luckpanda
Start free
English
Free tool

Privacy policy generator for your website, with an AI chat clause

Tell the generator who you are, what data your website collects and which services you use. It drafts a plain-language privacy policy that follows the data-protection notes for your country, adds a clause for your website chat, and writes a short FAQ your chatbot can answer from.

The draft follows this country's data-protection notes. Serving people in other countries too? Check the table under the tool.

Leave it empty and the draft leaves a slot for you to fill. Nothing is invented.

Analytics, payments, email, booking, hosting, chat. The draft names only the services you list.

Website chat

Yes adds a section on what the chat collects and that an AI model writes the answers.

The email or form people use to ask about their data.

ResultExample
Your privacy policy
Privacy Policy for Cedar Lane Pilates Who we are Cedar Lane Pilates runs the website cedarlanepilates.com. If you have a question about this policy or your personal information, email privacy@cedarlanepilates.com. What personal information we collect - Your name, email and phone number when you book a class. - Payment details at checkout. These go straight to our payment provider; we do not store your card number. - Your email address if you sign up for our newsletter. - Information about the pages you visit, collected by our analytics tool. - What you write in our website chat (see "Website chat" below). How we use it - To book your classes and send confirmations and reminders. - To take payment. - To send our newsletter, if you signed up. You can unsubscribe at any time from any newsletter email. - To understand how our website is used and improve it. - To answer your questions. Cookies and similar tools Google Analytics uses cookies to tell us which pages are visited and how people find our site. Other companies, such as Google, may collect information about your activity across different websites over time when you use our site. Our website does not respond to browser "Do Not Track" signals [check and change this if it does]. Who we share it with - Stripe, to process payments. - Mailchimp, to send our newsletter. - Google Analytics, to measure how our website is used. - [chat provider], to run our website chat. We do not sell your personal information. Website chat When you use the chat on our website, we collect your messages, any details you share (such as your name or email) and the page you were on. Answers in the chat are written by an AI model using information from our own website and documents, and they can be wrong. A member of our team may read the conversation to help you. The chat provider handles your messages on our behalf. We keep chat conversations for [how long you keep chats]. Please do not share card numbers or passwords in the chat. How long we keep your information We keep booking and payment records for [how long you keep this data] and newsletter details until you unsubscribe. Your choices To see, correct or delete the personal information we hold about you, email privacy@cedarlanepilates.com. We will tell you if we need to keep something, for example a payment record. [If the California Consumer Privacy Act applies to you: add the rights to know, delete, correct, opt out of sale or sharing and limit sensitive information, two ways to send a request, and the categories of information you collected in the last 12 months.] Children Our website is not directed to children under 13, and we do not knowingly collect their personal information. Security We use reasonable measures to protect your information, such as limiting who can access it. No website or online service can be completely secure. Changes to this policy If we make a material change, we will post the new policy on this page and update the date below. Last updated: [date]
Chatbot FAQ
Q: What personal information do you collect? A: Your name, email and phone when you book, payment details through our payment provider, your email if you join the newsletter, pages visited, and what you write in our chat. Q: Do you sell my information? A: No. We share it only with the services that help us run the studio, such as Stripe for payments and Mailchimp for the newsletter. Q: Is the chat answered by a person? A: An AI model writes the answers from our own website and documents. A member of our team may read the conversation and can take over. Q: How do I get my information deleted? A: Email privacy@cedarlanepilates.com. We will delete what we can and tell you if we need to keep anything, such as a payment record. Q: How do I stop the newsletter? A: Use the unsubscribe link in any newsletter email, or email privacy@cedarlanepilates.com.

This is a draft, not legal advice: check it against the data-protection law where you and your visitors are before you publish it. Written by AI. Read it before you send it.

Quick answer

What a privacy policy for a website must say

A privacy policy tells visitors who you are, what personal data your website collects, why, on what legal basis where the law asks for one, who you share it with, how long you keep it, and how people can see, correct or delete their data. If a chatbot reads visitor messages, say so too. Laws differ by country and some apply only above a size threshold. This is general information, not legal advice.

  1. Describe your businessEnter your business name, your website and the country you operate from. The draft follows that country's data-protection notes.
  2. List the data and the servicesWrite what your site collects (contact forms, orders, newsletter sign-ups) and the services that touch it: analytics, payments, email, hosting, chat.
  3. Say whether you have a website chatChoose Yes if visitors can chat on your site. The draft adds a section on what the chat collects and that an AI model writes the answers.
  4. Review, then publishFill every [square-bracket] slot, check the draft against the country notes below, link the policy in your footer and next to every form, and paste the FAQ into your chatbot.

