Privacy Policy
Effective date: [EFFECTIVE DATE]
Draft template — pending review by legal counsel. Bracketed placeholders must be completed before this is relied upon.
This Privacy Policy explains how [COMPANY LEGAL NAME] (“we”, “us”) collects, uses, and shares personal information in connection with the [COMPANY LEGAL NAME] platform (the “Service”). It is incorporated into our Terms of Service. Where we process personal data on behalf of a customer organization (as a processor), that organization’s own privacy notice governs its use of the data.
1. Information we collect
Account & profile data you provide (name, email, organization, role). Customer Content you upload or create (records and documents), including any personal data it contains. Usage & device data generated automatically (log data, IP address, browser type, actions taken, timestamps). Cookies and similar technologies as described in Section 9.
2. How we use information
To provide, secure, and improve the Service; authenticate users; process and render documents you ask us to; communicate with you about the Service; comply with legal obligations; and detect, prevent, and respond to fraud, abuse, or security incidents.
3. Legal bases (where applicable)
Where data-protection law (such as the GDPR) applies, we rely on: performance of a contract; our legitimate interests in operating and securing the Service; your consent (where required, e.g. certain cookies); and compliance with legal obligations. [CONFIRM WITH COUNSEL FOR YOUR JURISDICTION.]
4. How we share information
We share personal data with service providers / sub-processors that host and operate the Service on our behalf, under contract and only as needed; with authorities when required by law; and in connection with a business transfer (merger, acquisition, or asset sale). We do not sell personal data. A current list of sub-processors is available at [SUB-PROCESSORS URL].
5. Customer Content & documents
Documents you upload, convert, edit, or export are processed to provide the Service. Conversion and rendering (including server-side conversion and PDF rendering) are performed to fulfill your requests. You are responsible for the personal data contained in your Customer Content and for having a lawful basis to process it.
6. Data retention
We retain personal data for as long as needed to provide the Service and for legitimate business or legal purposes. Customer Content is retained per your account settings and our agreement, and deleted or returned on termination as described in the Terms. [SPECIFY RETENTION PERIODS.]
7. Security
We use technical and organizational measures designed to protect personal data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
8. International transfers
We may process and store data in countries other than yours. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers. [CONFIRM MECHANISMS.]
9. Cookies
We use strictly necessary cookies to operate the Service (e.g. authentication) and, where you consent, additional cookies for preferences or analytics. You can control cookies through your browser and, where offered, our cookie settings. [ALIGN WITH YOUR COOKIE BANNER, IF ANY.]
10. Your rights
Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. To exercise rights, contact us at [CONTACT EMAIL]. If we process your data on behalf of a customer organization, please direct your request to that organization.
11. Children
The Service is not directed to children under [MINIMUM AGE], and we do not knowingly collect their personal data.
12. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will provide reasonable notice. Continued use of the Service after changes take effect constitutes acceptance.
13. Contact
Questions or requests may be sent to [CONTACT EMAIL], [COMPANY LEGAL NAME], [COMPANY ADDRESS]. [IF GDPR APPLIES: identify the data controller and any EU/UK representative or DPO.]