Privacy Policy (U.S.)
Frontmatter
kind: agreement
title: Privacy Policy (U.S.)
code: business__privacy_policy_us
jurisdiction: US
respondent_type: person_and_entity
confidential: false
origin_url: https://github.com/General-Legal/legal-templates/tree/main/templates/privacy-policy-us
prompts:
company: "What is the company’s full legal name and entity type?"
business_services: "Identify covered websites, apps, audiences, and controller/business role."
effective_date: "What is the {{for_label}}?"
contacts: "Who are the primary and alternate contacts? Include name, title, email, and postal address."
business_data: "Inventory data categories, sensitive data, people, and specific sources."
business_purposes: "Map each category to its actual purpose and disclose any automated decision-making."
business_sharing: >-
Map data categories to recipients and purposes; state actual sale, sharing, advertising, and opt-out practices.
business_cookies: "Give the cookie notice and preference-center URLs."
business_retention: "State retention periods or criteria by category, security practices, and backup treatment."
business_rights: >-
Give working request methods, verification, authorized-agent, appeal, response, and marketing opt-out procedures.
business_state_disclosures: >-
Complete applicable state disclosures, including California collection/sale/sharing information for the required
period and financial incentives, if any.
business_children: "State intended ages, child-data practices, and parent contact process."
audiences:
company: lawyer
business_services: lawyer
effective_date: lawyer
contacts: lawyer
business_data: lawyer
business_purposes: lawyer
business_sharing: lawyer
business_cookies: lawyer
business_retention: lawyer
business_rights: lawyer
business_state_disclosures: lawyer
business_children: lawyer
questionnaire:
BEGIN:
_: entity__company
entity__company:
_: custom_text__business_services
custom_text__business_services:
_: custom_datetime__effective_date
custom_datetime__effective_date:
_: people__contacts
people__contacts:
_: custom_text__business_data
custom_text__business_data:
_: custom_text__business_purposes
custom_text__business_purposes:
_: custom_text__business_sharing
custom_text__business_sharing:
_: custom_text__business_cookies
custom_text__business_cookies:
_: custom_text__business_retention
custom_text__business_retention:
_: custom_text__business_rights
custom_text__business_rights:
_: custom_text__business_state_disclosures
custom_text__business_state_disclosures:
_: custom_text__business_children
custom_text__business_children:
_: END
END: {}
workflow:
BEGIN:
_: lawyer_review
lawyer_review:
approved: END
changes_requested: reask__draft
reask__draft:
resubmitted: lawyer_review
END: {}
Body
Privacy Policy (U.S.)
Arrow keys or Space step through the document. Click a paragraph to highlight it.
Privacy Policy (U.S.)
is responsible for the practices described here for Identify covered websites, apps, audiences, and controller/business role.. Effective date: What is the effective date?. Privacy contact and postal address:
Scope
This policy covers the services and audiences identified above. Where we process information solely for a business customer under its instructions, that customer’s privacy notice governs its purposes; requests should be directed to that customer. Our separate contractual duties still apply.
Information and sources
Inventory data categories, sensitive data, people, and specific sources.
This schedule identifies each category of personal information, the people it concerns, whether it is sensitive, and its source: directly from you, your device, a customer, or another identified source. We request only information needed for the purposes below. Required fields and the consequences of not providing them are explained when collected.
Purposes
Map each category to its actual purpose and disclose any automated decision-making.
We use information only for the described purposes and compatible or otherwise lawful uses. These may include providing requested services, securing accounts, responding to questions, meeting legal duties, and the specific analytics or marketing activities stated above. We obtain consent where required. A new use requiring notice or consent is addressed before it begins.
Sharing, advertising, and tracking
Map data categories to recipients and purposes; state actual sale, sharing, advertising, and opt-out practices.
This schedule identifies the categories of recipients and information disclosed, their purposes, any sale or sharing for targeted advertising, and applicable opt-out links. Service providers act under appropriate contractual restrictions. We may disclose information when legally required, to protect lawful rights, or in a business transfer subject to applicable protections. We do not describe information as anonymous if it can reasonably identify you.
Cookies and other device technologies, their purposes, and choices are described at Give the cookie notice and preference-center URLs.. Where law requires an opt-out preference signal to be honored, we apply it to the browser or account as required and explain any limits in the choice interface.
Retention and security
State retention periods or criteria by category, security practices, and backup treatment.
Retention periods or criteria are specified by category and purpose, including legal holds and backup deletion. We retain information only as long as needed for those purposes or as law requires. We use reasonable safeguards suited to the information and risks. No system guarantees complete security.
Your rights and choices
Give working request methods, verification, authorized-agent, appeal, response, and marketing opt-out procedures.
Depending on applicable law, you may request access, correction, deletion, a portable copy, or an opt-out of sale, sharing, targeted advertising, or certain profiling. Where applicable, you may limit use of sensitive information and use an authorized agent. We verify requests proportionately and request only information needed for verification. We explain a denial and provide any required appeal procedure and regulator contact. We do not unlawfully discriminate for exercising rights. You may opt out of marketing messages using their unsubscribe control; necessary service messages may continue.
