Sample SaaS Privacy Policy Template

Last updated on 20 May 2022 by William Blesch (Legal and data protection research writer at TermsFeed)

In this article, we'll walk you through the basics and requirements of a SaaS privacy policy and answer the most common questions about what it should contain. We've also provided a sample SaaS Privacy Policy template to help you design and write your own.

1. What is a Privacy Policy?
2. Why Do SaaS Companies Need a Privacy Policy?
3. What Should a SaaS Privacy Policy Include?
3.1. Types of Personal Information You Collect
3.2. How You Collect and Use Information
3.3. How Personal Data May Be Used
3.4. With Whom You Share Data
3.5. How You Protect Personal Data
3.6. Data Retention: How it's Stored, and for How Long
3.7. Medical Data
3.8. Financial Data
3.9. Cookies
3.10. Business Transfers
3.11. Children Under 13
3.12. Contact Information Clause
3.13. Changes to Your Policy and Notifications About it
3.14. How to Display Your SaaS Privacy Policy
4. Summary of a SaaS Privacy Policy
5. Download Sample SaaS Privacy Policy Template
5.1. Sample SaaS Privacy Policy Template (HTML Text Download)
5.2. Sample SaaS Privacy Policy Template (PDF Download)
5.3. Sample SaaS Privacy Policy Template (DOCX Download)
5.4. Sample SaaS Privacy Policy Template (Google Docs)
5.5. More Privacy Policy Templates

What is a Privacy Policy?

More and more people use software as a service (SaaS) products in today's world. These products offer many advantages to the end user, including convenience and ease of use.

However, there is often a trade-off between what these services can provide and their ability to protect customer data. Although Facebook isn't a SaaS company, a good example of the kind of trade-off between delivering a service and protecting user data is a huge Facebook scandal which took place in 2013.

During that shocking incident, Cambridge Analytica, a British consulting firm, improperly gained access to millions of Facebook users' personal information without their consent or knowledge.

For this reason and others, a Privacy Policy is essential for any tech company that collects information about subscriptions and account services. That includes companies with a SaaS model.

Moreover, a SaaS Privacy Policy must be robust and transparent, providing customers with straightforward and easy-to-understand details on how the company protects personal data and more.

Privacy is a fundamental human right. With the advent of the internet, people share large amounts of their personal information online, sometimes unknowingly.

As an organization that collects personal information from its users (visitors), you should take every precaution to protect it by having a detailed and easily accessible Privacy Policy.

A Privacy Policy is a statement or legal document that discloses how an organization collects, uses, stores, and processes personal information. Keep in mind that you need to tailor your SaaS Privacy Policy to your specific business and website, but there are some common elements that all policies should include:

The types of personal information you collect from users
How you collect this information (directly from users or through third parties)
Why you're collecting it (for example, providing a service, improving user experience, market products/services, etc.)
How you use this information (including sharing with affiliates and third parties)
Your retention period for personal data
The rights of users with respect to their personal data

Why Do SaaS Companies Need a Privacy Policy?

An increasing number of countries are passing strict data privacy laws which require companies to have a Privacy Policy.

For example, the European Union's General Data Protection Regulation (GDPR) went into effect in 2016. The GDPR is applicable to companies that process data of individuals in the EU, regardless of whether the company is based inside the EU.

The United States has no single federal law that governs data privacy, but several states have adopted their own rules. For example, the California Consumer Privacy Act (CCPA) applies to any company that does business in California and collects personal information about California residents.

In addition to government regulations, many industry-specific standards apply to collecting and using personal data. For instance, the Payment Card Industry Data Security Standard (PCI DSS) applies to any company that "that accepts, transmits or stores any cardholder data."

So, it's not enough to have a Privacy Policy because you "should." Your SaaS company needs a Privacy Policy because it is legally required to have one.

What Should a SaaS Privacy Policy Include?

