[Company], Inc.: every system, classified against the statute's own test
Service provider requires an actual contract restricting the vendor to your own purpose. An ad platform that can use the data for its own targeting is a sale or a share.
System
Classification
Contract Restricts to Our Purpose?
Disclosure Required
—
—
—
—
—
—
—
—
—
—
—
—
What a Yes/No questionnaire cannot show
Generic question
"Do you share data with third parties?" answered once, for the whole business
Processor Register
Each system checked against its own actual contract, one row at a time
Classify each new system, ad pixels included, before it goes live, and recheck it when the vendor's terms change.
Page 1 of 1119 words100%
How to write a privacy policy for a small business
A small business privacy policy is a public notice that tells customers what personal information you collect and why you use it. It says which companies receive that information, how long you keep it, and how people can ask to see or delete it. A good one is written from a list of every tool that touches customer data, and it promises nothing your business doesn't actually do.
Make the list first and write the policy second. A policy written first describes the business you meant to run. One written from the list describes the tools you actually installed.
Every order you ship passes customer details through several tools. Photo: Bench Accounting on Unsplash
California's broader law, the CCPA, covers for-profit businesses that do business in the state and meet at least one of three tests2:
Gross revenue over $26,625,0003 in the previous calendar year (the figure since 2025, adjusted for inflation every two years)
Buying, selling or sharing the personal information of 100,000 or more consumers or households a year
Earning at least half your annual revenue from selling or sharing personal information
Several other states have similar laws with their own tests, so check the rules where your customers live. Your tools can require a policy too: Google's Analytics terms say you must post one4 that discloses your use of Google Analytics and how it collects and processes data.
What each rule asks of your policy
Rule
Who it covers
The main things to cover
CalOPPA
Commercial sites and online services collecting personal information about Californians
What you collect, who you share it with, how you announce changes and the effective date. Whether other companies may track visitors through your site, and your response to Do Not Track signals if you track people across sites
CCPA
For-profit businesses that meet any of the three tests
Each right and how to use it, and the kinds of data you collected, sold or shared in the past 12 months, updated at least yearly
List every tool that touches customer data
The Federal Trade Commission's guide to protecting personal information opens with the same step: take stock of the personal information you have5 and where it is kept. Follow one order from first visit to delivery, and note every company that sees the customer's details.
Next, look for tracking tags, even if you're sure you don't share data: a Meta Pixel, a Google Ads or Analytics tag, a TikTok pixel, a heatmap or chat widget. An ad tag rarely feels like sharing data, so it's the easiest system to leave off. Check the site's tag manager and installed apps, or ask whoever built the site.
For each tool you find, write down:
The vendor, and what it does for you
What it receives: names, emails, addresses, payment details, device IDs or browsing events
Whose data it is: customers, subscribers or every site visitor
How long it keeps the data, and whether you can delete one person's record
Whether you signed a data processing agreement or just accepted standard terms
Sort service providers from sales
Under the CCPA, a service provider2 is a vendor whose written contract limits it to work it does for you and bars it from selling or sharing the data. Paying a vendor doesn't make it one; the contract does.
Giving data to anyone else for money or other valuable consideration is a sale. Giving it for ads targeted on what people do across other sites and apps is sharing, even when no money changes hands.
Valuable consideration doesn't have to be cash. In 2022, California's Attorney General said Sephora's arrangement with companies running tracking software on its website and app was a sale. Sephora benefited in kind, through better targeting of potential customers. The settlement required it to pay $1.2 million in penalties6 and to say in its privacy policy that it sells data.
Telling the two apart
Service provider
Sale or share
The contract
Limits the vendor to work it does for you
Lets the vendor use the data for itself, or there is none
Common examples
Often payment, shipping and help desk tools
Ad pixels whose platforms use the data for their own targeting
Write the policy from your list
Draft in the order a reader looks for answers. Cover what you collect and why, who gets it and how long you keep it. Then cover people's rights, how you announce changes, the effective date and how to reach you. California's Attorney General recommends plain, straightforward language, short sentences and the active voice1.
Name your vendors, or at least the kinds, in two groups: service providers, and anyone you sell to or share with. A CCPA business that sells or shares data must let people opt out, usually through a "Do Not Sell or Share My Personal Information" link. California's Attorney General says it must also treat a browser's Global Privacy Control signal6 like a click on that link.
ExampleOne blanket sentence, rewritten from the listAn illustrative example written for this guide
Before: We do not sell or share your personal information.
