Draft for review — not yet legal advice
This is an initial proposal and must be reviewed by the business and its legal counsel before launch. It does not claim full compliance with any law. Items marked like this are placeholders that need confirmation:
Version 2026-10-draft-1 · Last updated October 24, 2026
This Privacy Policy explains how [Legal business name] ("Brand X," "we," "us") handles personal information when you visit this website or send us a message through the contact form.
Brand X is a marketing company based in California, United States.
The website is operated by [Legal business name and entity type], located at [Registered business address, California].
You can contact us about privacy at [Privacy contact email address].
We collect only what we need to answer your inquiry and keep the website secure.
[Confirm: whether the business sells or shares personal information, for example for cross-context behavioral advertising, and state it here.]
We use the following providers to operate the contact form. They process information on our behalf and under their own terms and privacy policies:
The contact form loads Google reCAPTCHA, which may set cookies or use similar technologies for security purposes.
[Confirm whether analytics, advertising or other cookies are used, and update this section and the cookie notice accordingly.]
We keep contact form messages for [retention period] unless we need to keep them longer to resolve a dispute, enforce our agreements or comply with the law. Security data such as IP-based rate-limit counters is kept in memory for a short period and is not stored permanently.
[Confirm applicability: if the California Consumer Privacy Act (CCPA/CPRA) applies to the business, describe the rights to know, delete, correct, and limit use of sensitive personal information, the right to opt out of sale or sharing, and the right not to be discriminated against.]
To make a privacy request, contact us at [Privacy request email address or web form]. We may need to verify your identity before responding. [Describe response timeframes and the authorized-agent process.]
California "Shine the Light" requests and requests under other applicable laws can be sent to the same address. [Confirm.]
[Describe how the website responds to Do Not Track and Global Privacy Control signals.]
This website is not directed to children under [age threshold, e.g. 16], and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it.
We use reasonable technical and organizational measures to protect information, including encrypted connections, input validation and abuse protection. No method of transmission or storage is completely secure.
Information you submit is processed in the United States and by providers that may operate elsewhere. [Confirm and add transfer and rights language for visitors from the EEA, the UK or other regions, if applicable.]
We may update this policy from time to time. The version and date at the top of this page show when it was last changed.