Your business's nature, your location, your customers, and the laws that apply to you, as well as any third-party services you use, will determine what you should include in your Privacy Policy.

At the same time, there are many ways to present your Privacy Policy, and there are various formats. But, there are particular things that you do absolutely need to include.

Let's take a look at some of the required, most important clauses.

Types of Personal Information You Collect

An essential clause that you must include lets users know what type of personal information you collect.

For example, perhaps you collect information like:

Name
Postal address
IP address
Geolocation
Email address
A Social security number
Credit card numbers
Usage of products and services
Device and browser information

Any or all of that data might be collected:

Upon registration
Automatically by an app
Received from third parties

The point is that your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.

Note how Adobe is transparent about all the types of data it collects from Cloud users:

Adobe Privacy Policy: What information does Adobe collect about me clause

Your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.

SaaS businesses generally collect three types of personal data:

Data provided by the user such as names, email addresses, payment details
Data collected by the software, for example, cookies or log data
Data collected by third parties. Most SaaS applications use third-party widgets to perform services on its website or app. These widgets may collect personal data from the SaaS's users or share personal data with the SaaS.

These categories are addressed separately in the Privacy Policy below for Emma, an email marketing SaaS. It explains how each type of data is collected and provides specific examples for each, so there can be no doubt in users' minds as to what data the company may collect from them:

Emma Privacy Notice: Information we Process clause

The point is that your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.

How You Collect and Use Information

This clause informs users about what happens after they have provided their personal data. Within it, you must describe every method you use to collect information about users, whether it's online or through automated backend procedures.

You should also explain your reasons for collecting this data. Users want to know why you're collecting it as well as how you will use it.

When explaining why you collect personal information, you should also provide information about the legal grounds you rely on to process that data, your retention schedule (how long you keep a user's personal data), and how users can request their data or have it deleted.

Salesforce discusses the methods it uses to collect data including the types of technology used in the process:

Salesforce Privacy Policy: What device and usage data do we process clause

How Personal Data May Be Used

To ensure you obtain informed consent from your users, your Privacy Policy should clearly explain how their data may be used. Again, this section should provide specific categories and examples, relevant to the nature of the service you provide.

You need to explain why it's necessary for your service to process personal data. It may be to contact users, deliver the service, or improve the service offered to them.

Oracle's Privacy Policy explains personal data may be used for both business and commercial purposes. It provides a detailed explanation of each purpose:

Oracle Privacy Policy: Why and How do we Use Your Personal Information clause excerpt

Being transparent with users about how their personal data may be used is an important feature of a Privacy Policy.

With Whom You Share Data

Your users should know about the people with whom you'll be sharing personal data. For the purposes of transparency, it's good practice to include an explanation of what data you share with third parties and why.

For instance, most SaaS companies use third-party software to perform certain services. This is typically done through a website or mobile app. Google Adsense is an example of a third party that provides analytics services.

If you're using a third party like Google Adsense to help with your services, be sure to disclose that fact within your SaaS Privacy Policy. You also must not forget to divulge whether or not you sell personal information to third parties.

Here's all the third-parties that Square (now Block) shares user data with:

Polte, a location system SaaS, sets out eight specific ways in which it may share user data with a third party:

As you can see, the list of bases on which you may share user data should be exhaustive and detailed.

How You Protect Personal Data

Any personal data collected from an individual should be kept safe and accessible only by authorized personnel. Whether you store that information locally or in the cloud, keep in mind that it's your responsibility to keep it secure.

With that in mind, you must be as transparent as possible about the security measures you've put in place to ensure data safety and what steps you'll take if a data breach ever occurs.

Providing users with this information is crucial when it comes to maintaining trust. Remember that many data breaches have taken place over the last few years, and those companies that had significant losses of information ended up facing severe financial and legal consequences.

