Answer a few questions and get a ready-to-use privacy policy and terms of service — required by Google, Apple and the law. Copy or download, no sign-up.
Templates for general guidance, not legal advice. Review before publishing.
The moment your site collects any personal data you have a legal duty to tell people what you do with it. That threshold is much lower than most site owners assume — a contact form, an email signup, a comments box or analytics that records IP addresses all count.
A purely static brochure site with no forms, no analytics and no cookies genuinely does not need one. Almost no site is actually that.
Link it from every page, conventionally in the footer, and link it directly at the point of collection — beside the submit button on a form, and inside the cookie banner. Requiring someone to hunt for it undermines the whole purpose.
If your site sets analytics or advertising cookies, the policy is only half the job. Those need consent before they are set, which is a cookie banner obligation under PECR rather than something a policy can fix.
A privacy policy is the one document on your site that becomes actively harmful when it goes stale. Every time you add a tool that touches visitor data — a new form provider, a heatmap, an ads pixel — the policy needs updating. Put a review date on it and actually keep it.
A generated policy covers the standard requirements well. If you process health data, data about children, or transfer personal data outside the UK at any scale, have it reviewed by someone qualified.
If it collects any personal data — a contact form, email signups, analytics recording IP addresses — then UK GDPR requires you to tell visitors what you do with it.
It is a bad idea. You inherit statements about data handling that do not describe your business, which means you are publishing inaccurate claims about how you process people's data.
In the site footer on every page, and directly beside any form that collects data, plus inside your cookie banner.
No. Non-essential cookies need consent before they are set, under PECR. That requires a banner, not just a policy.