Privacy policy

Draft for review — not yet legal advice

This is an initial proposal and must be reviewed by the business and its legal counsel before launch. It does not claim full compliance with any law. Items marked like this are placeholders that need confirmation:

  • Legal name and business entity type of the company that operates this website
  • Registered business address and a privacy contact email address
  • Whether the California Consumer Privacy Act (CCPA/CPRA) applies to the business, and which other privacy laws apply
  • Retention period for contact form messages
  • Hosting provider and any other service providers that process data
  • Whether analytics, advertising or other cookies or trackers will be added
  • Instructions for submitting privacy requests (email address or web form) and the response procedure
  • Applicable privacy rights and any international transfer language

Version 2026-10-draft-1 · Last updated October 24, 2026

This Privacy Policy explains how [Legal business name] ("Brand X," "we," "us") handles personal information when you visit this website or send us a message through the contact form.

Brand X is a marketing company based in California, United States.

Who we are

The website is operated by [Legal business name and entity type], located at [Registered business address, California].

You can contact us about privacy at [Privacy contact email address].

Information we collect

We collect only what we need to answer your inquiry and keep the website secure.

  • Information you provide in the contact form: your name, email address, phone number and the message you write.
  • A record that you accepted this Privacy Policy, including the date and time and the version of the policy you accepted.
  • Technical information processed to protect the form from abuse: your IP address (used to limit repeated submissions) and the result of Google reCAPTCHA's risk analysis.

How we use information

[Confirm: whether the business sells or shares personal information, for example for cross-context behavioral advertising, and state it here.]

  • To read and reply to your message and to follow up on your request.
  • To prevent spam, fraud and abuse of the contact form and to keep our systems secure.
  • To keep records of your consent and to comply with legal obligations.

Service providers

We use the following providers to operate the contact form. They process information on our behalf and under their own terms and privacy policies:

  • Mailgun (email delivery): receives the contents of your message in order to deliver it to us.
  • Google reCAPTCHA v3 (spam protection): analyzes interactions with the form and the device or browser used, subject to the Google Privacy Policy and Terms of Service.
  • [Hosting provider and any other providers]

Cookies and similar technologies

The contact form loads Google reCAPTCHA, which may set cookies or use similar technologies for security purposes.

[Confirm whether analytics, advertising or other cookies are used, and update this section and the cookie notice accordingly.]

How long we keep information

We keep contact form messages for [retention period] unless we need to keep them longer to resolve a dispute, enforce our agreements or comply with the law. Security data such as IP-based rate-limit counters is kept in memory for a short period and is not stored permanently.

Your privacy choices and rights

[Confirm applicability: if the California Consumer Privacy Act (CCPA/CPRA) applies to the business, describe the rights to know, delete, correct, and limit use of sensitive personal information, the right to opt out of sale or sharing, and the right not to be discriminated against.]

To make a privacy request, contact us at [Privacy request email address or web form]. We may need to verify your identity before responding. [Describe response timeframes and the authorized-agent process.]

California "Shine the Light" requests and requests under other applicable laws can be sent to the same address. [Confirm.]

Do Not Track and Global Privacy Control

[Describe how the website responds to Do Not Track and Global Privacy Control signals.]

Children's privacy

This website is not directed to children under [age threshold, e.g. 16], and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it.

Security

We use reasonable technical and organizational measures to protect information, including encrypted connections, input validation and abuse protection. No method of transmission or storage is completely secure.

Visitors outside the United States

Information you submit is processed in the United States and by providers that may operate elsewhere. [Confirm and add transfer and rights language for visitors from the EEA, the UK or other regions, if applicable.]

Changes to this policy

We may update this policy from time to time. The version and date at the top of this page show when it was last changed.