Sample SaaS Privacy Policy Template

In this article, we'll walk you through the basics and requirements of a SaaS privacy policy and answer the most common questions about what it should contain. We've also provided a sample SaaS Privacy Policy template to help you design and write your own.

What is a Privacy Policy?

More and more people use software as a service (SaaS) products in today's world. These products offer many advantages to the end user, including convenience and ease of use.

However, there is often a trade-off between what these services can provide and their ability to protect customer data. Although Facebook isn't a SaaS company, a good example of the kind of trade-off between delivering a service and protecting user data is a huge Facebook scandal which took place in 2013.

During that shocking incident, Cambridge Analytica, a British consulting firm, improperly gained access to millions of Facebook users' personal information without their consent or knowledge.

For this reason and others, a Privacy Policy is essential for any tech company that collects information about subscriptions and account services. That includes companies with a SaaS model.

Moreover, a SaaS Privacy Policy must be robust and transparent, providing customers with straightforward and easy-to-understand details on how the company protects personal data and more.

Privacy is a fundamental human right. With the advent of the internet, people share large amounts of their personal information online, sometimes unknowingly.

As an organization that collects personal information from its users (visitors), you should take every precaution to protect it by having a detailed and easily accessible Privacy Policy.

A Privacy Policy is a statement or legal document that discloses how an organization collects, uses, stores, and processes personal information. Keep in mind that you need to tailor your SaaS Privacy Policy to your specific business and website, but there are some common elements that all policies should include:

• The types of personal information you collect from users
• How you collect this information (directly from users or through third parties)
• Why you're collecting it (for example, providing a service, improving user experience, market products/services, etc.)
• How you use this information (including sharing with affiliates and third parties)
• Your retention period for personal data
• The rights of users with respect to their personal data

Why Do SaaS Companies Need a Privacy Policy?

An increasing number of countries are passing strict data privacy laws which require companies to have a Privacy Policy.

For example, the European Union's General Data Protection Regulation (GDPR) went into effect in 2016. The GDPR is applicable to companies that process data of individuals in the EU, regardless of whether the company is based inside the EU.

The United States has no single federal law that governs data privacy, but several states have adopted their own rules. For example, the California Consumer Privacy Act (CCPA) applies to any company that does business in California and collects personal information about California residents.

In addition to government regulations, many industry-specific standards apply to collecting and using personal data. For instance, the Payment Card Industry Data Security Standard (PCI DSS) applies to any company that "that accepts, transmits or stores any cardholder data."

So, it's not enough to have a Privacy Policy because you "should." Your SaaS company needs a Privacy Policy because it is legally required to have one.

What Should a SaaS Privacy Policy Include?

Your business's nature, your location, your customers, and the laws that apply to you, as well as any third-party services you use, will determine what you should include in your Privacy Policy.

At the same time, there are many ways to present your Privacy Policy, and there are various formats. But, there are particular things that you do absolutely need to include.

Let's take a look at some of the required, most important clauses.

Types of Personal Information You Collect

An essential clause that you must include lets users know what type of personal information you collect.

For example, perhaps you collect information like:

• Name
• Postal address
• IP address
• Geolocation
• Email address
• A Social security number
• Credit card numbers
• Usage of products and services
• Device and browser information

Any or all of that data might be collected:

• Upon registration
• Automatically by an app
• Received from third parties

The point is that your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.

Note how Adobe is transparent about all the types of data it collects from Cloud users:

Your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.

SaaS businesses generally collect three types of personal data:

• Data provided by the user such as names, email addresses, payment details
• Data collected by the software, for example, cookies or log data
• Data collected by third parties. Most SaaS applications use third-party widgets to perform services on its website or app. These widgets may collect personal data from the SaaS's users or share personal data with the SaaS.

These categories are addressed separately in the Privacy Policy below for Emma, an email marketing SaaS. It explains how each type of data is collected and provides specific examples for each, so there can be no doubt in users' minds as to what data the company may collect from them:

The point is that your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.

