A privacy policy is a public promise, and regulators hold companies to what it says. We start with a short data mapping exercise, then write a policy that describes what you collect, why, and who you share it with. You choose a US-only version or one enhanced for GDPR and UK users.
At a glance
- Practice
- Privacy
- Pricing
- Flat fee, quoted before we start
- Included
- 6 deliverables
- Process
- 3 steps, one named attorney
- Where we work
- Slack, email or a call
When founders call us
The moments that usually bring a company to us for this work.
- 01
You are launching an app or website that collects emails, accounts or usage data
- 02
An app store or enterprise customer has asked for your privacy policy
- 03
You are starting to sell to users in Europe or the UK
- 04
You added analytics, ad pixels or AI features since your last policy was written
What you get
Scoped in writing before we start. One flat fee for all of it.
- Data mapping questionnaire and review call with your product lead
- Privacy policy covering collection, use, sharing, retention and user rights
- US state privacy law disclosures, including California rights where applicable
- Optional GDPR and UK GDPR sections: lawful bases, transfers and data subject rights
- Children's data review where your audience may include users under 13
- Internal notes on the processes needed to honor access and deletion requests
How it works
- 1
Data mapping
We learn what data you collect, the tools you use and where users are located.
- 2
Draft policy
We write the policy in plain language and confirm each statement against your practices.
- 3
Publish and maintain
You publish the policy, and we note which product changes should trigger an update.
Mistakes we help you avoid
The ones we see most often, and catch before they cost you.
- Avoided
Copying another company's policy that describes data practices you do not have
- Avoided
Saying you never sell or share data while running ad pixels that may count as sharing under California law
- Avoided
Promising rights you have no process to honor, such as deletion within a set time
- Avoided
Assuming GDPR does not apply because you have no office in Europe
Privacy Policies: questions founders ask
Usually. California law requires one for commercial websites and apps that collect personal information from California residents, and app stores and many payment providers require one too. Several other state laws add specific disclosure requirements depending on your size and activities.
It applies to for-profit businesses that do business in California and meet at least one threshold, such as annual revenue above a set amount, handling personal information of a large number of California consumers, or earning a significant share of revenue from selling or sharing it. Many early startups fall below the thresholds, but some still adopt CCPA-style terms for customers who ask.
GDPR can apply to a company outside the EU if it offers goods or services to people in the EU or monitors their behavior there. If that describes you, your notice needs GDPR-specific content such as lawful bases and transfer mechanisms. A US-only policy usually will not cover those points.
Generators can produce a reasonable starting format, but they cannot see how your product actually handles data. The risk is a policy that is inaccurate, which can create its own legal exposure. Data mapping is the part that matters most.
Get a flat-fee quote for Privacy Policies.
A short call with an attorney. You leave with a written scope and one fixed price.
Book a call