Here's Datadog's statement on how it ensures the protection of personal information:

Datadog Privacy Policy: Security clause

Slack includes a broad, purposive clause regarding data protection measures in its Privacy Policy as well as a link to its security practices. Its security practices page then provides a very detailed description of all the steps Slack takes regarding data security:

Slack Privacy Policy: Security clause

Data Retention: How it's Stored, and for How Long

It is essential to have a data retention clause, especially for account management and subscriptions. This clause will outline users' rights regarding managing their own data and your rights to retain personal information to process it.

You should pay attention to that last sentence. You have a right to keep personal data, but according to the GDPR, it's literally "for no longer than is necessary for the purposes for which the personal data are processed."

That means you can't keep it forever. So, you need to be as upfront and forthcoming as possible when letting users know how long you actually need to keep each type of data you store.

In practical terms, this may mean you need to draw up a "retention schedule" and outline that in your SaaS Privacy Policy.

Specifics you can mention in this clause include things like:

Where you store personal data and how users can access it to see or modify details
Users' right to delete their personal data or accounts, and how this may affect their access to future services
Your right to delete accounts if users do not comply with your own requirements for the use of services
The necessity of retaining certain information saved in your database, such as transaction history or unpaid balances, etc.

Here's an example from Datadog:

Datadog Privacy Policy: Data retention clause

In its Privacy Statement, Intuit explains it retains data for legitimate business or legal purposes. It also identifies how personal data is stored, in the event it cannot be deleted or de-identified:

Intuit Global Privacy Statement: Information Retention clause excerpt

Users need to be aware of how long you retain their data and what happens to their data upon termination of their account.

Medical Data

Not all SaaS companies have products or services that utilize or collect medical data. If yours doesn't, then you won't need a medical data clause in your Privacy Policy.

However, if you do, you'll need to ensure you let users know that you're in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Here's how Commonwealth Care Alliance, one of the top medical SaaS companies lets users know it is in compliance with HIPAA:

Commonwealth Care Alliance: HIPAA Privacy Practices and member Rights and Responsibilities Policy: Intro clause

Financial Data

Credit and financial information is very sensitive information. As previously noted, many laws govern how companies can protect their customers from identity theft or fraud, such as the Payment Card Industry Data Security Standard (PCI DSS).

The financial data clause is where you have the opportunity to make a statement about collecting credit card data and how you ensure compliance.

Cookies

Having a cookies clause within your Privacy Policy is essential because it will inform your website visitors that you use cookies and how they can manage them.

When it comes to Privacy Policies for SaaS companies specifically, the main question is what type of information is stored in these cookies?

It's critical to note that there are two types of cookies: session cookies (which only last until a user leaves your site) and persistent/tracking cookies (that help identify users across multiple sessions). Session Cookies expire when the browser window closes, whereas persistent/tracking cookies remain on the device for future visits or sometimes even indefinitely.

The point here is that cookies are now a tool commonly used by SaaS businesses to track how users interact with their mobile apps and websites.

Cookies can be privacy-invasive, and due to that fact, they are also a legal risk. Because of that, many companies have a completely separate Cookies Policy, which is displayed on its own landing page.

However, you can alternatively outline what types of cookies your company uses and how you use them within your Privacy Policy and then link to your full Cookies Policy from there.

Cloudflare does exactly that:

Cloudflare Privacy Policy: Cookies and other tracking technologies clause

SailPoint, a SaaS that facilitates secure user access to business IT networks, does this very clearly in its Privacy Statement. In simple, easy-to-understand language, it explains what cookies are and how it uses them and provides a comprehensive list of their purposes:

SailPoint Privacy Notice: Cookie Policy and use of Other Tracking Technologies clause

Business Transfers

Because SaaS businesses are bought and sold regularly, users have a right to know what happens to their personal data if a new company buys them out. You can use a business transfer clause to provide them with relevant details.

