This is a template. Set LEGAL_COMPANY_NAME, LEGAL_ADDRESS and LEGAL_EMAIL in .env, check every section against what your product does, and have it reviewed before you launch.
Privacy policy
Last updated: [DATE]
1. Who we are
MySaaS is run by [YOUR COMPANY NAME], [YOUR REGISTERED ADDRESS] ("we"). We are the controller of your personal data. Questions about your data: [privacy@your-domain.com].
2. What we collect and why
- Your account: email address, password (stored only as a secure hash), language, and when you signed up and confirmed your email. We need these to provide the service you signed up for (GDPR art. 6(1)(b)).
- Billing: your plan, payments, invoices and, if you give them, company details and VAT number. Card and bank details go straight to Stripe and never reach us. We need this to take payment (art. 6(1)(b)) and to keep accounting records required by law (art. 6(1)(c)).
- Security: technical logs such as IP addresses and failed login attempts, kept briefly to protect accounts from abuse (our legitimate interest, art. 6(1)(f)).
- Emails: we send messages needed for your account, such as confirmations, password resets and billing notices. [If you send newsletters, describe them and their consent here.]
3. Who processes data for us
- Stripe (payments, invoices, tax): Stripe Payments Europe, Ltd., Ireland. Stripe may transfer data to the US under the EU–US Data Privacy Framework and standard contractual clauses.
- [Hosting provider], where the application and database run, [country].
- [Email provider], which delivers our emails, [country].
We don't sell your data and don't share it with anyone else unless the law requires it.
4. How long we keep it
We keep account data while your account exists. When you delete your account, we delete it straight away. Invoices and payment records are kept for as long as accounting law requires ([e.g. 5 years from the end of the tax year]), and security logs for [30 days].
5. Your rights
You can access, correct, delete and export your data, restrict or object to its processing, and withdraw any consent you gave. In your account settings you can download all your data and delete your account yourself. For anything else, email [privacy@your-domain.com]. You can also complain to your data protection authority.
6. Cookies
We use only the cookies needed for the site to work, which don't require consent:
sessionkeeps you signed in and protects forms (until you sign out, at most 30 days).langremembers your language (1 year).cookie_consentremembers your cookie choice (1 year).
[If you add analytics or other optional cookies, list them here. They only load after you choose "Accept all", and you can change your choice in cookie settings.]
7. Changes
If we change this policy in a way that matters, we'll tell you by email before it applies.