A GDPR privacy policy, written from how you really work.
Privacyboard writes your privacy policy from your company details, activities, vendors and security practices. It tells you when a change makes it out of date, and you validate it before it is shown to anyone.
Free to set up · No credit card · About 5 minutes
In short
- Built from
- Your company, activities, vendors, data and practices
- Stays current
- Flags the policy when your answers change
- You approve it
- A draft is never public until you validate it
- Cost
- Free to draft and validate. Publishing is on Pro
Know what is missing before you validate
A short checklist shows which answers are still needed, so the policy is complete before anyone sees it.
Told when it goes out of date
Add a tool or change a practice and the affected section is flagged, with the change highlighted so you can review it in seconds.
Nothing goes public without your approval
Validate a version, then show it in your privacy center or download it. Drafts always stay private.
What is a privacy policy under the GDPR?
A privacy policy, or privacy notice, is the document in which a company tells people how it handles their personal data. The GDPR asks for it to be concise, easy to read and written in clear language, and to say who is responsible for the data, why it is used, who receives it, how long it is kept and which rights people have.
A generic template rarely fits, because the right text depends on the tools you use and what you do with data. Privacyboard starts from your own answers, so each section describes your situation and not an average one.
How it works
- 1
Answer a few questions
Start with your website address. We read your public pages to prefill your company, tools and contact, and you check what we found.
- 2
Review the draft
The policy is assembled from your activities, vendors, data categories and practices. A checklist shows what is still missing.
- 3
Validate and share
Read it, correct what is wrong, then validate it. Download it or show it in your privacy center.
What you get
Written from your facts
Controller identity, purposes, data categories, recipients, retention and security practices come from your workspace.
Vendors and transfers
The vendors you list appear as recipients. If one processes data outside the EEA, the policy asks how that transfer is protected.
Automated decisions, guided
If you take automated decisions about people, three short questions describe the decision, its logic and its effect.
Out-of-date alerts
Add a tool or change a practice and the validated policy is marked as changed, so the approved text is never silently stale.
Validation before publishing
Only a policy you validated can be shown to the public. Drafts stay private.
Download as a file
Export the validated policy as a document whenever you need it.
What the GDPR asks a privacy policy to say
This is a summary, not legal advice. A particular situation may need a professional.
- Article 12
- Information must be concise, transparent, intelligible, easily accessible and in clear, plain language.
- Articles 13 and 14
- Who you are and how to reach you, the purposes and legal basis, the recipients, transfers outside the EEA, retention, the rights people have and their right to complain to an authority.
- Article 22
- If you take decisions based only on automated processing with legal or similarly significant effects, you must give meaningful information about the logic involved and the consequences.
Questions, answered.
Is a privacy policy mandatory under the GDPR?
If you process personal data of people in the EU, you must give them the information listed in Articles 13 and 14. In practice that is done with a privacy policy that is easy to find, for example linked from your website footer and your sign-up forms.
What should a GDPR privacy policy include?
Who is responsible for the data and how to contact them, the purposes and legal basis of each use, the categories of data, who receives it, transfers outside the EEA and how they are protected, how long data is kept, the rights people have, how to exercise them and how to complain to an authority.
Is the policy generated by AI?
No. It is assembled from your answers and the vendor information in your workspace using fixed, reviewed text. Nothing is invented about your company, and anything we suggest stays marked until you confirm it.
What happens when I add a tool or change a practice?
Your validated policy is marked as changed since validation. You read the update, correct it if needed and validate again, so the approved version always matches what you do.
Can I edit the text?
Yes. You can read the whole policy, change what is wrong and then validate it. Validation records the exact version you approved.
Is this legal advice?
No. Privacyboard is a guidance tool. It gives you clear drafts and records, and for an unusual situation you should check with a professional.