How You Collect and Use Information

This clause informs users about what happens after they have provided their personal data. Within it, you must describe every method you use to collect information about users, whether it's online or through automated backend procedures.

You should also explain your reasons for collecting this data. Users want to know why you're collecting it as well as how you will use it.

When explaining why you collect personal information, you should also provide information about the legal grounds you rely on to process that data, your retention schedule (how long you keep a user's personal data), and how users can request their data or have it deleted.

Salesforce discusses the methods it uses to collect data including the types of technology used in the process:

How Personal Data May Be Used

To ensure you obtain informed consent from your users, your Privacy Policy should clearly explain how their data may be used. Again, this section should provide specific categories and examples, relevant to the nature of the service you provide.

You need to explain why it's necessary for your service to process personal data. It may be to contact users, deliver the service, or improve the service offered to them.

Oracle's Privacy Policy explains personal data may be used for both business and commercial purposes. It provides a detailed explanation of each purpose:

Being transparent with users about how their personal data may be used is an important feature of a Privacy Policy.

With Whom You Share Data

Your users should know about the people with whom you'll be sharing personal data. For the purposes of transparency, it's good practice to include an explanation of what data you share with third parties and why.

For instance, most SaaS companies use third-party software to perform certain services. This is typically done through a website or mobile app. Google Adsense is an example of a third party that provides analytics services.

If you're using a third party like Google Adsense to help with your services, be sure to disclose that fact within your SaaS Privacy Policy. You also must not forget to divulge whether or not you sell personal information to third parties.

Here's all the third-parties that Square (now Block) shares user data with:

Polte, a location system SaaS, sets out eight specific ways in which it may share user data with a third party:

As you can see, the list of bases on which you may share user data should be exhaustive and detailed.

How You Protect Personal Data

Any personal data collected from an individual should be kept safe and accessible only by authorized personnel. Whether you store that information locally or in the cloud, keep in mind that it's your responsibility to keep it secure.

With that in mind, you must be as transparent as possible about the security measures you've put in place to ensure data safety and what steps you'll take if a data breach ever occurs.

Providing users with this information is crucial when it comes to maintaining trust. Remember that many data breaches have taken place over the last few years, and those companies that had significant losses of information ended up facing severe financial and legal consequences.

Here's Datadog's statement on how it ensures the protection of personal information:

Slack includes a broad, purposive clause regarding data protection measures in its Privacy Policy as well as a link to its security practices. Its security practices page then provides a very detailed description of all the steps Slack takes regarding data security:

Data Retention: How it's Stored, and for How Long

It is essential to have a data retention clause, especially for account management and subscriptions. This clause will outline users' rights regarding managing their own data and your rights to retain personal information to process it.

You should pay attention to that last sentence. You have a right to keep personal data, but according to the GDPR, it's literally "for no longer than is necessary for the purposes for which the personal data are processed."

That means you can't keep it forever. So, you need to be as upfront and forthcoming as possible when letting users know how long you actually need to keep each type of data you store.

In practical terms, this may mean you need to draw up a "retention schedule" and outline that in your SaaS Privacy Policy.

Specifics you can mention in this clause include things like:

• Where you store personal data and how users can access it to see or modify details
• Users' right to delete their personal data or accounts, and how this may affect their access to future services
• Your right to delete accounts if users do not comply with your own requirements for the use of services
• The necessity of retaining certain information saved in your database, such as transaction history or unpaid balances, etc.

Here's an example from Datadog:

In its Privacy Statement, Intuit explains it retains data for legitimate business or legal purposes. It also identifies how personal data is stored, in the event it cannot be deleted or de-identified:

Users need to be aware of how long you retain their data and what happens to their data upon termination of their account.

Medical Data

Not all SaaS companies have products or services that utilize or collect medical data. If yours doesn't, then you won't need a medical data clause in your Privacy Policy.