Cloudflare doesn't create a separate clause for this issue, but instead incorporates that information into its section on sharing data with third parties. This is also acceptable as long as you, in fact, are transparent about what might happen in the case of a merger, etc.:

Cloudflare Privacy Policy: Sharing information clause excerpt

Children Under 13

It's not likely that many kids under the age of 13 will register for your SaaS product or service. But, you never know. To be prudent and stay compliant with laws like the Children's Online Privacy Protection Act (COPPA), your Privacy Policy should state that your products and services aren't intended for anyone under the age of 13.

Zoom goes further and lets users know that it doesn't allow anyone under the age of 16 to sign up for its services:

Zoom Privacy Statement: Children clause

Contact Information Clause

A contact information clause is used to give users a way to contact you primarily about any privacy concerns they might have.

It is good to make sure that any methods of communication you provide are simple and effective. For example, you might list a specific phone number or email address. Whatever you do, ensure that you have someone who will address user concerns ready to receive the communications.

Transparency, openness, and customer service are key here.

Here's Zoom's contact information clause:

Zoom Privacy Statement: Contact clause

Changes to Your Policy and Notifications About it

No law states you must carve your Privacy Policy in stone. You have the right to change it at any time. However, if you do, you are required to provide users with ample notification.

Again, think about customer service. If a user has concerns about how their data is being used or what changes have been made to the policy, they need to be able to contact you and get an answer.

Make sure that any notification you send out includes information on how users can access your Privacy Policy to view the updates/changes, as well as how they can change their personal data or unsubscribe from your services.

Including all of this information in one place makes it easy for users and demonstrates that you take your responsibility seriously when safeguarding people's privacy.

Splunk's clause on this subject is a bit sparse, but it does let users know what happens and how they'll be notified when the Privacy Policy is updated:

Splunk Privacy Policy: Updates to this Privacy Policy clause

Now that you know what goes into a Privacy Policy, let’s take a look at how you should display your SaaS Privacy Policy.

How to Display Your SaaS Privacy Policy

It's important to ensure your Privacy Policy appears on both your website and app. It should be clearly displayed and easily accessible to users.

We recommend including a link to your Privacy Policy when a user signs up to or purchases your SaaS. This notifies the user of your Privacy Policy in advance and allows them to decide whether to accept its terms and proceed with their purchase or set up an account.

Buffer includes a link to its Terms of Service page (including its Privacy Policy) in the pop-up window when users set up an account. Users are required to read and accept these terms before they can proceed:

Buffer Create Account form with Terms of Service link highlighted

You should always use clickwrap and things like "I Agree" checkboxes to get agreement to your Privacy Policy.

You should also include a link to your Privacy Policy in your website footer or app menu.

For example, T-Mobile's website footer clearly displays a link to its Privacy Notice:

T Mobile website footer with Privacy Notice link highlighted

This allows existing users to easily access your Privacy Policy to check for updates.

Summary of a SaaS Privacy Policy

A Privacy Policy is not simply a legal requirement but also an opportunity to communicate your company's values. Think of it as the "About Us" section on your website, only more important.

Every SaaS Privacy Policy should include clauses on:

The types of personal information you collect
How you collect and use that information
With whom you share data
Whether you sell data
How you protect personal information
How long you retain personal data
Your cookies policy
What happens to user data if there is a business transfer
How you communicate with customers
How you protect kids under the age of 13
How users can contact you with privacy concerns
A statement about your right to make changes to your Privacy Policy and how you'll let users know about them

Your Privacy Policy is supposed to be easy to find and understand, so make sure that you place links to it in prominent locations, such as on registration forms and on your website's footer.

Privacy Policies are a necessity for any SaaS company.

If you're worried about putting one together yourself, we have the tools and expertise to help. We recommend using our Privacy Policy Generator or taking advantage of our free SaaS Privacy Policy template and allowing it to provide structure and inspiration as a starting point.

The end game is to ensure that you have a well-written Privacy Policy that is easily accessible on your website or app, which can help you create and maintain a trusting and open relationship with current and future customers.

