Generate your Privacy Policy for free, Get started now →
Twenty states now have a comprehensive privacy law, and each one runs a different applicability test. Here's the actual decision framework for figuring out which ones cover your business.
Read article
GDPR Article 6 lists six lawful bases for processing. Consent and legitimate interest are the two most reached for, and the two most often picked wrong.
Read article
GDPR's storage limitation principle does not set a fixed number of years. Here is what the law actually requires, plus a worked retention schedule you can adapt.
Read article
Donor records, mailing lists, and donation processors all need disclosure. Here's how to write a privacy policy that matches how nonprofits actually collect data.
Read article
GDPR doesn't require an EU office or EU revenue to apply. Here's the actual Article 3 test that decides whether a US-only business is in scope.
Read article
No-card free trials collect data before anyone becomes a paying customer. Here's how to disclose trial signup, product usage tracking, and conversion emails correctly.
Read article
A CCPA notice at collection and a full privacy policy are not the same document. Here's what each one has to say, where it has to appear, and when you need both.
Read article
GDPR and CCPA use completely different tests for who has to comply. Here's how each law actually decides if your business is covered, with the real threshold numbers.
Read article
The right to erasure isn't unconditional. Here's what GDPR Article 17 actually requires you to delete, the statutory exceptions that override it, and how backups and logs fit in.
Read article
The CCPA opt-out link isn't required on every website. Here's exactly what triggers the requirement, what changed under the CPRA, and where the link has to go.
Read article
A GDPR data subject access request starts a clock the moment it arrives, not when you get around to it. Here's the response process, the 30 day deadline, and what the reply must actually contain.
Read article![5 SaaS Marketplaces Require a ToS: No Census Exists [2026]](/_astro/what-percentage-of-saas-firms-publish-tos.BCZP1OBm_j5eCz.webp)
No independent, randomized audit has measured what share of SaaS companies publish a Terms of Service page as of 2026. What is verifiable: at least 5 of the largest SaaS distribution and marketplace channels, including Apple's App Store, Google Play, and AWS Marketplace, require a published Terms of Service or EULA before they will list a product.
Read article
14 real End User License Agreements from major software companies, grouped by pattern, with notes on what each one gets right and where the approach actually differs from a template.
Read article
The law that triggers a cookie consent banner doesn't actually say the word cookie. Here's how to tell whether your site genuinely needs one, or just thinks it does.
Read article
Only 64% of small businesses with 1-19 employees have a documented internal privacy policy for staff, versus 87% of businesses with 100 or more employees, according to the Office of the Privacy Commissioner of Canada's 2025-26 survey. See the compliance gap, breach exposure, and cost data behind it.
Read article
A section-by-section breakdown of a real privacy policy: what each part legally needs to say, why it exists, and how it should read.
Read article
GDPR requires opt-in consent before cookies load. CCPA/CPRA requires an opt-out link instead. Here's what each law actually demands, side by side.
Read article
A breakdown of the seven key principles that form the foundation of the GDPR, and what you need to do to comply with each one.
Read article
A practical checklist for GDPR compliance: from auditing your personal data collection to appointing a Data Protection Officer.
Read article What GDPR compliance means for your privacy policy: the key principles, individual rights, and how the regulation applies to your business.
Read article