40 studios" beats "trusted by thousands" if 40 is the real number.
• The site looks right on a phone.
• Pages load quickly on a mobile connection.

---

Summary

About page outline

An about page answers one question: "Are these real people I can trust?" Write it like you'd introduce yourself to a customer in person. Keep it short. Most good about pages are 250 to 600 words.

Replace everything in square brackets. Delete any section that doesn't fit.

---

Page title

About [Business name]

1. One-line summary

Say what you do and who for, in a single sentence.

[Business name] [makes / helps / repairs / designs] [what] for [who] in [place, if local].

Example: Northfield Bikes repairs and services bicycles for commuters in Leeds.

2. Why you started

Two or three sentences. Be specific. A real moment beats a mission statement.

[We / I] started [Business name] in [year] after [the specific problem or moment]. [What you noticed was missing.] [What you decided to do about it.]

3. Who's behind it

Names, roles and a real photo build more trust than anything else on this page. If you prefer not to show your face, show your workspace, your tools or your product, and still give a first name.

[Name], [role]. [One or two sentences about their background and what they look after.]

[Name], [role]. [One or two sentences.]

4. How you work

Three to five short points about what customers can expect. Choose things that are true and that a customer would care about.

• [We reply to every message within one working day.]
• [Every order is checked by hand before it ships.]
• [We tell you the price before we start, and we don't add surprise fees.]
• [We'll fix it free if [condition] within [time].]

5. Proof

Pick one or two. Only use what you can back up.

• [Number of customers, projects or years, if it's accurate]
• [A short, real testimonial with the customer's permission]
• [Memberships, certifications or awards, linked to where they can be verified]
• [Press mentions, linked to the article]

6. Where you are

We're based in [city, country]. [Opening hours or "We work online with customers in [regions]."]

If required where you are, add your legal business name, registered address and company or VAT number here or on a separate legal notice page.

7. Next step

End with one clear action.

[See our work] · [Book a call] · [Get in touch]

---

Writing tips

• Use "we" or "I", whichever is true. A one-person business that says "we" and "our team" can feel evasive.
• Swap general words for specific ones. "Fast" becomes "within 48 hours". "Experienced" becomes "since 2014".
• Read it aloud. If a sentence sounds like an advert, rewrite it.
• Update it when people join or leave.

Accessibility statement template

An accessibility statement tells visitors what to expect and how to get help. The best ones are honest about what isn't perfect yet. Only claim what you've checked.

Not legal advice. Some organisations must publish a statement in a set format. For example, public sector bodies in the EU and UK have specific requirements, and the European Accessibility Act sets rules for many businesses selling certain products and services to EU consumers. If these apply to you, follow the official model statement for your country.

Replace everything in square brackets.

---

Accessibility

Last reviewed: [date]

We want everyone to be able to use [example.com], including people who use screen readers, keyboard navigation, voice control, magnification or other assistive technology.

Our goal

We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA.

What we've done

• [The site can be used with a keyboard, and you can always see where you are on the page.]
• [Text and buttons have enough colour contrast.]
• [Images have text descriptions where they carry meaning.]
• [Form fields have clear labels, and error messages explain how to fix them.]
• [The site works when zoomed to 200% and on small screens.]
• [Videos have captions.]
• [Animations are reduced if your device is set to reduce motion.]

How we check

[We tested the site in [month, year] using [automated checks / manual keyboard testing / screen readers such as NVDA, JAWS or VoiceOver]. [An independent auditor reviewed it in [month, year].] We check new pages before they go live.]

What we know isn't perfect yet

We're working on these:

• [Some older PDF documents aren't fully accessible. Ask us and we'll send the content in another format.]
• [Our embedded [map / booking widget] from [provider] has keyboard issues. You can book by email or phone instead.]
• [Some videos from before [year] don't have captions yet. We aim to add them by [date].]

Need help or found a problem?

If you can't use part of our site, or need information in a different format such as large print, plain text or audio, contact us:

• Email: [[email protected]]
• Phone: [number]
• [Other method, for example a text relay service]

Tell us the page address and what went wrong. We'll reply within [5 working days] and, where we can, give you the information another way while we fix it.

Compatibility

The site is designed to work with recent versions of major browsers and assistive technologies. [List any you've specifically tested.]