Download Sample SaaS Privacy Policy Template

Generate a Privacy Policy in just a few minutes

Our Sample SaaS Privacy Policy is available for download, for free. The template includes these sections:

Definitions
Collecting and Using Personal Information
Usage Data
Use of Personal Information
Transfer of Personal Information
Disclosure of Personal Information
Security of Personal Information
Links to Other Websites
Changes to Privacy Policy
Contact Information

Sample SaaS Privacy Policy Template (HTML Text Download)

You can download the Sample SaaS Privacy Policy Template as HTML code below. Copy it from the box field below (right-click > Select All and then Copy-paste) and then paste it on your website pages.

Privacy Policy
Our Privacy Policy was last updated on [___DATE___].
This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.
We use Your Personal data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy. This Privacy Policy was generated by <a href="https://www.termsfeed.com/blog/sample-saas-privacy-policy-template/">TermsFeed SaaS Privacy Policy Template</a>.
Interpretation and Definitions
Interpretation
The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.
Definitions
For the purposes of this Privacy Policy:
<ul>
<li>
"Account" means a unique account created for You to access our Service or parts of our Service.
</li>
<li>
"Company" (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to [___COMPANY INFORMATION___]
</li>
<li>
"Country" refers to [___COMPANY_COUNTRY___].
</li>
<li>
"Cookies" are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.
</li>
<li>
"Data Controller", for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
</li>
<li>
"Device" means any device that can access the Service such as a computer, a cellphone or a digital tablet.
</li>
<li>
"Do Not Track" (DNT) is a concept that has been promoted by US regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
</li>
<li>
"Personal Data" is any information that relates to an identified or identifiable individual.
</li>
<li>
"Service" refers to the Website.
</li>
<li>
"Service Provider" means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
</li>
<li>
"Usage Data" refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
</li>
<li>
"Website" refers to [___WEBSITE NAME___], accessible from [___WEBSITE_URL___]
</li>
<li>
"You" means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.
</li>
</ul>
Collecting and Using Your Personal Data
Types of Data Collected
Personal Data
While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information may include, but is not limited to:
<ul>
<li>
Email address
</li>
<li>
First name and last name
</li>
<li>
Phone number
</li>
<li>
Address, State, Province, ZIP/Postal code, City
</li>
<li>
Usage Data
</li>
</ul>
Usage Data
Usage Data is collected automatically when using the Service.
Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.
We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.
Tracking Technologies and Cookies
We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:
<ul>
<li>Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.</li>
<li>Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).</li>
</ul>
Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser.
We use both Session and Persistent Cookies for the purposes set out below:
<ul>
<li>
Necessary / Essential Cookies
Type: Session Cookies
Administered by: Us
Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.
</li>
<li>
Cookies Policy / Notice Acceptance Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies identify if users have accepted the use of cookies on the Website.
</li>
<li>
Functionality Cookies
Type: Persistent Cookies
Administered by: Us
Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.
</li>
<li>
Tracking and Performance Cookies
Type: Persistent Cookies
Administered by: Third-Parties
Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered via these Cookies may directly or indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features or new functionality of the Website to see how our users react to them.
</li>
</ul>
For more information about the cookies we use and your choices regarding cookies, please visit our Cookies Policy or the Cookies section of our Privacy Policy.
Use of Your Personal Data
The Company may use Personal Data for the following purposes:
<ul>
<li>
To provide and maintain our Service, including to monitor the usage of our Service.
</li>
<li>
To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.
</li>
<li>
For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service.
</li>
<li>
To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application's push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.
</li>
<li>
To provide You with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless You have opted not to receive such information.
</li>
<li>
To manage Your requests: To attend and manage Your requests to Us.
</li>
<li>
For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
</li>
<li>
For other purposes: We may use Your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.
</li>
</ul>
We may share Your personal information in the following situations:
<ul>
<li>With Service Providers: We may share Your personal information with Service Providers to monitor and analyze the use of our Service, for payment processing, to contact You.</li>
<li>For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.</li>
<li>With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.</li>
<li>With business partners: We may share Your information with Our business partners to offer You certain products, services or promotions.</li>
<li>With other users: when You share personal information or otherwise interact in the public areas with other users, such information may be viewed by all users and may be publicly distributed outside.</li>
<li>With Your consent: We may disclose Your personal information for any other purpose with Your consent.</li>
</ul>
Retention of Your Personal Data
The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.
Transfer of Your Personal Data
Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.
Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.
The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.
Disclosure of Your Personal Data
Business Transactions
If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.
Law enforcement
Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).
Other legal requirements
The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:
<ul>
<li>Comply with a legal obligation</li>
<li>Protect and defend the rights or property of the Company</li>
<li>Prevent or investigate possible wrongdoing in connection with the Service</li>
<li>Protect the personal safety of Users of the Service or the public</li>
<li>Protect against legal liability</li>
</ul>
Security of Your Personal Data
The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.
Detailed Information on the Processing of Your Personal Data
The Service Providers We use may have access to Your Personal Data. These third-party vendors collect, store, use, process and transfer information about Your activity on Our Service in accordance with their Privacy Policies.
Analytics
We may use third-party Service providers to monitor and analyze the use of our Service.
[___LIST___]
Children's Privacy
Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.
If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.
Links to Other Websites
Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
Changes to this Privacy Policy
We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.
We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
Contact Us
If you have any questions about this Privacy Policy, You can contact us:
<ul>
<li>By visiting this page on our website: [___WEBSITE_CONTACT_PAGE_URL___]</li>
<li>By sending us an email: [___WEBSITE_CONTACT_EMAIL___]</li>
</ul>

