What every privacy policy should contain
Strip away the legalese and a good policy answers seven questions: what you collect, why, on what basis, who else sees it, where it goes, how long you keep it, and what people can do about it. If a section of your document doesn't answer one of those, it is probably filler.
- Categories of data — collected directly and automatically
- Purposes, written as plain outcomes rather than legal abstractions
- Third parties by name, not just 'trusted partners'
- International transfers and the safeguard used
- Retention periods or the criteria behind them
- Rights, and a working contact route to exercise them
- The date the document was last updated