Legal and data protection research writer at TermsFeed.
On this page
- 3.1. Types of Personal Information You Collect
- 3.2. How and Why You Collect Information
- 3.3. How Personal Information May Be Used
- 3.4. Who You Share the Personal Information With
- 3.5. How You Protect the Personal Information
- 3.6. Data Retention: How it's Stored, and for How Long
- 3.7. Medical Data
- 3.8. Cookies
- 3.9. Business Transfers
- 3.10. Children Under 13
- 3.11. Contact Information Clause
- 3.12. Changes to Your Policy and Notifications About it
At Step 1, select the Website option or App option or both.
Answer some questions about your website or app.
Answer some questions about your business.
- The types of personal information you collect from users
- How you collect this information (directly from users or through third parties)
- Why you're collecting it (for example, providing a service, improving user experience, market products/services, etc.)
- How you use this information (including sharing with affiliates and third parties)
- Your retention period for personal data
- The rights of users with respect to their personal data
- The California Online Privacy Protection Act (CalOPPA) in the US
- Privacy Act of 1988 in Australia
- PIPEDA in Canada
- The GDPR in the EU
- The DPA in the UK
- Various data protection acts in Southeast Asia (Singapore, Malaysia etc.)
In addition to government regulations, many industry-specific standards apply to collecting and using personal data. For instance, the Payment Card Industry Data Security Standard (PCI DSS) applies to any company that "that accepts, transmits or stores any cardholder data."
More and more people use software as a service (SaaS) products in today's world. These products offer many advantages to the end user, including convenience and ease of use.
However, there is often a trade-off between what these services can provide and their ability to protect customer data. Although Facebook isn't a SaaS company, a good example of the kind of trade-off between delivering a service and protecting user data is a huge Facebook scandal which took place in 2013.
During that shocking incident, Cambridge Analytica, a British consulting firm, improperly gained access to millions of Facebook users' personal information without their consent or knowledge.
Privacy is a fundamental human right. With the advent of the internet, people share large amounts of their personal information online, sometimes unknowingly.
- What personal data your SaaS app is collecting and using
- How personal data is collected and used
- How personal data is stored
- If personal data is shared with third parties
- How users can limit what data is collected/used, withdraw consent to have any data collected/used, and have the collected and stored data deleted
- If cookies are being used, which ones are being used, and why
Let's take a look at some of the required, most important clauses.
Types of Personal Information You Collect
An essential clause that you must include lets users know what type of personal information you collect.
For example, perhaps you collect information like:
- Postal address
- IP address
- Email address
- A Social security number
- Credit card numbers
- Usage of products and services
- Device and browser information
Any or all of that data might be collected:
- Upon registration
- Automatically by an app
- Received from third parties
Note how Adobe is transparent about all the types of data it collects from Cloud users:
SaaS businesses generally collect three types of personal data:
- Data provided by the user such as names, email addresses, payment details
- Data collected by the software, for example, cookies or log data
- Data collected by third parties. Most SaaS applications use third-party widgets to perform services on its website or app. These widgets may collect personal data from the SaaS's users or share personal data with the SaaS.
It includes a clause sub-section that addresses personal information collected through connected social media accounts Here's an excerpt:
The next sub-section discloses the personal information that's automatically collected when users interact with the Buffer service. Here's an excerpt:
While it isn't necessary to create separate clauses like this, it definitely helps break the information down in an easy-to-understand way.
How and Why You Collect Information
This clause informs users about how you collect their information, and what your purpose for collecting it is. You must describe every method you use to collect information about users, whether it's online or through automated backend procedures.
This information is often included with the previous clause, with companies stating in the same clause what information they collect and via what methods. If you go that route, this clause can then explain what you use the information for.
You should also explain your reasons for collecting this data. Users want to know why you're collecting it as well as how you will use it.
When explaining why you collect personal information, you should also provide information about the legal grounds you rely on to process that data, your retention schedule (how long you keep a user's personal data), and how users can request their data or have it deleted.
Salesforce discusses the methods it uses to collect data including the types of technology used in the process:
If you fall within the scope of the GDPR, you'll need to provide your lawful bases for processing personal data.
Here's how Moz does this in a short but compliant clause:
Be as clear, concise and specific as possible when letting users know what information you collect and for what purpose.
How Personal Information May Be Used
Let people know what you use their data for, such as for marketing purposes, fulfilling orders, or to improve your website. This clause should provide specific categories and examples, relevant to the nature of the service you provide.
Who You Share the Personal Information With
Your users should know about the people with whom you'll be sharing personal data. For the purposes of transparency, it's good practice to include an explanation of what data you share with third parties and why.
For instance, most SaaS companies use third-party software to perform certain services. This is typically done through a website or mobile app. Google Adsense is an example of a third party that provides analytics services.
Here's an example of such a clause:
Polte, a location system SaaS, sets out eight specific ways in which it may share user data with a third party:
As you can see, the list of bases on which you may share user data should be exhaustive and detailed.
