[PROJECT_NAME] Privacy Policy
Effective date: [DATE]
This policy explains how [COMPANY_NAME] ("we", "us") collects, uses, shares and protects personal data when you use [PROJECT_NAME], our [PROJECT_TYPE] at [WEBSITE_URL] (the "Service"). It also explains your rights and how to use them.
1. Who is responsible for your data
[COMPANY_NAME], [COMPANY_ADDRESS], is the controller of the personal data described here.
- Privacy questions and requests: [PRIVACY_EMAIL]
- Data protection officer: [DPO_CONTACT]
- Representative in the EU / UK (GDPR Art. 27): [EU_REPRESENTATIVE]
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | name, email address, sign-in details | you |
| Content | what you create or upload in the Service | you |
| Payment data | billing name, country, last four digits of the card | you, through our payment provider (we never see full card numbers) |
| Usage data | pages viewed, features used, time and date, approximate location from the IP address | your device |
| Device data | browser, operating system, language, screen size | your device |
| Support data | messages you send us | you |
We do not knowingly collect sensitive data (health, religion, biometrics and similar). Please don't send it to us.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account and provide the Service | contract (Art. 6(1)(b)) |
| Take payments, keep invoices and tax records | contract; legal obligation (Art. 6(1)(c)) |
| Keep the Service secure, prevent fraud and abuse | legitimate interests (Art. 6(1)(f)) |
| Understand how the Service is used and improve it | legitimate interests, or consent where the law requires it |
| Send service emails (sign-in codes, receipts, important changes) | contract |
| Send news and offers | consent (Art. 6(1)(a)), which you can withdraw at any time |
| Answer your questions | legitimate interests; contract |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details and you can object (section 8).
4. Cookies and similar technologies
We use cookies that are strictly necessary to sign you in and keep the Service secure. We use other cookies or tags (analytics, advertising) only as described in our Cookie Policy and, where the law requires it, only after you agree. You can change your choice at any time.
5. Who we share it with
We do not sell your personal data and we do not share it for cross-context behavioural advertising.
We share personal data only with:
- Service providers (processors) who work for us under a written contract: hosting ([HOSTING_PROVIDER]), email delivery, payment processing, customer support and analytics tools. They may use the data only to provide their service to us.
- Authorities, when the law requires it or to protect rights, safety and property.
- A buyer or successor, if the business or its assets are sold or merged. We will tell you first.
6. International transfers
We and our providers may process data outside your country, including in the United States. When personal data leaves the EEA, the UK or Switzerland, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or on Standard Contractual Clauses with additional safeguards. Ask us for a copy of the safeguards at [PRIVACY_EMAIL].
7. How long we keep it
We keep account data while your account is open and for [RETENTION_PERIOD] after you close it, so you can come back or ask for a copy. Invoices and tax records are kept as long as tax law requires. Security logs are kept for a short time, normally no more than 12 months. After that we delete or anonymise the data.
8. Your rights
Depending on where you live, you can:
- access your data and get a copy (GDPR Art. 15; CCPA "right to know");
- correct it (Art. 16);
- delete it (Art. 17);
- restrict how we use it (Art. 18);
- get it in a portable format (portability, Art. 20);
- object to processing based on legitimate interests and to direct marketing at any time (Art. 21);
- withdraw consent at any time, without affecting earlier processing;
- not be subject to decisions based solely on automated processing that significantly affect you (Art. 22). We do not make such decisions;
- opt out of the sale or sharing of personal data (California). We do not sell or share it;
- limit the use of sensitive personal information (California). We do not use it for anything that would give you this right;
- not be discriminated against for using these rights.
To use a right, email [PRIVACY_EMAIL] or use the settings in your account. We answer within one month (GDPR) or 45 days (California), and may ask you to confirm your identity first. You can use an authorised agent. We honour Global Privacy Control (GPC) browser signals as an opt-out of sale and sharing.
You can complain to your data protection authority, for example the authority in the EU country where you live or work, or the UK Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to fix the problem first.
9. Security
We protect personal data with encryption in transit, access controls, the principle of least privilege and regular updates. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the authorities as the law requires (GDPR Art. 33 and 34: authorities within 72 hours).
10. Children
The Service is not directed to children under 16 and we do not knowingly collect their data. If you think a child has given us personal data, contact [PRIVACY_EMAIL] and we will delete it.
11. California notice at collection
In the last 12 months we collected the categories in section 2: identifiers, commercial information, internet or other electronic network activity, approximate geolocation and the content of communications with us. We use them for the purposes in section 3 and keep them as described in section 7. We have not sold or shared personal information and we have no actual knowledge of selling or sharing the personal information of consumers under 16.
12. Changes to this policy
We will post any change here with a new effective date. If the change is significant, we will tell you by email or in the Service before it takes effect, and ask for your consent again where the law requires it.
13. Contact
[COMPANY_NAME], [COMPANY_ADDRESS]. Email: [PRIVACY_EMAIL]. General support: [SUPPORT_EMAIL].