Placeholder. This is a template, not a reviewed policy. Everything in [SQUARE BRACKETS] still has to be filled in, and the whole document needs a look from someone qualified before the site takes real signups.

Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how [COMPANY / SITE NAME] ("we", "us", "our") collects, uses, and shares personal information when you use [WEBSITE URL] (the "Site").

If you have questions, contact us at [CONTACT EMAIL].

1. Who we are

[COMPANY LEGAL NAME]

[POSTAL ADDRESS]

[CONTACT EMAIL]

For users in the European Economic Area (EEA) and the United Kingdom, we are the "data controller" of your personal information.

2. Information we collect

Information you give us:

  • Account information — the email address and password you provide when you register. Passwords are stored in hashed form; we cannot read them.
  • Profile information — any optional details you choose to add to your account.
  • Newsletter subscription — your email address and subscription preferences, if you sign up for our mailing list.
  • Correspondence — the contents of any messages you send us.

Information collected automatically:

  • Server logs — IP address, browser type and version, referring page, pages viewed, and timestamps. These are generated by our hosting infrastructure as a normal part of serving the Site.
  • Cookies — we use strictly necessary cookies to keep you signed in and to maintain your session. We do not use advertising or analytics cookies.

We do not collect payment information, and we do not use third-party analytics or advertising trackers.

3. How we use your information

We use personal information to:

  • Create and maintain your account and authenticate you when you sign in;
  • Provide, operate, and improve the Site;
  • Send you service-related messages, such as password resets and important account notices;
  • Send you our newsletter, where you have asked to receive it;
  • Respond to your enquiries;
  • Detect, prevent, and investigate fraud, abuse, and security incidents;
  • Comply with legal obligations.

4. Legal bases (EEA / UK users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

PurposeLegal basis
Creating and running your accountPerformance of a contract
Service and security emailsPerformance of a contract; legitimate interests
NewsletterConsent (withdrawable at any time)
Security, abuse prevention, Site improvementLegitimate interests
Responding to legal requestsLegal obligation

5. How we share information

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

We share personal information only with:

  • Our email/newsletter provider — [PROVIDER NAME] — to deliver newsletters and account emails on our behalf;
  • Our hosting provider — [HOSTING PROVIDER] — which stores the Site and its data;
  • Professional advisers, authorities, or acquirers — where required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets.

These providers act as processors on our instructions and are not permitted to use your data for their own purposes.

6. International data transfers

The Site is available globally, and your information may be stored or processed in [COUNTRY / REGION WHERE YOUR SERVERS AND VENDORS OPERATE], which may not offer the same level of data protection as your home country.

Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable). You may request a copy of the safeguards we use by contacting us.

7. Data retention

  • Account data — kept for as long as your account is active, and for [X DAYS/MONTHS] after you delete it, to allow for recovery and to meet legal obligations.
  • Newsletter data — kept until you unsubscribe, plus a suppression record so we do not email you again.
  • Server logs — kept for approximately [X DAYS].
  • Correspondence — kept for [X MONTHS/YEARS].

8. Your rights

If you are in the EEA or UK, you have the right to access your personal information; to correct inaccurate data; to request erasure; to restrict or object to processing; to data portability; and to withdraw consent at any time (which does not affect processing already carried out). You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to request deletion; to request correction; and to be free from discrimination for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

Everyone can access and update account details from within their account settings, and can unsubscribe from our newsletter using the link in any newsletter email.

To exercise any of these rights, email [CONTACT EMAIL]. We will respond within the time frame required by applicable law. We may need to verify your identity before acting on a request.

9. Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS) and hashed password storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password for your account.

10. Children

The Site is not directed to children, and we do not knowingly collect personal information from anyone under [13 / 16 — see note below]. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the "Last updated" date. If the changes are material, we will notify you by email or through a notice on the Site.

12. Contact

Questions, concerns, or requests: [CONTACT EMAIL]
[COMPANY LEGAL NAME], [POSTAL ADDRESS]