Privacy policy generator
Describe your business and data. Get a draft privacy policy, or a DPIA or data map.
Nothing sends until you start, and you can change anything afterwards.
What you get
- Text in the chat Copy it wherever you need it. Keep chatting to adjust the tone, length, or wording.
Templates
Online shop privacy policy
- A three page Word document with ten sections, in plain English, for a UK shop under UK GDPR
- Sections for the data collected and for Stripe, Google Analytics and Mailchimp
- A reminder to collect newsletter and cookie consent actively before launch
- Marked for review by a privacy professional or counsel before you publish it
Fitness app privacy policy
- A four page Word document, drafted with US state privacy law in mind
- Treats precise location as sensitive information
- Points to confirm are marked, and it names the sections to rewrite if they turn out differently
Agency GDPR compliance checklist
- A do first list, led by client mailing lists with no clear permission records
- Who is responsible for each list: the client as controller, the agency often as processor
- A note that current Irish regulator guidance could not be retrieved, so verify it
How it works
- Start from a template below, or describe the processing: what it is for, whose data, which data, the systems and vendors, and how long you keep it. For a request, give its type, the person's location, the date you received it, and where their data lives.
- askROI's Privacy and compliance tool drafts the work product: a DPIA with risks scored by likelihood and severity and the measures for each, a request response with its deadline, search plan, exemptions, and letter, or a data map with one row per processing activity.
- Copy it into your privacy records or ask for a Word file, or keep chatting to fill the gaps it marked to confirm.
What people use it for
- Privacy policies a draft policy built from what you actually collect and which vendors you use.
- GDPR compliance checklists what your organization needs to do, in order.
- New projects a DPIA before launching a system that collects personal data, including whether one is required at all.
- Access requests a deadline, a search plan across the systems you name, and a response letter ready to send.
- Deletion requests the systems to clear, the exemptions to check, and the reply to the requester.
- Records a data map of activities, purposes, legal bases, vendors, transfers, and retention, with the gaps listed.
Questions
What is in the DPIA draft?
A description of the processing, whether a DPIA is required, the lawful basis with necessity and proportionality, a risk table scored by likelihood and severity, the measures for each medium or high risk with the residual risk, and the outcome with blank sign-off lines for your data protection officer.
What deadlines does it use for data subject requests?
One month for GDPR and UK GDPR, which can be extended by two more months for complex requests if you tell the person within the first month, For CCPA and CPRA, requests to know, delete, or correct get 45 days, extendable once by 45 more, while opt-outs of sale or sharing and requests to limit sensitive data use must be done within 15 business days. It counts from the date you received the request.
Does it fill in details I did not give it?
No. Retention periods, vendors, legal bases, and transfer safeguards you did not mention appear as suggestions or as items marked to confirm, listed at the end. It cites laws by article or section and checks regulator guidance when a point is uncertain.
What does it not do?
It does not search your systems unless they are connected, delete anything, or give legal advice. A privacy professional or qualified attorney should review the result before you rely on it or send it.
Is this privacy policy generator free?
Yes. You can draft privacy documents on the free plan. Paid plans raise the usage limits and include more credits for Premium mode.