Here is the shape of a short privacy policy template for a small US website. Each heading answers one question a visitor or a regulator asks. Keep the order; replace the slots with what is true for you.

Privacy policy template (outline)
Privacy Policy for [business name]

Who we are
[Business name] runs [website]. Questions about this policy: [privacy contact].

What we collect
- [list the data you collect, e.g. name and email from the contact form]

How we use it
- [each purpose, e.g. to answer your message, to deliver your order]

Who we share it with
- [each service by name, and what it does for you]

How long we keep it
[retention period, or how you decide it]

Your choices and rights
Contact [privacy contact] to ask what we hold about you, or to correct or delete it.

Changes to this policy
We will post any change on this page and update the date below.

Last updated: [date]

Link the policy from every page footer and next to each form that collects personal data.

Privacy rules by country

The main law, the regulator and what a website privacy policy must cover in each market the generator knows. The draft follows the row for the country you pick.

CountryMain law and regulatorWhat the policy must coverCheck for your business
United StatesNo single federal law. California Online Privacy Protection Act (CalOPPA); California Consumer Privacy Act (CCPA, as amended by the CPRA); COPPA; FTC Act section 5.CalOPPA, for sites collecting data from California residents: categories of data and of third parties, how to review or change data, how changes are announced, the effective date, how you respond to Do Not Track, and whether others track users across sites.The CCPA applies only above a threshold: revenue over $26,625,000, data of 100,000 or more consumers or households, or half your revenue from selling or sharing data. COPPA if your site targets children under 13. Other states' laws.
United KingdomUK GDPR and the Data Protection Act 2018. Regulator: the ICO.Who you are, purposes and lawful basis, retention, rights (access, rectification, erasure, restriction, objection, portability), the right to complain to you and to the ICO, recipients, transfers, automated decisions.Cookie consent, with narrow exceptions such as analytics used only to improve your site. A data protection officer only in some cases. Under 13s need a parent's consent.
European UnionGeneral Data Protection Regulation (EU) 2016/679. One supervisory authority per member state.The GDPR article 13 list: identity and contact, purposes and legal basis, recipients, transfers outside the EU and their safeguards, retention, six rights, withdrawing consent, complaining to an authority, automated decisions.An EU representative if you are outside the EU and serve people there. A data protection officer only in some cases. Consent for non-essential cookies. Parental consent below 16, or a lower national age.
GermanyGDPR, plus the Federal Data Protection Act (BDSG) and the TDDDG. Regulator: the data protection authority of your federal state.Everything the GDPR lists.A data protection officer if 20 or more people regularly process personal data automatically. Consent for cookies unless strictly necessary (section 25 TDDDG).
FranceGDPR, plus Loi Informatique et Libertés (78-17). Regulator: the CNIL.Everything the GDPR lists. Information for minors in words they understand.Minors consent alone from 15. Cookie consent, where refusing must be as easy as accepting.
SpainGDPR, plus Ley Orgánica 3/2018 (LOPDGDD) and the LSSI. Regulator: the AEPD.Everything the GDPR lists; it may be layered, with the basic information first and a link to the rest.Minors consent alone from 14. Cookie consent unless strictly necessary. An unsubscribe address in commercial emails.
IndiaDigital Personal Data Protection Act, 2023 and DPDP Rules, 2025. Regulator: the Data Protection Board of India.A standalone, plain notice: an itemised list of data and the purpose, how to withdraw consent, how to use your rights, how to complain to the Board. Contact for questions; a grievance process.The Rules phase in: most duties, including the notice rule, 18 months after November 2025. Children are under 18 and need verifiable parental consent.
BrazilLGPD (Lei 13.709/2018). Regulator: the ANPD.Purpose, form and duration, controller identity and contact, sharing, responsibilities, and the article 18 rights. The data protection officer's (encarregado) contact.Small processing agents need not appoint an encarregado but must give a contact channel. Transfers abroad only in listed cases.
MexicoFederal law on personal data held by private parties. Authority: the Secretaría Anticorrupción y Buen Gobierno.A privacy notice (aviso de privacidad). We could not read the official text of the current law, so the draft stays general.Check the current law and the authority's guidance before you publish.
Saudi ArabiaPersonal Data Protection Law (Royal Decree M/19, amended by M/148) and its Implementing Regulations. Complaints: SDAIA.A privacy policy available before collection: purpose, data, how it is collected, stored and destroyed, rights and how to use them; plus legal basis, mandatory or optional data, recipients, transfers abroad, retention and how to withdraw consent.Transfers outside the Kingdom only for allowed purposes. A data protection officer only in some cases. Marketing needs prior consent.
United Arab EmiratesFederal Decree-Law No. 45 of 2021, in force since 2 January 2022. Regulator: the UAE Data Office.Purposes, recipients inside and outside the UAE, safeguards for processing abroad; on request, data types, retention, automated decisions and how to complain.Free-zone companies with their own data protection law follow that law instead. No general legitimate-interest basis. Confirm whether the Executive Regulations are in force.
SwitzerlandFederal Act on Data Protection (FADP), revised, in force since 1 September 2023. Regulator: the FDPIC.Identity and contact, purpose, recipients, and for disclosure abroad the country and safeguards. No GDPR-style list of legal bases.A Swiss representative only for large-scale, regular, high-risk processing by a foreign business.
CanadaPIPEDA. Regulator: the Office of the Privacy Commissioner. Quebec: Law 25 and the Commission d'accès à l'information.Who is accountable and how to reach them, how to get access, what you hold and how you use it. Quebec: the person in charge, governance policies and a plain-language privacy policy.Alberta, British Columbia and Quebec have their own laws. Quebec: tracking or profiling off by default; an assessment before sending data outside Quebec.
ArgentinaLey 25.326. Regulator: the AAIP.Purpose and recipients, the database and who runs it, whether answers are optional, the consequences of not answering, access, rectification and deletion.Some databases must be registered with the AAIP. Transfers only to countries with adequate protection.
ColombiaLey 1581 de 2012 and Decreto 1377 de 2013. Regulator: the SIC.A data processing policy: your contact details, the processing and purpose, rights, who handles requests and how, the effective date and how long the database is kept.Prior, express authorisation. Some databases must be registered in the national register.
EgyptPersonal Data Protection Law No. 151 of 2020.We could not read the official text, so the draft stays general.The ministry says the law requires licences, permits and approvals to collect and process personal data. Check before you publish.
RussiaFederal Law No. 152-FZ "On Personal Data".A published policy on processing personal data, on the pages where you collect it: data, purposes, methods, storage periods, destruction, and people's rights.Data of Russian citizens may not be stored or processed in databases outside Russia. Notify the authority before processing and before transfers abroad. Consent separate from other documents since 1 September 2025.
Other countriesNo law named.A general policy: who you are, what you collect and why, sharing, retention, how to see, correct or delete data, and how to complain.Check your own country's law and those of the countries your visitors are in.