However, if you do, you'll need to ensure you let users know that you're in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Here's how Commonwealth Care Alliance, one of the top medical SaaS companies lets users know it is in compliance with HIPAA:

Financial Data

Credit and financial information is very sensitive information. As previously noted, many laws govern how companies can protect their customers from identity theft or fraud, such as the Payment Card Industry Data Security Standard (PCI DSS).

The financial data clause is where you have the opportunity to make a statement about collecting credit card data and how you ensure compliance.

Cookies

Having a cookies clause within your Privacy Policy is essential because it will inform your website visitors that you use cookies and how they can manage them.

When it comes to Privacy Policies for SaaS companies specifically, the main question is what type of information is stored in these cookies?

It's critical to note that there are two types of cookies: session cookies (which only last until a user leaves your site) and persistent/tracking cookies (that help identify users across multiple sessions). Session Cookies expire when the browser window closes, whereas persistent/tracking cookies remain on the device for future visits or sometimes even indefinitely.

The point here is that cookies are now a tool commonly used by SaaS businesses to track how users interact with their mobile apps and websites.

Cookies can be privacy-invasive, and due to that fact, they are also a legal risk. Because of that, many companies have a completely separate Cookies Policy, which is displayed on its own landing page.

However, you can alternatively outline what types of cookies your company uses and how you use them within your Privacy Policy and then link to your full Cookies Policy from there.

Cloudflare does exactly that:

SailPoint, a SaaS that facilitates secure user access to business IT networks, does this very clearly in its Privacy Statement. In simple, easy-to-understand language, it explains what cookies are and how it uses them and provides a comprehensive list of their purposes:

Business Transfers

Because SaaS businesses are bought and sold regularly, users have a right to know what happens to their personal data if a new company buys them out. You can use a business transfer clause to provide them with relevant details.

Cloudflare doesn't create a separate clause for this issue, but instead incorporates that information into its section on sharing data with third parties. This is also acceptable as long as you, in fact, are transparent about what might happen in the case of a merger, etc.:

Children Under 13

It's not likely that many kids under the age of 13 will register for your SaaS product or service. But, you never know. To be prudent and stay compliant with laws like the Children's Online Privacy Protection Act (COPPA), your Privacy Policy should state that your products and services aren't intended for anyone under the age of 13.

Zoom goes further and lets users know that it doesn't allow anyone under the age of 16 to sign up for its services:

Contact Information Clause

A contact information clause is used to give users a way to contact you primarily about any privacy concerns they might have.

It is good to make sure that any methods of communication you provide are simple and effective. For example, you might list a specific phone number or email address. Whatever you do, ensure that you have someone who will address user concerns ready to receive the communications.

Transparency, openness, and customer service are key here.

Here's Zoom's contact information clause:

Changes to Your Policy and Notifications About it

No law states you must carve your Privacy Policy in stone. You have the right to change it at any time. However, if you do, you are required to provide users with ample notification.

Again, think about customer service. If a user has concerns about how their data is being used or what changes have been made to the policy, they need to be able to contact you and get an answer.

Make sure that any notification you send out includes information on how users can access your Privacy Policy to view the updates/changes, as well as how they can change their personal data or unsubscribe from your services.

Including all of this information in one place makes it easy for users and demonstrates that you take your responsibility seriously when safeguarding people's privacy.

Splunk's clause on this subject is a bit sparse, but it does let users know what happens and how they'll be notified when the Privacy Policy is updated:

Now that you know what goes into a Privacy Policy, let’s take a look at how you should display your SaaS Privacy Policy.

How to Display Your SaaS Privacy Policy

It's important to ensure your Privacy Policy appears on both your website and app. It should be clearly displayed and easily accessible to users.

We recommend including a link to your Privacy Policy when a user signs up to or purchases your SaaS. This notifies the user of your Privacy Policy in advance and allows them to decide whether to accept its terms and proceed with their purchase or set up an account.

