How to Write a Privacy Policy for a SaaS (2026)

Short answer: Write your SaaS privacy policy from a list of the personal data your product actually touches, then cover the sections GDPR Article 13 requires: who you are, what you collect and why, the legal basis, who receives it, transfers, retention, user rights and how to complain. Draft it with a generator (free to about $28 a month on the plans checked today), edit every line, and link it from your signup form, footer, terms of service and cookie banner.

This is not legal advice. Prices and legal quotes below come from the linked pages, checked on 7 Nov 2026. The advice in between is ours and marked as such.

TL;DR#

• Start from facts, not a template. List every piece of personal data, where it goes and how long it stays. The policy is a description of that list.
• Twelve sections cover most SaaS products. They map to GDPR Article 13 plus a few US additions such as a Do Not Track statement.
• Plain language is a legal requirement in the EU, not a style choice: information must be "concise, transparent, intelligible and easily accessible" (Art. 12).
• Generators are cheap. Termly has a free plan, GetTerms starts at $5/mo billed annually, iubenda at $5.99/mo billed annually plus VAT.
• Linking matters as much as wording. Show it at signup, in the footer, in your terms and in the cookie banner.

Disclosure: ZeroRaised publishes this guide and is a launch site for bootstrapped products. We have no commercial relationship with Termly, iubenda or GetTerms and earn nothing if you use them. We are not lawyers.

What this guide covers (and what it does not)#

This post covers one document: the public privacy notice your users read. The compliance work behind it (lawful basis, vendor DPAs, records of processing, breach plans) is in our GDPR checklist for solo SaaS founders, and the contract users accept is in our guide to writing terms of service for a SaaS. Keep terms and privacy policy as separate documents that link to each other.

Step 1: write down what you actually collect#

Our read: most bad privacy policies were written before anyone listed the data. Spend 30 minutes on a table before you open a generator. A typical bootstrapped SaaS ends up with rows like these (example, not a template):

The last row matters for SaaS specifically. For data your customers upload about other people, you are usually a processor, and that relationship belongs in a data processing agreement rather than your public privacy policy. Say so briefly in the policy and point business customers to the DPA.

Step 2: the 12 sections to include#

Article 13 lists what you must tell people "at the time when personal data are obtained" (Art. 13). Even if you are not in the EU, it is the most complete public checklist, and covering it gets you most of the way for other regimes. Here is how we would turn it into headings:

If you get personal data from somewhere other than the user (an enrichment API, a referral, a customer inviting a teammate), Article 14 applies instead, and you must provide the information "within a reasonable period after obtaining the personal data, but at the latest within one month" (Art. 14). For a SaaS, invited teammates are the common case: the invite email is a good place to link the policy.

Our read on section 11: in 2026 this is the section users actually read. If you send customer content to an AI provider, say which one, for what feature, and whether that provider or you may use it to train models. Vague wording here costs trust faster than anything else in the document.

Step 3: write it so people can read it#

Article 12 requires the information "in a concise, transparent, intelligible and easily accessible form, using clear and plain language" (Art. 12). The UK regulator's guidance adds that "It is often most effective to provide privacy information to people using a combination of different techniques", naming layering, dashboards and just-in-time notices as examples (ICO, the right to be informed). The ICO notes that page is under review after the Data (Use and Access) Act.

A layered policy for a small SaaS looks like this:

1. Top layer: five or six sentences. What you collect, the main reasons, that you do not sell personal data (only if true), and how to contact you.
2. Full policy: the 12 sections above, each under its own heading so readers can jump.
3. Just-in-time notes: a one-line note under the signup button, beside an optional marketing checkbox, and inside any feature that sends data to a new place, such as an AI assistant.

Our tips: write "we" and "you", replace "may" with what you actually do, name vendors rather than "third-party service providers", and give retention in days or months.

Step 4: US state laws at a high level#

This section covers state law only, at a high level. Two California laws are the ones most founders meet first.

CalOPPA. It requires an operator of a commercial website or online service that collects personally identifiable information from California residents to post a privacy policy. Since a later amendment, the policy must "Disclose how the operator responds to Web browser Do Not Track signals" and disclose whether other parties may collect personally identifiable information about a user's online activity over time and across sites (iubenda summary of the CalOPPA amendment). You do not have to honour Do Not Track; if you do not respond to the signal, iubenda says "it will suffice to indicate this fact in the privacy policy."

CCPA. California's Attorney General says the CCPA "applies to for-profit businesses that do business in California" and meet any one of three tests: "a gross annual revenue of over $25 million"; buying, selling or sharing the personal information of "100,000 or more California residents or households"; or deriving 50% or more of annual revenue from selling California residents' personal information (California AG, CCPA). Most bootstrapped SaaS products will not meet those tests early on. If you do, the AG says your privacy policy "must include instructions on how you can submit your request to delete", and if you sell or share personal information, a link to your "Do Not Sell or Share My Personal Information" page.

