Privacy notice · Draft
This editable draft is not a compliance determination. Do not publish until a privacy professional has mapped the real data flows, processors, legal bases, and retention periods for each country served.
Controller and contact
Identify the actual legal entity, privacy contact, and establishment: [COMPANY], [CONTACT], [ADDRESS]. Do not publish invented company details.
Data collected
Document only what the live service actually collects, such as account identifiers, support messages, order targets, security logs, and payment-provider references. Never collect social-media login credentials.
Purposes and legal bases
For each data category, describe the specific service, security, billing, or legal purpose and the applicable legal basis in each operating jurisdiction.
Recipients and transfers
List hosting, email, analytics, support, payment, and supplier processors; assess international data transfers, safeguards, and customer notice obligations.
Retention and rights
Set documented retention and deletion periods, and explain applicable access, correction, deletion, objection, portability, and complaint rights, including how to exercise them with [CONTACT].