Facts checked against the official texts and regulator pages listed below on 14 October 2026. This is a short summary, not legal advice: each law has more detail than fits here, and laws change. Check the source or ask a lawyer before you publish.

The AI chat clause: what to tell visitors about your website chat

A chat box collects personal data the moment a visitor types a name, an email or an order number. If an AI model writes the answers, your policy should say so in plain words.

  • What the chat collects: the messages, any contact details the visitor gives, and the page they chatted from.
  • What it is for: answering questions, and passing the conversation to a person when needed.
  • That an AI model writes the answers from your own website and documents, and can make mistakes.
  • That people on your team may read the conversation.
  • Which company runs the chat for you, named with your other service providers.
  • How long you keep chats, and how a visitor asks you to delete one.
  • A line asking visitors not to type passwords, card numbers or health details into the chat.
AI chat clause (example)
Website chat
When you use the chat on our website, we collect your messages, any details you choose to share (such as your name or email) and the page you were on. We use them to answer your question and, if needed, to pass your conversation to a member of our team.

Answers in the chat are written by an AI model using information from our website and documents. They can be wrong; for anything important, ask to speak to a person. Our team may read chat conversations to help you and to improve our answers.

The chat is provided by [chat provider], which processes your messages on our behalf. We keep chat conversations for [how long you keep chats]. To ask us to delete a conversation, contact [privacy contact].

Please do not share passwords, card numbers or health information in the chat.

Choose Yes for "Website chat" in the tool and this section is written for you.