Other states. Other states have passed their own comprehensive privacy laws with their own thresholds. The IAPP US State Privacy Legislation Tracker maps them and was last updated 8 Sept 2026. Our read: check it once a year, and lean on a generator that monitors regulations if you have meaningful US traffic.

Generators vs a lawyer#

Prices below were checked on each vendor's pricing page on 7 Nov 2026 and are per website per month. We could not load PrivacyPolicies.com's pricing page today (it returned a 403), so it is not listed.

Our read: for just a privacy policy and cookie notice, GetTerms Starter or iubenda Essentials is the cheapest paid route. For privacy policy, terms and cookie banner in one place, Termly Pro+ and GetTerms Business are the lower-cost bundles on these numbers. Whatever you pick, treat the output as a first draft: generators cannot see your code, so compare it against your data table line by line, especially for AI features and customer uploads.

When to pay a lawyer. We did not find published fixed prices we could verify today, so ask for a written fixed quote and, to keep it cheap, send your edited draft and data table and ask for a review rather than a redraft. These triggers are our opinion:

• You process health, financial, biometric, children's or other sensitive data.
• An enterprise customer sends a security questionnaire or its own DPA.
• You meet CCPA thresholds or sell into several regulated markets at once.
• You train AI models on customer data.
• You receive a regulator letter, a data breach or a legal complaint.

Step 5: link it everywhere it needs to be#

A perfect policy nobody can find does not do its job. Place links here:

1. Signup form. A line under the button: "By signing up you agree to our Terms and acknowledge our Privacy Policy." This is the "time when personal data are obtained" moment Article 13 talks about.
2. Site and app footer, on every page, including inside the logged-in app.
3. Terms of service. Your terms should say the privacy policy explains how you handle data and link to it, and the privacy policy should link back. Do not duplicate data clauses in both; one source of truth avoids contradictions.
4. Cookie banner and cookie policy. Link the privacy policy from the banner. If you keep a separate cookie policy, link it from the privacy policy's cookie section.
5. Transactional emails and invite emails. Footer link, especially in team invites, since those recipients never saw your signup page.
6. Checkout and marketing forms. Next to any newsletter or waitlist field.

If you are about to go live, our product launch checklist for bootstrapped makers has the rest of the pre-launch list; the privacy policy is one line on it.

Step 6: keep it true#

Our read: the policy goes stale the first time you add a vendor. Make it a rule that any pull request adding a third-party service, data field or AI feature also updates the data table and the policy. The ICO recommends reviewing privacy information regularly (ICO). For material changes, email users before they take effect, update the effective date, add a changelog line and keep old versions in your repository.

Frequently asked questions#

Does a small SaaS need a privacy policy?#

In practice, yes, as soon as you collect any personal data, and a signup form with an email address counts. GDPR Article 13 requires you to give users specific information at the time you collect their data, and California's CalOPPA requires commercial websites and online services that collect personally identifiable information from California residents to post a privacy policy. This is not legal advice.

Can I copy another SaaS company's privacy policy?#

Do not. Their policy describes their vendors, their data and their jurisdiction, so copying it means publishing claims that are false about your product, and the text may be protected by copyright. Use a generator or template as a starting point and rewrite it against your own data list.

Is a free privacy policy generator good enough?#

For a pre-revenue product with simple data flows, a free or low-cost generator is a reasonable start, as long as you edit the output so it matches what your app actually does. Termly has a free plan with one basic legal policy, and GetTerms offers a free version with its branding. Move to a paid plan or a lawyer when your data gets sensitive or your customers get larger.

What is the difference between a privacy policy and a cookie policy?#

The privacy policy covers all personal data you process, from account details to support emails. A cookie policy covers only cookies and similar trackers on your site and app, and usually sits behind your cookie banner. Many small SaaS products put a cookie section inside the privacy policy; generators such as Termly and iubenda can produce both.

How often should I update my SaaS privacy policy?#

Whenever your data handling changes: a new vendor, a new feature that collects new data, a new country of customers or a new use such as AI training. The UK ICO also recommends reviewing privacy information regularly. Keep a dated changelog and tell users about material changes before they take effect.

Ship it, then launch it#

ZeroRaised is a launch directory for products built without institutional VC. Once your privacy policy, terms and cookie banner are live, submit your product for free. For more practical guides on building and growing without investors, join the ZeroRaised newsletter.

Sources#

• GDPR Article 12, last checked 7 Nov 2026
• GDPR Article 13, last checked 7 Nov 2026
• GDPR Article 14, last checked 7 Nov 2026
• ICO: The right to be informed, last checked 7 Nov 2026
• California Attorney General: CCPA, last checked 7 Nov 2026
• iubenda: Do Not Track and California privacy policy changes (CalOPPA), last checked 7 Nov 2026
• IAPP US State Privacy Legislation Tracker, last checked 7 Nov 2026
• Termly pricing, last checked 7 Nov 2026
• GetTerms pricing, last checked 7 Nov 2026
• iubenda pricing, last checked 7 Nov 2026