Privacy policy covers all data types, purposes, retention, third-parties, user rights

GDPR Art. 13 and Art. 14 require controllers to provide data subjects with specific information at the point of collection, including retention periods, third-party recipients, legal basis for each processing purpose, and a description of user rights. CCPA §1798.100 and LGPD Art. 9 impose equivalent disclosure obligations for US and Brazilian users respectively. An incomplete or missing privacy policy is not a minor oversight — it is a standalone regulatory violation independent of any breach. Regulators in the EU, UK, and California treat absent or skeletal policies as evidence of systemic non-compliance, which increases penalties. ISO-27001:2022 A.5.34 requires that privacy notice obligations be documented and fulfilled.

Draft a policy that covers all seven required sections. A privacy policy generator (Iubenda, Termly) can scaffold the structure — customize it to match your actual data flows. Add a footer link to it on every page.

Required sections your policy must include:
1. Data collected — email, name, payment info, usage events, cookies
2. Purpose for each — contract/service delivery, analytics, marketing
3. Retention periods — account data: until deletion; analytics: 26 months; logs: 90 days
4. Third-party recipients — Stripe (payments), SendGrid (email), GA4 (analytics); include DPA links
5. User rights — access, deletion, correction, portability, opt-out of marketing
6. Legal basis — contract for service delivery; consent for newsletters; legitimate interest for fraud
7. Privacy contact — privacy@example.com or a web form

Link the policy in your root layout's footer so it appears on every page without authentication. Update within 30 days whenever you add a new third-party service or change a data handling practice.