---

Before you publish

• Every claim in "What we've done" is true today.
• Known issues are listed, not hidden.
• The contact method is monitored.
• The statement is linked from the footer of every page.
• You've set a date to review it again, at least once a year.

Contact page template

A good contact page makes it obvious how to reach a person, how quickly you'll reply and where to go for quick answers. Replace everything in square brackets and delete what you don't offer.

---

Contact us

We're [a small team / one person] and we read every message. We usually reply within [one working day], [Monday to Friday, 9am to 5pm, time zone].

Email

[[email protected]]

For orders, include your order number so we can find it quickly.

Phone

[+00 0000 000000]

[Days and hours, with time zone.] Outside these hours, leave a message or email us.

Send a message

[Contact form: name, email, message. Add a subject dropdown only if it helps you route messages. Don't ask for a phone number unless you'll use it.]

We'll only use your details to reply to you. See our privacy policy.

Visit us

[Business name] [Street] [City, postcode] [Country]

[Opening hours] [Parking, step-free access or public transport notes]

Quick answers

• How long does delivery take?
• How do I return something?
• How do I cancel my subscription?
• Where is my order?

Other ways to reach us

• Reporting a security issue: [[email protected]] (see our security.txt)
• Privacy questions: [[email protected]]
• Accessibility help: [[email protected]], or ask for this information in another format
• Press: [[email protected]]

---

Checklist

• The email address is one a person checks every working day.
• The form sends a copy to the visitor, or shows a clear confirmation message.
• Form submissions are tested after every site update.
• Spam protection doesn't block real people (avoid puzzles that are hard for screen reader users).
• The stated reply time is one you can keep on your busiest week.
• Holiday closures are posted here when they happen.

Privacy policy starting point

Not legal advice. This template helps you describe your data practices clearly. It is not a complete privacy policy for every situation, and it doesn't make you compliant with any law on its own. Privacy rules depend on where you are, where your visitors are and what data you handle (for example, the GDPR in the EU, the UK GDPR, and state laws such as California's). If you handle health, financial or children's data, or sell or share data for advertising, get professional advice.

Before you write

Fill in this table first. Your policy should describe exactly what's in it, no more and no less.

Check what your site actually loads. Chat widgets, embedded videos, maps, fonts, social buttons and advertising pixels often collect data too.

---

Privacy policy

Last updated: [date]

This policy explains what personal information [Business name] ("we", "us") collects when you use [example.com], why we collect it and what choices you have.

Who we are

[Business legal name], [address]. You can contact us about privacy at [[email protected]].

[If you have a data protection officer or an EU or UK representative, give their details here.]

What we collect

Information you give us

• When you contact us: your name, email address and message.
• When you buy something: your name, email, billing and delivery address. Card details are handled by [payment provider] and we never see your full card number.
• When you create an account: [your email, a password (stored securely, never in plain text), and any profile details you choose to add].
• When you sign up for our newsletter: your email address.

Information collected automatically

• [Basic usage data such as pages visited, approximate location from your IP address, device and browser type, collected by [analytics provider].]
• [Server logs kept by our host for security and troubleshooting.]

Information from others

• [For example, if you sign in with another service, we receive your name and email from it.]

Why we use it

We use your information to:

• reply to your messages,
• process and deliver your orders,
• run your account,
• send newsletters you've signed up for,
• understand how the site is used so we can improve it,
• keep the site secure and prevent fraud,
• meet our legal obligations, such as keeping tax records.

[For visitors in the EU and UK, list the legal basis for each purpose: for example, contract for orders, consent for newsletters and non-essential cookies, legitimate interests for security and basic analytics, legal obligation for tax records.]

We don't sell your personal information. [If you share data for targeted advertising, say so plainly here and explain how to opt out.]

Who we share it with

We use trusted services to run our business. They only use your information to provide their service to us.

[If data goes outside your visitors' country or region, explain the safeguards used, for example standard contractual clauses.]

We may also share information if the law requires it, or to protect our rights or someone's safety.

Cookies

[Choose one:]

• [We only use cookies that are needed for the site to work, such as keeping you signed in or remembering your basket. These don't need your consent.]
• [We use necessary cookies, and with your permission, [analytics / advertising] cookies. You can change your choice at any time using the "Cookie settings" link in the footer.]

How long we keep it

We keep personal information only as long as we need it for the reasons above. [Order records: [6 years] for tax. Contact messages: [2 years]. Newsletter: until you unsubscribe. Server logs: [30 days].]