Sample SaaS Privacy Policy Template

More Privacy Policy Templates

More specific Privacy Templates are available over our blog.

Sample Privacy Policy Template	A Privacy Policy for all sorts of businesses.
Sample Mobile App Privacy Policy Template	A Privacy Policy for mobile apps on Apple App Store or Google Play Store.
Sample GDPR Privacy Policy Template	A Privacy Policy for businesses that need to comply with GDPR.
Sample CCPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with CCPA.
Sample California Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's privacy requirements (CalOPPA & CCPA).
Sample Virginia CDPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with Virginia's CDPA.
Sample PIPEDA Privacy Policy Template	A Privacy Policy for businesses that need to comply with Canada's PIPEDA.
Sample Ecommerce Privacy Policy Template	A Privacy Policy for ecommerce businesses.
Small Business Privacy Policy Template	A Privacy Policy for small businesses.
Privacy Policy for Google Analytics (Sample)	A Privacy Policy for businesses that use Google Analytics.
Sample CalOPPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's CalOPPA.
Sample COPPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's COPPA.
Sample CPRA Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's CPRA.
Blog Privacy Policy Sample	A Privacy Policy for blogs.
Sample Email Marketing Privacy Policy Template	A Privacy Policy for businesses that use email marketing.

William Blesch

Legal and data protection research writer at TermsFeed

This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.

20 May 2022

Sample SaaS Privacy Policy Template

What is a Privacy Policy?

Why Do SaaS Companies Need a Privacy Policy?

What Should a SaaS Privacy Policy Include?

Types of Personal Information You Collect

How You Collect and Use Information

How Personal Data May Be Used

With Whom You Share Data

How You Protect Personal Data

Data Retention: How it's Stored, and for How Long

Medical Data

Financial Data

Cookies

Business Transfers

Children Under 13

Contact Information Clause

Changes to Your Policy and Notifications About it

How to Display Your SaaS Privacy Policy

Summary of a SaaS Privacy Policy

Download Sample SaaS Privacy Policy Template

Sample SaaS Privacy Policy Template (HTML Text Download)

Sample SaaS Privacy Policy Template (PDF Download)

Sample SaaS Privacy Policy Template (DOCX Download)

Sample SaaS Privacy Policy Template (Google Docs)

More Privacy Policy Templates