How to write a privacy policy for a small website
A privacy policy is a description of what your site actually does with people's information. Write it in two passes: first an inventory of every piece of data the site touches, then plain sentences describing that inventory. A copied template describes someone else's site, which is worse than useless.
Do you need one?
If your site collects any personal information, almost certainly yes. A contact form that asks for a name and an email address counts. So does a newsletter sign-up, a booking form, or analytics that store identifiers about visitors. In the UK and EU, the GDPR's right to be informed means people must be told what you collect and why at the point you collect it; Article 13 lists what that information should include. Other places, including several US states, have their own requirements. Even where the law is silent, payment providers, app stores and advertising platforms often ask for a privacy policy URL.
Step 1: make the inventory
Open your site and list everything it collects or causes to be collected. Go through it page by page, not from memory. A table like this works:
| What | Where it's collected | Why | Where it goes | How long it's kept |
|---|---|---|---|---|
| Name, email, message | Contact form | To reply to enquiries | Website host's storage; emailed to the owner | Decide: for example, 12 months after the last message |
| Name, email, phone, date, time, service | Booking form | To arrange the appointment | Host's storage; copied to a spreadsheet | Decide: for example, two years for records |
| Newsletter sign-up | To send the newsletter | Your email marketing tool | Until they unsubscribe | |
| Visit counts | Every page | To see which pages are used | Host's analytics | As your host keeps it |
| IP address (technical) | Fonts or images loaded from other services | To display the page | That service, under its own policy | As that service keeps it |
Two columns are where small sites usually come unstuck. Where it goes has to include every tool a submission is copied to: if your form sends to Slack, a spreadsheet and an email tool, all three are on the list. How long it's kept is a decision you have to make; "forever" is rarely defensible.
Step 2: write it in plain sentences
- Who you are and how to contact you. Business or trading name, and an email address that someone reads.
- What you collect, form by form. "When you book, we ask for your name, email, phone number and the time you want."
- Why. One reason per item, in ordinary words. If you rely on a legal basis under GDPR, name it: most small sites use contract (to provide a booking) or legitimate interests (to reply to an enquiry), and consent for marketing emails.
- Who else receives it. Name the tools from your inventory: your host, your email marketing service, your spreadsheet or CRM, your payment provider.
- How long you keep it, from your inventory.
- People's rights to see, correct or delete their data, and how to ask. In the UK, mention that they can complain to the ICO.
- Cookies and tracking, if any. If you use none, say so.
- When you last updated the policy.
Common mistakes
- Copying a large company's policy. It lists processing you don't do and misses the tools you do use.
- Forgetting third-party embeds. Web fonts, maps, videos and images served by another company all send the visitor's IP address to that company.
- Never updating it. Adding a connector, a newsletter tool or a new form changes what the policy should say.
- Hiding it. Link it from the footer of every page and next to each form.
How Anticode helps
Every published Anticode site gets a Privacy Policy and Terms written from what that particular site does, rather than from a generic template. The Legal pages section of the console shows what was found: the forms and the personal fields they keep, where submissions go (Anticode's own storage, your inbox, or a connector such as Slack or Google Sheets), any payment links, and services the page loads from, such as Google Fonts or Unsplash images. You add a business or owner name and a contact email, which appear on the documents.
Some facts help the policy stay short. Form submissions are sealed at rest. Site analytics count visits without cookies, and published pages carry no third-party trackers. The form connectors you switch on are reflected in where the policy says submissions go.
Limits
Anticode's documents are a starting point, not legal advice. They describe what the site's pages and settings show; they can't know what you do with data afterwards, such as copying a spreadsheet to a laptop or forwarding enquiries to a colleague. Retention periods and your legal basis are your decisions. If you export the site and add your own code or services, the generated policy no longer describes it, and you'll need to update it yourself.
Questions people ask
Can I use a free privacy policy generator?
As a structure, yes. But check every sentence against your inventory. Generators ask questions; they can't see which tools your form actually sends to.
My site has no forms. Do I still need one?
If nothing personal is collected, the policy can be very short. Note that fonts, images or videos loaded from other services still expose visitors' IP addresses to those services.
How often should I review it?
Whenever you add a form, a connector or a new tool, and at least once a year.
Do I need a cookie banner too?
Only if you use cookies or similar storage that isn't strictly necessary. A site with no tracking cookies doesn't need a consent banner for them.