After: Service providers run our store, take payments, send our emails and ship orders, and their contracts limit them to that work. We also use advertising pixels from Meta and Google, which may use what they collect for their own advertising. Under California law, that counts as selling or sharing. You can opt out on our "Do Not Sell or Share" page, or by turning on Global Privacy Control in your browser.
It matches the list. Every claim traces back to a row in the inventory.
It names the sharing. The pixels get their own sentence and an opt-out, not a denial.
Keep the policy true after you publish
Each rights request starts a clock. Under the CCPA you have 45 days from receipt2 to answer a request to see, correct or delete data. When it's reasonably necessary, you can extend once by 45 more days, if you tell the person within the first 45. Checking their identity doesn't pause the clock, so log each request the day it arrives, even one sent by plain email.
Check that your opt-out tools work. In 2025, California's privacy agency fined the clothing retailer Todd Snyder $345,1787. The company's privacy portal hadn't processed opt-out requests for 40 days, the agency said, and people had to verify their identity before opting out. The agency's enforcement head, Michael Macko, said businesses should check that their privacy tools work as intended, "because the buck stops with the businesses that use them."
Review the list whenever you add or drop a tool or a vendor changes its terms, and put a yearly review on your compliance calendar.
Write the breach plan now as well: who contains the problem, who works out what was exposed, and which states' notice rules apply. A security incident response plan covers the technical side.
When to bring in a lawyer
This guide covers US rules in general and isn't legal advice. Have a privacy lawyer review your policy if you might meet the CCPA tests, handle health, financial or children's data, or have had a breach.
Before you publish
Every tool that touches customer data is on the list, tracking tags included
Each vendor is marked service provider or sale or share, with the contract term behind it
Each sale or share is named in the policy, with an opt-out that works
The policy has an effective date and a way to contact you
The next review is on the calendar
To start from a draft, the privacy policy generator writes one from the tools you list. Or open this template with Edit with AI, and River builds the inventory and register with you before it drafts a word.
How to use this template
Use the files as they are, or open them in River. River asks for every tool that touches customer data, naming ad and analytics tags in its questions, and builds the Data Inventory. It asks whether each vendor's contract limits it to your purposes, sorts each one in the Processor Register, and drafts the policy only once both sheets are complete.
Afterward it suggests next steps from what the sheets show, such as a request close to its deadline or an ad tag the policy doesn't name yet.
1
Download it or open it in River
Get the three Word documents and three CSV sheets free, or open the template in River and work through it with AI.
2
List every tool
Fill in the Data Inventory: each system that touches customer data, what it receives, whose data it is and how long it's kept.
3
Sort each vendor
In the Processor Register, mark each one a service provider or a sale or share, with the contract term that decides it.
4
Draft it and keep it current
Write the policy from the register, log every request against its deadline, and revisit the list whenever you add a tool.
What's in the template
Every sheet in the pack, filled in for one companyWhat actually touches customer data, how each system is classified, the policy language that follows, and every request against its deadline.
Small Business Privacy Policy Template
Data Inventory
Arial10
A1fx
Data Inventory
Fernbrook Home Goods. 6 of 8 systems shown.
System
Vendor
Personal Data Touched
Purpose
Store platform
Shopify
Name, address, email, order history
Hosts the storefront and every order record
Payment processing
Shopify Payments
Card token, billing address
Authorizes and settles checkout
Email marketing
Klaviyo
Email, purchase and browsing history
Campaign and abandoned-cart email
Customer support
Gorgias
Email, order history, message content
Live chat and ticketing
Ad retargeting
Meta Pixel + Custom Audiences
Hashed email/phone, device ID, page events
Matches visitors to Meta accounts for ads
Ad remarketing
Google Ads remarketing tag
Device ID, page and purchase events
Builds remarketing audiences
Eight systems total. The two flagged rows are the ones a "do you use analytics" checkbox usually misses as a sale.
Processor Register
Arial10
A1fx
Processor Register
Same eight systems, classified against the statute's own test. 5 of 8 rows shown.
System
Classification
Contract Restricts to Our Purpose?
Disclosure
Shopify
Service provider
Yes
Named, no opt-out needed
Klaviyo
Service provider
Yes
Named, no opt-out needed
Gorgias
Service provider
Yes
Named, no opt-out needed
Meta Pixel + Custom Audiences
Sale or share
No
Opt-out required, incl. Global Privacy Control
Google Ads remarketing tag
Sale or share
No
Opt-out required, incl. Global Privacy Control
6 of 8 systems are service providers. The 2 that are not, a quarter of the inventory, are the same kind of arrangement the California Attorney General treated as a sale in its $1.2 million Sephora settlement.
