Skip to main content
Free tool

Privacy policy generator

Say what your site does and where you are, and get a privacy policy that matches it: what you collect, who you share it with, cookies, and the California, children's and EU rules only when they apply to you. Written for US small businesses first, with a GDPR section, your regulator named, when you serve UK or EU visitors. Free, no sign-up.

About your site

What does the site do?

Which laws apply?

An example privacy policy

A bakery in Oregon with an online shop, a newsletter, analytics cookies and card payments, below every CCPA threshold and not serving the EU, so you can see the shape. Change the answers to make it yours.

Privacy Policy Effective date: November 8, 2026 Maple & Grain Bakery ("we", "us", "our") operates https://maplegrainbakery.com. We respect your privacy. This policy explains what personal information we collect when you use this website, how we use it, who we share it with, and the choices you have. Information we collect We collect only what we need to run this website and serve you: - Contact details you submit through our forms - your name, email, phone number and message. - Your email address if you sign up for our newsletter or updates. - Order and delivery details - the items you buy, your shipping and billing address and contact details. - Payment confirmation. Card payments are processed by our payment provider (Stripe or PayPal); we never see or store your full card number. - Usage information collected by cookies and similar technologies - pages visited, approximate location from your IP address, device and browser - and your cookie preferences. How we use your information We use the information above to: - Provide and operate this website and respond to your enquiries. - Process, fulfil and support your orders and any returns. - Send you newsletters or updates - only if you have opted in, and you can unsubscribe at any time. - Understand how the site is used so we can improve it, keep it secure, and meet our legal obligations. Who we share it with We do not sell your personal information. We share it only with the service providers we rely on to run this site: - Hosting and website infrastructure providers. - Our payment processor (Stripe or PayPal), to take card payments and, where applicable, issue refunds. - Delivery carriers, who receive the name and address needed to deliver your order. - Our email provider, to send transactional messages and any newsletters you asked for. - Analytics providers, who receive usage information where you have allowed analytics cookies. - Professional advisers, and authorities where the law requires it. Cookies and tracking This site uses cookies and similar technologies. Essential cookies make the site work. Analytics cookies tell us how the site is used. You can block or delete cookies in your browser settings; blocking some of them may stop parts of this site working. The analytics providers named above may collect information about your activity over time and across different websites when you use this site. Do Not Track: some browsers send a "Do Not Track" signal. There is no accepted standard for responding to it, so this site does not change its behaviour when it receives one. Marketing emails We send marketing emails only to people who have asked for them. Every one identifies us as the sender, includes our postal address and carries an unsubscribe link. If you unsubscribe, we stop within ten business days, and we never charge or ask for more than an email address to do it. Transactional messages - order confirmations, booking reminders, replies to your enquiry - are not marketing and are sent regardless. Reviewing, changing and deleting your information You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, at any time by emailing [protected]. We will confirm your identity before acting on a request, and we reply within 30 days. We will not discriminate against you for exercising any of these rights. Children's privacy This site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it. How long we keep your information We keep your information only for as long as we need it for the purposes above or to meet legal, tax and accounting requirements, and then delete or anonymise it. Security This site is served over HTTPS and access to personal information is limited to the people who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Changes to this policy We may update this policy from time to time. The effective date at the top shows the current version, and if a change is significant we will say so on this site before it takes effect. Contact us If you have any question about this policy or want to exercise your privacy rights, email us at [protected].
4,385 characters.

Before you publish it

  • CAN-SPAM requires a valid postal address in every marketing email. The policy promises one, so put it in your email template, not just here.
  • No CCPA section was written because you said none of its thresholds is met: over $25 million in annual gross revenue (as adjusted by the CPPA), personal information of 100,000 or more California consumers or households, or half of revenue from selling or sharing it. Tick the box if that changes.
  • CalOPPA requires the link to this policy to be conspicuous - the word "Privacy" in your footer, on every page, is enough.
  • The policy says cookies can be controlled in the browser, which is true everywhere. If you add a consent banner later, tick the cookie banner box and the policy will say so.
This is a starting point, not legal advice. It follows what the main US rules ask a small-business site to say, and it is written so that somebody qualified can read it in five minutes. If your business handles health, financial or children's data, or a lot of money turns on a clause, have it reviewed before you publish it.
The other two pages a site needs. The terms of service generator uses the same answers, and the refund policy generator writes the returns page a shop links from checkout. A published Webkio site writes its privacy policy and terms from its own settings, so these pages are never a copy from another business.

How this is worked out

The policy is assembled from your answers, one section per rule, and nothing is written for a law you did not say applies. Every policy carries what California's Online Privacy Protection Act asks of any commercial site collecting personal information from Californians: an effective date, the categories of information collected and the categories of third parties they go to (both read from the features you ticked), how to review, correct and delete your information, how changes are announced, and how the site responds to a Do Not Track signal. The CCPA rights section is written only when you say one of its thresholds is met - annual gross revenue over $25 million as adjusted by the California Privacy Protection Agency, personal information of 100,000 or more consumers or households, or half of revenue from selling or sharing - and the "Do Not Sell or Share My Personal Information" link and Global Privacy Control sentence appear only when you say you sell or share. The children's clause defaults to "not directed to children under 13" and switches to a COPPA notice with a warning when the site is. The newsletter clause follows CAN-SPAM: sender identified, postal address in every message, opt-out honoured within ten business days. The EU and UK section, with lawful bases per purpose, the rights and transfers, is written only when you serve those visitors, and it never claims a data protection officer.

Standards and documentation it follows

Guides that use this

Quoting this tool

Free to quote and link. Cite it as Privacy policy generator, a free tool by Webkio, https://webkio.com/privacy-policy-generator. The method above is the whole method, so a figure you quote can be checked by anyone with the same inputs.

Questions

No, and it cannot be. It is a clearly written starting point that follows what the main US rules ask for, so that somebody qualified can read it in five minutes rather than write it in five hours. If your business handles health, financial or children's data, or sells into states and countries with their own privacy laws, have it reviewed.

In practice, yes. California's Online Privacy Protection Act applies to any commercial website that collects personal information from California residents, and a contact form collects a name and an email address. The law does not care where the business is; it cares where the visitor is.

Because you said none of its thresholds applies. The California Consumer Privacy Act covers a business with annual gross revenue over $25 million (the figure the statute names, adjusted by the CPPA for inflation), or that buys, sells or shares the personal information of 100,000 or more California consumers or households a year, or that earns half or more of its revenue from selling or sharing it. Most small businesses meet none of them, and claiming rights you do not owe is as wrong as omitting ones you do. Tick the box and the section appears.

Under California law, "sharing" includes passing personal information to an advertising platform for cross-context behavioural advertising, which is what a Meta pixel or Google Ads remarketing tag does. If you run those, you are sharing in the legal sense even though no money changes hands. The policy only names a "Do Not Sell or Share" link when you say you do, because the link has to exist and work.

Only if you offer goods or services to people in the EU or the UK, or monitor their behaviour. A US business that ships only to US addresses and does not target EU visitors generally does not. Leaving it off a policy that does not need it is better than publishing lawful bases you have never thought about.

Yes. When a Webkio site is published it writes a privacy policy and terms from its own settings - the business name, the contact address, and only the sections for the features actually turned on - and keeps the footer links to them. This tool is the same wording, for sites built anywhere.

More free tools

Google review link generator
Business name generator
Website cost calculator
Favicon generator
Terms of service generator
Refund policy generator

See all free tools