Privacy policy

This is a draft template and not legal advice. It must be reviewed and completed by you, ideally with a qualified lawyer, before you publish it. Replace every [PLACEHOLDER: ...] marker and delete this line.

Privacy policy

Version 1 draft. Effective from [PLACEHOLDER: effective date].

1. Who is responsible

The controller for the personal data described here is [PLACEHOLDER: legal name], [PLACEHOLDER: postal address], [PLACEHOLDER: contact email]. [PLACEHOLDER: data protection officer and contact, or a statement that none is required.]

2. What we process, and why

[PLACEHOLDER: keep only what is true for your Service and add what is missing. For each item give the purpose and the legal basis, for example Art. 6(1)(b) GDPR for a contract, 6(1)(a) for consent, 6(1)(f) for a legitimate interest.]

• Account data, such as name, email address and organisation, to create and run your account.
• Sign-in and security data, such as sign-in events and session information, to keep your account safe.
• Content you submit, including anything you enter into forms on our website, to provide the Service you asked for. [PLACEHOLDER: for example, waitlist emails are used only to tell you when the Service opens.]
• Billing data, to charge you and meet tax and accounting duties. [PLACEHOLDER: payment provider.]
• Server logs, such as IP address, time and requested page, to run the website and detect abuse.
• Correspondence, what you send us and our replies.

3. Cookies and similar technologies

[PLACEHOLDER: describe exactly what your website and app store in the browser. If you set only what is strictly necessary and use no analytics or advertising, say so plainly. If you add analytics or marketing tools later, this section and your cookie notice must change first.]

4. Who else receives your data

[PLACEHOLDER: list your service providers (hosting, email, payment, support, AI model providers) with what they do and where they operate.] We do not sell personal data.

5. Transfers outside your region

[PLACEHOLDER: say whether data leaves the EU or EEA and, if it does, the safeguard used, such as standard contractual clauses.]

6. How long we keep data

[PLACEHOLDER: retention period for each kind of data in section 2, and what happens when an account is closed.]

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time. You may also complain to your data protection authority. To use a right, write to [PLACEHOLDER: contact email]. [PLACEHOLDER: name and address of the competent supervisory authority.]

8. How we protect data

[PLACEHOLDER: a short, honest summary of your technical and organisational measures. Do not claim anything you have not done.]

9. Automated tools and AI

[PLACEHOLDER: if the Service uses AI models on personal data, say which data, which provider, and whether it is used for training. Otherwise state that no automated decision-making takes place.]

10. Changes

We may update this policy and will publish the new version here with its date. [PLACEHOLDER: how you notify people of material changes.]