Privacy Policy Generator
GDPR compliant in two minutes

If your site collects any personal data at all — even just a contact form or basic analytics — and can be reached from the EU or UK, yes. GDPR Articles 13 and 14 require you to inform people about the processing when you collect their data. A publicly linked privacy policy is the standard way to meet that duty, and similar laws (CCPA in California, PIPEDA in Canada, LGPD in Brazil) require one worldwide.

In your footer so it appears on every page, and anywhere you collect data: next to form submit buttons, in sign-up screens, and inside your cookie banner. Regulators check whether the policy was reasonably reachable at the point of collection.

The privacy policy covers all personal-data processing — forms, accounts, marketing, everything. The cookie policy covers only cookies and similar technologies. They overlap heavily, which is why many sites fold the cookie details into the privacy policy or cross-link both. We make a dedicated cookie policy generator as well.

Yes — if you use it. Analytics providers act as processors or joint controllers depending on configuration, and their use involves cookies and possibly data transfers outside the EEA. Every tool you connect to your site should appear somewhere in the policy, ideally by category.

You can, if the data practices genuinely match. The policy must accurately describe every surface where you collect data — so if the app collects location or contacts that the website doesn't, add those disclosures before sharing the same document.