Policy templates
Plain-language starting points written for current privacy and consumer law. Fill in the [BRACKETED] details when you create a policy, then edit anything that doesn't match what your product does. They are not legal advice.
Privacy
Privacy Policy
GDPR, UK GDPR and CCPA/CPRA ready privacy notice (GDPR Art. 13/14). Edit the lists of data, purposes and providers so they match what your product really does.
Cookie Policy
Lists the cookies and tags you use and how people choose (ePrivacy Directive Art. 5(3), GDPR consent rules, UK PECR). Fill the table with your real cookies.
California Privacy Notice (CCPA/CPRA)
Notice at collection, the rights of California residents, "Do Not Sell or Share" and Global Privacy Control, as the CCPA regulations in force since 2026 expect.
Your Privacy Rights (request page)
A page that tells people how to access, correct, delete or export their data, and how you handle the request (GDPR Art. 12-22, UK GDPR, CCPA). Link it from the privacy policy and the account settings.
Data Retention Policy
How long each kind of data is kept and how it is deleted (GDPR Art. 5(1)(e) storage limitation, CCPA retention disclosure).
Terms and rules
Terms of Service
Terms and conditions for a website, web app or mobile app: accounts, acceptable use, content ownership, payments, liability, governing law.
Acceptable Use Policy
What users may not do with the service (abuse, spam, illegal content, security testing), how reports are handled and what happens on a breach. Fits with the EU Digital Services Act notice-and-action duty.
Accessibility Statement
Your accessibility commitment, known issues and a feedback contact. Expected by the European Accessibility Act (in force since June 2025) for many consumer services, and good practice under the ADA.
Disclaimer
General information, no professional advice, external links and affiliate disclosures, for content sites and blogs.
Payments
For B2B products
Data Processing Agreement
Controller-to-processor terms required by GDPR Art. 28 (and UK GDPR), for B2B products that handle customers' personal data. Attach the list of sub-processors.
Sub-processors List
The public list of service providers that process personal data for you (GDPR Art. 28(2) and 28(4)); the DPA points to it. Replace the rows with your real providers.