How we protect it

We use HTTPS across the site, limit who can access personal information and use services with strong security practices. No system is completely secure, but we work to protect your data and will tell you if a breach affects you where the law requires it.

Your choices and rights

You can:

• ask for a copy of the information we hold about you,
• ask us to correct or delete it,
• unsubscribe from emails using the link in every email,
• withdraw consent you've given, such as for cookies or newsletters,
• [object to or restrict certain uses, and ask to move your data to another service].

Email [[email protected]] and we'll reply within [30 days]. [If you're in the EU or UK, you can also complain to your local data protection authority. In the UK, that's the Information Commissioner's Office.]

Children

Our site isn't meant for children under [13 / 16], and we don't knowingly collect their information. If you think a child has given us personal information, contact us and we'll delete it.

Changes to this policy

If we make important changes, we'll update the date at the top [and let account holders know by email].

Contact

[Business legal name] [Address] [[email protected]]

Refund and cancellation policy template

Not legal advice. This is a plain-language starting point. Consumer law varies by country and sometimes by state or province, and some rights can't be removed by your policy. For example, in the EU and UK consumers usually have a 14-day right to cancel most online purchases, with specific rules for digital content and services. Check the rules where your customers are, and have a qualified professional review your final policy.

Replace everything in square brackets. Delete the sections that don't apply to what you sell.

---

Refund policy

Last updated: [date]

We want you to be happy with what you buy from [Business name]. If something isn't right, here's how we'll put it right.

The short version

• [You can return physical items within [30] days for a full refund.]
• [You can cancel your subscription at any time from your account. You'll keep access until the end of the period you've paid for.]
• [If a digital product doesn't work as described, tell us within [14] days and we'll fix it or refund you.]
• To ask for a refund, email [[email protected]] with your order number.

Physical products

Returns. You can return most items within [30] days of delivery. Items should be [unused and in their original packaging].

Items we can't take back. [Personalised items, perishable goods, sealed hygiene items once opened, gift cards.] This doesn't affect your rights if an item is faulty.

Faulty or wrong items. If something arrives damaged, faulty or isn't what you ordered, contact us within [14] days with a photo. We'll [replace it, repair it or refund you], and we'll cover the return postage.

Return postage. For change-of-mind returns, [you pay / we pay] return postage. We recommend a tracked service.

How to return.

1. Email [[email protected]] with your order number and the items you're returning.
2. We'll reply within [one working day] with the return address [and a label].
3. Once we receive the item, we'll refund you within [5 working days] to your original payment method.

Digital products

[Downloads, templates, software licences, courses.]

Before you buy. We describe each product in detail and [offer a preview / free version / demo] so you know what you're getting.

After you buy. [Choose one and make it true:]

• [Because digital products can be downloaded straight away, we don't offer refunds for change of mind once you've downloaded the files. If you're in the EU or UK, we'll ask you to confirm this at checkout.]
• [If you're not happy, email us within [14] days and we'll refund you, no questions asked.]

If it doesn't work. If a product is faulty or not as described, tell us within [14] days. We'll help you get it working, replace it or refund you.

Subscriptions

Cancelling. Cancel at any time from [Account > Billing], or by emailing us. You don't need to call us or give a reason.

What happens next. Your subscription won't renew. You'll keep access until [the end of your current billing period].

Refunds on subscriptions. [Choose one:]

• [We don't refund partial billing periods, except where the law requires it.]
• [If you cancel within [14] days of your first payment, we'll refund that payment in full.]
• [If you forgot to cancel before an annual renewal, email us within [7] days of the renewal and we'll refund it.]

Free trials. We'll remind you [3] days before your trial ends. If you don't cancel before then, you'll be charged [price] on [day the trial ends].

Services

[Consulting, design, repairs, bookings.]

Cancelling a booking. Cancel at least [48 hours] before your appointment for a full refund. Later cancellations [are charged [50%] / can be rescheduled once for free].

Work in progress. If you cancel a project after we've started, we'll charge for the work completed so far and refund the rest.

If we get it wrong. If our work doesn't match what we agreed, tell us within [14] days and we'll put it right or refund the affected part.

How long refunds take

We process refunds within [5 working days] of approving them. Your bank or card provider may take a few more days to show the money in your account.

Questions

Email [[email protected]] or see our contact page.

[Business legal name], [address]