Buffer includes a link to its Terms of Service page (including its Privacy Policy) in the pop-up window when users set up an account. Users are required to read and accept these terms before they can proceed:

You should always use clickwrap and things like "I Agree" checkboxes to get agreement to your Privacy Policy.

You should also include a link to your Privacy Policy in your website footer or app menu.

For example, T-Mobile's website footer clearly displays a link to its Privacy Notice:

This allows existing users to easily access your Privacy Policy to check for updates.

Summary of a SaaS Privacy Policy

A Privacy Policy is not simply a legal requirement but also an opportunity to communicate your company's values. Think of it as the "About Us" section on your website, only more important.

Every SaaS Privacy Policy should include clauses on:

• The types of personal information you collect
• How you collect and use that information
• With whom you share data
• Whether you sell data
• How you protect personal information
• How long you retain personal data
• Your cookies policy
• What happens to user data if there is a business transfer
• How you communicate with customers
• How you protect kids under the age of 13
• How users can contact you with privacy concerns
• A statement about your right to make changes to your Privacy Policy and how you'll let users know about them

Your Privacy Policy is supposed to be easy to find and understand, so make sure that you place links to it in prominent locations, such as on registration forms and on your website's footer.

Privacy Policies are a necessity for any SaaS company.

If you're worried about putting one together yourself, we have the tools and expertise to help. We recommend using our Privacy Policy Generator or taking advantage of our free SaaS Privacy Policy template and allowing it to provide structure and inspiration as a starting point.

The end game is to ensure that you have a well-written Privacy Policy that is easily accessible on your website or app, which can help you create and maintain a trusting and open relationship with current and future customers.

Download Sample SaaS Privacy Policy Template

Generate a Privacy Policy in just a few minutes

Our Sample SaaS Privacy Policy is available for download, for free. The template includes these sections:

• Definitions
• Collecting and Using Personal Information
• Usage Data
• Use of Personal Information
• Transfer of Personal Information
• Disclosure of Personal Information
• Security of Personal Information
• Links to Other Websites
• Changes to Privacy Policy
• Contact Information

Sample SaaS Privacy Policy Template (HTML Text Download)

You can download the Sample SaaS Privacy Policy Template as HTML code below. Copy it from the box field below (right-click > Select All and then Copy-paste) and then paste it on your website pages.

Sample SaaS Privacy Policy Template (PDF Download)

Download the Sample SaaS Privacy Policy Template as a PDF file

Sample SaaS Privacy Policy Template (DOCX Download)

Download the Sample SaaS Privacy Policy Template as a DOCX file

Sample SaaS Privacy Policy Template (Google Docs)

Download the Sample SaaS Privacy Policy Template as a Google Docs document

More Privacy Policy Templates

More specific Privacy Templates are available on our blog.

Sample Privacy Policy Template	A Privacy Policy for all sorts of businesses.
Sample Mobile App Privacy Policy Template	A Privacy Policy for mobile apps on Apple App Store or Google Play Store.
Sample GDPR Privacy Policy Template	A Privacy Policy for businesses that need to comply with GDPR.
Sample CCPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with CCPA.
Sample California Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's privacy requirements (CalOPPA & CCPA).
Sample Virginia CDPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with Virginia's CDPA.
Sample PIPEDA Privacy Policy Template	A Privacy Policy for businesses that need to comply with Canada's PIPEDA.
Sample Ecommerce Privacy Policy Template	A Privacy Policy for ecommerce businesses.
Small Business Privacy Policy Template	A Privacy Policy for small businesses.
Privacy Policy for Google Analytics (Sample)	A Privacy Policy for businesses that use Google Analytics.
Sample CalOPPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's CalOPPA.
Sample COPPA Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's COPPA.
Sample CPRA Privacy Policy Template	A Privacy Policy for businesses that need to comply with California's CPRA.
Blog Privacy Policy Sample	A Privacy Policy for blogs.
Sample Email Marketing Privacy Policy Template	A Privacy Policy for businesses that use email marketing.