Set the retention period to one you actually keep. If your chat tool cannot delete a single conversation on request, say how you handle the request instead of promising deletion.

Common mistakes in privacy policies

  • Copying another site's policy. It lists their services and their data, not yours, and promises things you may not do.
  • Listing services you do not use, or leaving out ones you do. The sharing section should match your site today.
  • Saying "we never share your data" while using analytics, payment or email providers.
  • Promising that data is "100% secure". Describe what you do; never guarantee it.
  • Claiming the policy is "GDPR compliant". A policy is one part of compliance, not proof of it.
  • Leaving out a way to contact you. Every right in the policy needs a place to use it.
  • Forgetting the chat. If visitors type into a chat box, the policy should cover it.
  • Never updating the date. Change "Last updated" each time you add a service or change how you use data.

Let an AI agent answer privacy questions from your policy

Visitors ask the same privacy questions before they share an email or place an order: what do you keep, who sees it, how do I delete it. A support agent can answer them from the policy you publish.

A support agent answering from a studio's privacy policy page

If I book a class, who sees my details?
Your name, email and phone go to our booking provider so it can confirm your class, and to our team. We do not sell your details. The full list of services we use is in our Privacy Policy.
From the page: Privacy Policy
Do you keep this chat?
Yes. Our policy says chat conversations are kept for 12 months so our team can follow up. You can ask us to delete yours by emailing privacy@cedarlanepilates.com.
From the page: Privacy Policy
Please delete everything you have on me.
I have passed your request to the team. They will reply by email to confirm once it is done.
Handed to a person: data request

LuckPanda builds the agent from your own website pages, so it answers from your published policy instead of guessing, and you can paste the chatbot FAQ from this tool as FAQ entries. Every chat is kept in History, with the transcript and the visitor's details, so your team can follow up a request. Deleting a single chat from the app is not available yet, so write a retention line you can keep and handle deletion requests by hand.

Answer privacy questions on your website

Build a support agent from your site that answers questions from your privacy policy, and hands data requests to your team.

See the AI customer service agent

Questions people ask

Do I need a privacy policy on my website?

If your website collects personal data, such as a contact form, a newsletter sign-up, orders or analytics, most data-protection laws expect you to tell people about it, and a privacy policy is the usual way. Some laws apply only above a size threshold, so check the rules for your country on this page.

Is a free privacy policy generator good enough?

It gives you a clear first draft built from what you enter, so it lists your real data and services. It does not know everything about your business and is not legal advice: fill the slots, check the rules for each country you serve, and ask a lawyer if you handle sensitive data.

Can I copy another website's privacy policy?

Do not. It describes their data, their services and their promises, so it will be wrong for your site and may promise things you do not do. Write your own from what your website actually does.

Does my privacy policy need to mention my chatbot?

If visitors can type messages, names or emails into a chat on your site, yes: say what the chat collects, that an AI writes the answers if it does, who provides it, who can read the chats and how long you keep them.

What is the difference between a privacy policy and a cookie notice?

A privacy policy explains all the personal data you handle. A cookie notice or banner covers cookies and similar tools on the device, and in places such as the EU and the UK it is where you ask for consent to non-essential cookies.

Keep reading

Related pages

For AI agents

Build it with your AI agent

Give an agent your site and it can create the chatbot, read your pages and test it through LuckPanda's API and MCP. It prepares the work; going live stays with you.

Use LuckPanda's MCP server (https://luckpanda.app/mcp) to build a website chatbot for me. Ask for my website address, call chatbot_create_from_website with it, wait until the pages are learned (chatbot_source_list), then run a few test questions with chatbot_test_message and show me the answers. Do not put it live: I will do that myself.

Instructions for AI agents

Needs a LuckPanda agent key (Settings › Developers) with the chatbot.manage grant. MCP endpoint: https://luckpanda.app/mcp (Streamable HTTP, bearer key).

  • chatbot_create_from_website { url }: creates a draft chatbot named after the site and starts reading it.
  • chatbot_source_list: pages learned, failed or skipped, with a reason for each.
  • chatbot_test_message: asks the bot a question as the owner. Test chats never email anyone.
  • Going live (chatbot_update with status live) is a person's action; an agent gets APPROVAL_REQUIRED.

Try it on your website

Paste your address and watch the chatbot learn your pages. No account and no card.

This page in other languages