What to include in a website privacy policy

Most privacy policies on small business websites were pasted in on launch day and never opened again. They mention cookies the site does not set, promise deletion procedures nobody follows, and sometimes still carry another company's name. If you are deciding what to include in a website privacy policy, the guiding rule is simple: every sentence should describe something your site actually does, in words a customer can follow.

The sections below are the ones readers, payment partners and app stores usually expect to find. Treat them as a drafting structure, and have the finished document checked by a qualified lawyer before you publish it, since specifics differ by business.

Opening: who you are and what the policy covers

Start by naming the business, not "we" alone. Give the legal or trading name, a registered or office address, and state which website or apps the policy applies to. If you run several domains, say whether this policy covers all of them.

Add the date the policy last changed. A policy without a date gives readers no way to know whether it is current, and it makes your own review cycle harder to track.

What data you collect

This is the heart of the document and the section most often wrong. Split it by how the data arrives.

Information people give you

• Contact and enquiry form fields, listed by name
• Account registration details for a portal or store
• Billing and delivery addresses for orders
• Newsletter subscriptions
• CVs and details sent through a careers page
• Messages sent through chat or WhatsApp links

Information collected automatically

• Server log data such as IP address, browser and pages visited
• Analytics identifiers, if you run GA4 or a similar tool
• Advertising or remarketing identifiers, if those scripts are installed
• Session cookies used for logins and shopping carts

Say plainly what you do not collect too. If card details go straight to a payment gateway and never touch your server, write that. Customers find it reassuring, and it is usually true.

Why you collect it

For each category, give the purpose in ordinary words: answering enquiries, processing and delivering orders, sending invoices, providing support, improving the website, or sending offers to people who asked for them. Avoid catch-all phrases such as "for business purposes", which tell the reader nothing.

Keep marketing separate from service. If someone fills a quote form, that is not permission to add them to a promotional list, and your policy should not pretend otherwise.

Who you share it with

Almost every website shares data with someone, even if the owner has never thought of it that way. List the categories of recipients and what each one handles:

• Hosting and email providers that store form submissions and inboxes
• Payment gateways that process transactions
• Courier and logistics partners that receive delivery addresses
• Analytics and advertising platforms
• CRM, invoicing or helpdesk tools your team uses
• Professional advisers and, where required, government authorities

State whether any of these process data outside India, since cross-border transfer is a point people ask about. Make clear that you do not sell personal data, if that is the case.

How long you keep it and how you protect it

Give retention in practical terms rather than a vague promise. For example: enquiry emails kept for a stated number of months, order records kept as long as tax and accounting rules require, and newsletter data kept until the person unsubscribes. Pick periods you can genuinely follow, then follow them.

In the security paragraph, describe measures honestly. HTTPS on the whole site, restricted admin accounts, software kept updated, and access-controlled backups are reasonable claims for a small site. Do not claim bank-grade encryption or absolute safety; no one can guarantee that, and an overstated claim can rebound on you.

Cookies and tracking

Describe the cookies your site actually sets, grouped by purpose: strictly necessary ones for login and cart, preference cookies for language or currency, analytics cookies, and advertising cookies. Explain how visitors can control them, both through your consent notice if you have one and through their browser settings.

To check what you really set, open your site in Chrome, press F12 for DevTools and look under the Application panel at cookies and storage. Compare the list with your policy and fix whichever one is out of date. Usually it is the policy.

Rights of visitors and how to contact you

Explain, without legal jargon, what a person can ask for: a copy of the data you hold, correction of wrong details, deletion where you no longer need the information, withdrawal of consent for marketing, and a route to complain if they are unhappy with your response.

Then give a working channel: a monitored email address, a postal address and a realistic response time. Name a role, such as a grievance or privacy contact, rather than an individual who may leave. If your business handles children's data, health information or financial records, discuss those specific obligations with a lawyer, because the expectations are stricter.

Close the document with a short paragraph on updates, explaining that the policy may change and that the revision date at the top shows when it last did.

Keeping the policy true as your site changes

A policy goes stale the moment someone adds a chat widget, a new form or a pixel for an ad campaign. Tie a quick policy check to two events: any time you install a new script or plugin, and a diary reminder every six months. Walk the site, list every input and script, and confirm the document still matches.

Publish the policy where people can find it, usually in the footer on every page and beside each form. If you need help auditing forms, scripts and consent on your site, our team can do that during a build or refresh; see our website services or ask a specific question through ask an expert. For the wording itself, take a lawyer's review before publishing.

Frequently asked questions

How long should a privacy policy be?

Long enough to cover what you do and no longer. A simple brochure site may need a page or two; an online store with accounts, payments and delivery partners will need more. Clarity matters more than length.

Can I use a privacy policy generator?

A generator can give you a workable skeleton, but it guesses at your practices. Edit every section to match reality, remove clauses that do not apply, and get the result reviewed professionally.

Where should the privacy policy link appear?

In the site footer on every page, and next to any form that collects personal details. Payment gateways and app stores typically look for an easily reachable link during review.

Do I need a separate policy for my mobile app?

Usually you need one policy that clearly covers the app, or a separate app policy, because apps often collect device data and permissions a website does not. App stores also expect a reachable policy URL at submission.