Privacy policy page exists

GDPR Article 13, CCPA §1798.100, and Brazil's LGPD Article 9 all require that users be informed about data collection before or at the time their data is collected. Any application that uses analytics, session cookies, contact forms, or authentication collects personal data — which triggers mandatory disclosure requirements. Operating without a privacy policy exposes the business to regulatory fines (GDPR penalties reach 4% of global turnover) and removes the legal basis for processing user data at all. Courts and regulators treat absence of a privacy policy as evidence of willful non-compliance.

Create a route at /privacy or /privacy-policy and link it from your site footer. The policy must disclose what data is collected, why, how long it's retained, and how users can request deletion.

// app/privacy/page.tsx — required disclosure page
export default function PrivacyPage() { /* policy content */ }

// components/footer.tsx
import Link from 'next/link'
<Link href="/privacy">Privacy Policy</Link>

For a SaaS with EU users, include: legal basis for processing under GDPR Art. 6, data subject rights (access, erasure, portability), third-party processors (Stripe, Vercel, analytics vendors), and data retention periods. Services like Termly or Iubenda generate jurisdiction-appropriate policy text if writing from scratch is impractical.