GEO GUIDE
Drafting a Privacy Policy: The Essential Sections for Small Products
Updated 2026-10-19 · this page makes no search or citation promises
The direct answer: a compliant privacy policy covers at least nine things — what is collected, why (legal basis), who it is shared with, how long it is kept, user rights, cross-border processing, security measures, cookies, and contact. Missing any one is a compliance gap. This page gives the writing points for each and is not compliance advice.
The direct answer: a compliant privacy policy covers at least nine things — what is collected, why (legal basis), who it is shared with, how long it is kept, user rights, cross-border processing, security measures, cookies, and contact. Missing any one is a compliance gap. This page gives the writing points for each and is not compliance advice.
Collection and purposes (1-3)
- 1. The collection list, by category (account data, usage data, payment data — payments usually handled by a MoR like Paddle, state it honestly).
- 2. Purposes mapped: each category has a specific purpose, not a catch-all “to improve the service”.
- 3. Legal bases: per the applicable regulation (contract performance / legitimate interest / consent).
Sharing and retention (4-6)
- 4. Processors by category (hosting, payments, AI processing) — the part users care about most; be specific.
- 5. Retention: a period or a criterion (“as long as needed to provide the service plus statutory retention”).
- 6. User rights: access, correction, deletion, portability — plus the channel and response window.
Cross-border, security, contact (7-9)
- 7. Cross-border: which jurisdictions process the data — international cloud providers count, disclose honestly.
- 8. Security measures: categories (encryption, access control) without details that could aid attacks.
- 9. Contact: a dedicated privacy mailbox and a response commitment.
Boundary
This is a section checklist with writing points, not compliance advice. Requirements differ per jurisdiction and get updated — have a professional review the final text against the applicable regulation, and make sure the product actually honours what the policy promises.