U.S. state disclosures
Complete applicable state disclosures, including California collection/sale/sharing information for the required period and financial incentives, if any.
The state schedule must describe applicable rights and request methods, the relevant collection and disclosure periods, categories sold or shared, sensitive-information uses, financial incentives if any, and the company’s actual practices. Mandatory rights apply even where this notice does not enumerate them.
Children, links, and changes
Our intended ages, treatment of children’s information, and parent request process are: State intended ages, child-data practices, and parent contact process.. We obtain legally required parental consent or avoid collecting information that requires it. If we discover prohibited collection, we take appropriate deletion and protective steps.
Third-party sites have their own policies. We update this policy when practices change, post the effective date, and give additional notice or seek consent when law requires. Contact us using the details at the beginning of this policy.
Questionnaire
Try answering this
Sample matter: Acme LLC — nothing you type below is saved anywhere.
- 1What is the company’s full legal name and entity type?
- 2Identify covered websites, apps, audiences, and controller/business role.
- 3What is the effective date?
- 4Who are the primary and alternate contacts? Include name, title, email, and postal address.
- 5Inventory data categories, sensitive data, people, and specific sources.
- 6Map each category to its actual purpose and disclose any automated decision-making.
- 7Map data categories to recipients and purposes; state actual sale, sharing, advertising, and opt-out practices.
- 8Give the cookie notice and preference-center URLs.
- 9State retention periods or criteria by category, security practices, and backup treatment.
- 10Give working request methods, verification, authorized-agent, appeal, response, and marketing opt-out procedures.
- 11Complete applicable state disclosures, including California collection/sale/sharing information for the required period and financial incentives, if any.
- 12State intended ages, child-data practices, and parent contact process.
Step 1 of 12
What is the company’s full legal name and entity type?
Privacy Policy (U.S.)
Arrow keys or Space step through the document. Click a paragraph to highlight it.
Privacy Policy (U.S.)
is responsible for the practices described here for Identify covered websites, apps, audiences, and controller/business role.. Effective date: What is the effective date?. Privacy contact and postal address:
Scope
This policy covers the services and audiences identified above. Where we process information solely for a business customer under its instructions, that customer’s privacy notice governs its purposes; requests should be directed to that customer. Our separate contractual duties still apply.
Information and sources
Inventory data categories, sensitive data, people, and specific sources.
This schedule identifies each category of personal information, the people it concerns, whether it is sensitive, and its source: directly from you, your device, a customer, or another identified source. We request only information needed for the purposes below. Required fields and the consequences of not providing them are explained when collected.
Purposes
Map each category to its actual purpose and disclose any automated decision-making.
We use information only for the described purposes and compatible or otherwise lawful uses. These may include providing requested services, securing accounts, responding to questions, meeting legal duties, and the specific analytics or marketing activities stated above. We obtain consent where required. A new use requiring notice or consent is addressed before it begins.
Sharing, advertising, and tracking
Map data categories to recipients and purposes; state actual sale, sharing, advertising, and opt-out practices.
This schedule identifies the categories of recipients and information disclosed, their purposes, any sale or sharing for targeted advertising, and applicable opt-out links. Service providers act under appropriate contractual restrictions. We may disclose information when legally required, to protect lawful rights, or in a business transfer subject to applicable protections. We do not describe information as anonymous if it can reasonably identify you.
Cookies and other device technologies, their purposes, and choices are described at Give the cookie notice and preference-center URLs.. Where law requires an opt-out preference signal to be honored, we apply it to the browser or account as required and explain any limits in the choice interface.
Retention and security
State retention periods or criteria by category, security practices, and backup treatment.
Retention periods or criteria are specified by category and purpose, including legal holds and backup deletion. We retain information only as long as needed for those purposes or as law requires. We use reasonable safeguards suited to the information and risks. No system guarantees complete security.
Your rights and choices
Give working request methods, verification, authorized-agent, appeal, response, and marketing opt-out procedures.
Depending on applicable law, you may request access, correction, deletion, a portable copy, or an opt-out of sale, sharing, targeted advertising, or certain profiling. Where applicable, you may limit use of sensitive information and use an authorized agent. We verify requests proportionately and request only information needed for verification. We explain a denial and provide any required appeal procedure and regulator contact. We do not unlawfully discriminate for exercising rights. You may opt out of marketing messages using their unsubscribe control; necessary service messages may continue.
U.S. state disclosures
Complete applicable state disclosures, including California collection/sale/sharing information for the required period and financial incentives, if any.
The state schedule must describe applicable rights and request methods, the relevant collection and disclosure periods, categories sold or shared, sensitive-information uses, financial incentives if any, and the company’s actual practices. Mandatory rights apply even where this notice does not enumerate them.
Children, links, and changes
Our intended ages, treatment of children’s information, and parent request process are: State intended ages, child-data practices, and parent contact process.. We obtain legally required parental consent or avoid collecting information that requires it. If we discover prohibited collection, we take appropriate deletion and protective steps.
Third-party sites have their own policies. We update this policy when practices change, post the effective date, and give additional notice or seek consent when law requires. Contact us using the details at the beginning of this policy.
Workflow
Definition graph — generated directly from this notation's workflow.