Privacy Policy

Policy Capture

Company Policy Questionnaire

Business Information

This step establishes the legal identity of the business, which forms the foundation of any privacy policy, terms of service, or other legal agreement.

Why it’s important:
Legal policies must reflect the correct business name, jurisdiction, and entity type to be enforceable. The business location also determines which privacy laws apply (e.g., GDPR for EU-based businesses, CCPA/CPRA for California). Accurate contact details ensure that consumers and regulators can reach the company if needed.

Website Details

Captures how the business operates online and who its audience is.

Why it’s important:
Understanding the website’s scope, services, and geographic reach helps tailor the policy to relevant laws and disclosures. For example, targeting users in the EU would require GDPR compliance. Selling online introduces eCommerce-related responsibilities around data collection, terms of sale, and consumer rights.

Data Collection

Outlines what personal information is gathered and how it is collected from users.

Why it’s important:
Every privacy policy must explain to users what data is being collected and through which means (forms, cookies, etc.). Transparency here builds trust and ensures legal compliance. It also affects whether you need a cookie consent banner and what types of notices or consents must be provided to users.

Data Usage & Sharing

Clarifies the internal and external use of collected data.

Why it’s important:
Policies must state not only what data is collected, but also why it’s collected and who it’s shared with. This is critical for compliance with laws like GDPR (which requires lawful bases for processing) and CCPA (which mandates disclosure of third-party data sharing). International data transfers also have regulatory implications.

Additional Compliance

Flags any specialized requirements based on the business model or audience.

Why it’s important:
Certain features—like account creation, software downloads, or child audiences—trigger additional legal requirements. For instance, collecting data from children under 13 invokes COPPA in the U.S., while having users in California or Europe invokes state/national regulations. This step ensures all compliance considerations are addressed.

Policy Preferences

Defines optional inclusions to reflect the business’s legal risk tolerance and product types.

Why it’s important:
Disclaimers, EULAs, and cookie banners aren’t required for all sites but can offer critical protections. A disclaimer can limit liability, while a EULA governs software usage. A cookie consent banner may be legally required depending on your tracking practices and user base. Tailoring these choices makes your policy more comprehensive and aligned with your actual risk profile.