Answer a short questionnaire and get a privacy policy written for the regulations you select — GDPR, UK GDPR, CCPA/CPRA, LGPD, PIPEDA, Australia's Privacy Act and more — hosted at a URL, with PDF and DOCX copies.
Most privacy laws do not ask for a document called a privacy policy. They ask you to tell people, at the moment you collect their data, who you are, what you collect, why, who you share it with, how long you keep it and what rights they have. Under the GDPR and UK GDPR that list is set out in Articles 13 and 14, and it includes your legal basis for each use and the right to complain to a supervisory authority.
California's CCPA, as amended by the CPRA, adds its own list: the categories of personal information you collect, the sources, whether you sell or share it, how a consumer can exercise their rights — and it requires you to review the policy at least once every twelve months. Brazil's LGPD, Canada's PIPEDA and Australia's Privacy Principles each set similar expectations in their own terms.
There is a practical reason too. Apple's App Store and Google Play both require a privacy policy link for apps, and many analytics and advertising services expect you to disclose that you use them. A clear, current policy is usually the first thing a regulator, a platform reviewer or a careful customer looks for.
Every policy carries the sections all of these laws share, plus the extra sections each regime you select requires.
Your organisation, contact details and, under the GDPR and UK GDPR, your EU or UK representative and data protection officer where you have one.
The personal data you collect, where it comes from, how you use it and — for the GDPR — the legal basis for each use and any automated decision-making.
Who you share data with, and how data leaves the EU, UK or Australia safely when your providers are elsewhere.
How long you keep data and how you protect it, plus sections on cookies, children's data and how you announce changes.
GDPR and UK GDPR rights, California's right to opt out of sale or sharing, and dedicated sections for Brazil, Canada and Australia.
Each regime-specific section is grounded in the statute it implements, so a reviewer can trace a clause to its source instead of trusting it.
You answer the questionnaire once. MostlyPrivacy produces each language version of the policy from those same answers in a single step, so the German and the English say the same thing — not two documents that drifted apart. You can publish a document in up to ten of 36 languages.
Each language is published at its own hosted URL, with a PDF rendered for each one and a DOCX export when you need to edit offline. On Pro, you can connect a GitHub repository and let a code scan pre-fill the services and data types your product actually uses.
This is a template engine, not a lawyer. The templates are cited to the statutes they follow but have not been reviewed by a lawyer, and some sections — US state laws beyond California and Switzerland's revised FADP — are explicitly marked for review. Translations are machine-generated from the same template; have a fluent reader check any language you rely on.
A published policy is a snapshot. It does not change by itself when your practices or the law change: you update your answers, regenerate and publish the new version. If your processing is unusual or high-risk — health data, children's data, large-scale profiling — have a qualified lawyer review the result before you publish.
Yes. The free plan includes one generated document for one site — a privacy policy, for example — published at a hosted URL with a PDF copy. Paid plans start at $15 a month and remove the one-document limit.
You choose the regimes that apply to you: the GDPR, UK GDPR, California's CCPA/CPRA, the Virginia-model US state privacy laws, Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act and Switzerland's revised FADP. The US state and Swiss sections are marked for review.
A privacy policy is valid when it accurately describes what you do with personal data and includes what the applicable law requires. The generator gives you a statute-cited structure; whether it is accurate depends on your answers. It is not legal advice, and we recommend a lawyer's review.
Usually, yes. Analytics tools collect online identifiers such as IP addresses and cookie IDs, which most privacy laws treat as personal data, and many analytics providers require you to disclose that you use them.
Yes. Every language version is generated from the same answers, in up to ten of 36 languages per document. Translations are machine-generated, so have a fluent reader check them.
No. A published policy is a snapshot. When your practices or the law change, you update your answers and regenerate, and the new version is published alongside the old one. We do not silently rewrite a document you have published.
Link to the hosted URL MostlyPrivacy gives you for each language, or download the PDF or DOCX and publish it yourself.
On Pro and above you can connect a GitHub repository. The scan detects the third-party services your code uses — payment, analytics, email and so on — and pre-fills them into the questionnaire, so the policy lists the processors you actually rely on.
Weighing up other tools? Read our honest comparison: MostlyPrivacy vs Termly
One site, the consent banner and one generated document — free, with no card. Upgrade when you need more sites or documents.