Privacy paper that matches what your product actually does.
Enterprise buyers and regulators read your privacy documents against your product. We map your data flows first, then write policies, DPAs and AI terms that are accurate, readable and ready for security review.
Privacy services
Each one is a flat fee, quoted before we start. Hover a service to see what's included.
5 services
- Privacy PoliciesA privacy policy that matches your real data practices, for US-only or GDPR users.Data mapping questionnaire and review call with your product leadPrivacy policy covering collection, use, sharing, retention and user rightsUS state privacy law disclosures, including California rights where applicable
- Cookie NoticesCookie notices and consent settings that fit EU consent and US opt-out rules.Tracker inventory sorted into necessary, analytics, functional and advertisingCookie notice describing each category, purpose and providerConsent and opt-out configuration guidance for your consent management tool
- AI & Data GovernanceTraining-data, model and acceptable-use terms that keep your AI product defensible.Review of the data sources you use for training, fine-tuning and evaluationCustomer contract terms on training rights, opt-outs and data retentionAcceptable use policy for your AI features
- Data Processing Agreements (DPA)A DPA template and negotiation support for GDPR and US state privacy requirements.Standard DPA covering GDPR, UK GDPR and US state privacy law requirementsStandard Contractual Clauses and UK addendum for international transfersSubprocessor list template and change notification process
- HIPAA / BAAsHIPAA applicability review and business associate agreements for health tech.HIPAA applicability analysis for your product and customersBusiness associate agreement template for your customersReview and negotiation of customer-provided BAAs
Who we work with
- 01
Startups launching a product that collects personal data
- 02
Companies facing enterprise security and privacy questionnaires
- 03
AI products training on or processing customer data
- 04
Health-tech teams handling protected health information
Privacy questions
A template describes someone else's data practices. If your policy doesn't match what you actually collect and share, that mismatch is itself a compliance risk.
GDPR can apply to non-EU companies that offer goods or services to people in the EU or monitor their behavior. Whether it applies to you depends on your users and how you market.
A data processing agreement sets out how a vendor handles personal data on a customer's behalf. Enterprise customers usually require one before signing.
Other practice areas
- 7 servicesAI Commercial & InfrastructureThe contracts behind the compute.Explore
- 6 servicesConstructionContracts that protect your scope, your schedule and your right to get paid.Explore
- 7 servicesReal EstateLease and deal documents that hold up in diligence.Explore
- 5 servicesTaxThe tax decisions you can only get right early.Explore
- 5 servicesBlockchain & CryptoContracts for digital assets, drafted by people who read the protocol docs.Explore
- 7 servicesEmerging Companies & Venture CapitalFrom Delaware incorporation to your Series B, without the hourly meter.Explore
- 6 servicesIntellectual PropertyProtect what makes you defensible, and skip what doesn't.Explore
- 5 servicesEmploymentHire fast without creating problems you find in diligence.Explore
- 5 servicesFinancial RegulatoryFintech contracts written with the regulator in the room.Explore
- 5 servicesDefense & Government ContractsWin government work without giving away your IP.Explore
Talk to a privacy attorney.
A short call with an attorney. You leave with a written scope and one fixed price.
Book a call