Privacy Policy
Calibri11
Privacy Policy, Section 3
Drafted from Processor Register, not from a blanket denial.
Service providers. Shopify, Shopify Payments, Klaviyo, Postscript, Gorgias and ShipStation each operate under a contract restricting them to our own purposes. This is not a sale or a share.
Sale or share. A Meta Pixel and Custom Audiences integration, and a Google Ads remarketing tag, each receive data used for their own ad targeting. You may opt out of both below, including through an automatic browser opt-out signal.
The generator-built version of this section read "we do not sell or share your personal information," full stop. It was inaccurate for two of eight systems the day it went live.
Request Log
Arial10
A1fx
Request Log
6 requests logged. One found on retroactive review, from before this log existed.
Type
Received
Due (45 days)
Completed
Status
Deletion
03 Nov
18 Dec
22 Jan
Extended to 90 days, notice sent in time
Access
14 Sep
29 Oct
20 Oct
On time
Opt-out
01 Dec
Immediate
03 Dec
Meta and Google suppressed
Deletion
02 Jun
17 Jul
15 Aug
74 days, no extension ever sent
The bottom row predates this log: handled by email, no due date ever calculated, closed 29 days past a deadline nobody knew it had.
Data Inventory sheetEach system that touches customer data, with its vendor, the data it receives, purpose, hosting and retention.
Processor Register sheetEach system marked service provider or sale or share, with the contract basis and any opt-out needed.
Privacy PolicyThe customer-facing policy in ten sections, with service providers and any sale or share named separately.
Data Handling ProcedureInternal rules: classify a tool before it goes live, review vendors twice a year, delete on schedule.
Request Log sheetEvery access, deletion and opt-out request, with the date received, its due date and any extension.
Breach Response PlanWhat to do on discovery, how to find each affected state's notice deadline, and what notices must say.
Common questions
Does a small business need a privacy policy?
In the US, usually yes, if you have a website or app. California's online privacy law requires one from any commercial website or online service that collects personal information about Californians, and an email address counts. Google Analytics also requires one in its terms. The law expects you to do what your policy says, so keep it accurate.
What should a small business privacy policy include?
It should say what personal information you collect and why, which companies receive it, and how long you keep it. It should also cover people's choices and rights, how you announce changes, the effective date and how to contact you. If the CCPA applies, explain how to use each right and, if you sell or share data, how to opt out.
Does a Meta Pixel or Google Analytics count as selling data?
It can, if the CCPA applies to you. When a platform may use the data for its own advertising and no service-provider contract limits it, passing data for ad targeting is sharing, even with no money paid. California's Attorney General treated Sephora's tracking arrangements as a sale in a $1.2 million settlement in 2022.
How long do I have to answer a request to delete data?
Under the CCPA, 45 days from the day the request arrives, even if you're still checking who sent it. You may take one 45-day extension when it's reasonably necessary, if you notify the person before the first 45 days end. Other states' privacy laws set their own deadlines, so look up the law in the person's state.
Is this privacy policy template free?
Yes. Download the three Word documents and three CSV sheets with no signup. The sheets come filled in for a made-up home goods store, so you can see how they work before clearing them, and the documents have bracketed prompts to replace. Edit with AI opens the same template in River.
What does Edit with AI do?
It opens the template in a free River workspace. River asks which tools touch customer data, ad and analytics tags included, and builds the Data Inventory. Then it sorts each vendor by what its contract allows. Only after that does it help draft the policy, and it won't keep a blanket "we don't sell your data" line if any tool is a sale or share.
Do I need a lawyer to write a privacy policy?
Not always, and this template isn't legal advice. A small business with a simple setup can write an accurate policy from its own inventory. Ask a privacy lawyer to review it if you may be covered by the CCPA, collect health, financial or children's data, sell abroad, or are dealing with a breach.
Sources
1
California Attorney General. “Making Your Privacy Practices Public: Recommendations on Developing a Meaningful Privacy Policy.” oag.ca.gov (opens in a new tab)
California Attorney General. “Attorney General Bonta Announces Settlement with Sephora as Part of Ongoing Enforcement of California Consumer Privacy Act.” oag.ca.gov (opens in a new tab)
7
California Privacy Protection Agency. “CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine, Overhaul Privacy Practices.” cppa.ca.gov (opens in a new tab)
CS
Written by
Chandler Supple
Co-founder & CEO, River
Chandler has spent the last six years working in AI, building tools for millions of users and Fortune 100 companies. In 2025, he co-founded River to build a new kind of operating system for AI agents.
Small Business Privacy Policy Template