How You Protect the Personal Information
Any personal information collected from an individual should be kept safe and accessible only by authorized personnel. Whether you store that information locally or in the cloud, keep in mind that it's your responsibility to keep it secure.
With that in mind, you must be as transparent as possible about the security measures you've put in place to ensure data safety and what steps you'll take if a data breach ever occurs.
Providing users with this information is crucial when it comes to maintaining trust. Remember that many data breaches have taken place over the last few years, and those companies that had significant losses of information ended up facing severe financial and legal consequences.
Here's Datadog's statement on how it ensures the protection of personal information:
Your app users will care greatly about the security of their data. SaaS apps are commonly used by businesses to process a lot of important and confidential data.
While you don't need to get specific about the security protocols you have in place with your app, let users know that you do take measures to keep their data safe.
ConvertKit notes that security protocols are in place to help keep data secure. It places the responsibility of protecting account security on the users, and provides contact information for reporting unauthorized account uses or security breaches:
This older clause from Asana is a great example of sharing some details about what security measures you implement, while providing more resources and details via links to other documents or sites:
Data Retention: How it's Stored, and for How Long
This clause will let users know how you retain personal information, and for how long. It also outline users' rights regarding managing their own data and your rights to retain personal information to process it. It is essential to have a data retention clause, especially for account management and subscriptions.
You have a right to keep personal data, but according to the GDPR, this time period is "for no longer than is necessary for the purposes for which the personal data are processed."
That means you can't keep it forever. So, you need to be as upfront and forthcoming as possible when letting users know how long you actually need to keep each type of data you store.
Specifics you can mention in this clause include things like:
- Where you store personal data and how users can access it to see or modify details
- Users' right to delete their personal data or accounts, and how this may affect their access to future services
- Your right to delete accounts if users do not comply with your own requirements for the use of services
- The necessity of retaining certain information saved in your database, such as transaction history or unpaid balances, etc.
Here's an example from Datadog:
In its Privacy Statement, Intuit explains it retains data for legitimate business or legal purposes. It also identifies how personal data is stored, in the event it cannot be deleted or de-identified:
Users need to be aware of how long you retain their data and what happens to their data upon termination of their account.
However, if you do, you'll need to ensure you let users know that you're in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Here's how Commonwealth Care Alliance lets users know it is in compliance with HIPAA:
When it comes to Privacy Policies for SaaS companies specifically, the main question is what type of information is stored in these cookies?
It's critical to note that there are two types of cookies: session cookies (which only last until a user leaves your site) and persistent/tracking cookies (that help identify users across multiple sessions). Session Cookies expire when the browser window closes, whereas persistent/tracking cookies remain on the device for future visits or sometimes even indefinitely.
The point here is that cookies are now a tool commonly used by SaaS businesses to track how users interact with their mobile apps and websites.
Cookies can be privacy-invasive, and due to that fact, they are also a legal risk. Because of that, many companies have a completely separate Cookies Policy, which is displayed on its own landing page.
Cloudflare does exactly that:
SailPoint, a SaaS that facilitates secure user access to business IT networks, does this very clearly in its Privacy Statement. In simple, easy-to-understand language, it explains what cookies are and how it uses them and provides a comprehensive list of their purposes:
Moz includes its cookies information within a clause that also covers usage details, IP addresses and "other technologies:"
As long as the information is there, it's ok to create either a separate cookies clause or include the information in a more broad but relevant clause.
Use our Cookie Consent all-in-one solution (Privacy Consent) for cookies management to comply with GDPR & CCPA/CPRA and other privacy laws:
- For GDPR, CCPA/CPRA and other privacy laws
- Apply privacy requirements based on user location
- Get consent prior to third-party scripts loading
- Works for desktop, tables and mobile devices
- Customize the appearance to match your brand style
Create your Cookie Consent banner today to comply with GDPR, CCPA/CPRA and other privacy laws:
Start the Privacy Consent wizard to create the Cookie Consent code by adding your website information.
At Step 2, add in information about your business.
At Step 3, select a plan for the Cookie Consent.
You're done! Your Cookie Consent Banner is ready. Install the Cookie Consent banner on your website:
Display the Cookie Consent banner on your website by copy-paste the installation code in the
</head>section of your website. Instructions how to add in the code for specific platforms (WordPress, Shopify, Wix and more) are available on the Install page.
Because SaaS businesses are bought and sold regularly, users have a right to know what happens to their personal data if a new company buys them out. You can use a business transfer clause to provide them with relevant details.
Cloudflare doesn't create a separate clause for this issue, but instead incorporates that information into its section on sharing data with third parties. This is also acceptable as long as you, in fact, are transparent about what might happen in the case of a merger, etc.:
Let your users know that a business transfer may happen and how their personal information will be affected by it. You can do this in a simple Business Transfers clause.
Here's an example of a great standard clause that addresses how personal information may be affected by a business transfer:
Unbounce discloses this in a very short and basic clause. It's simple, but it's adequate:
Children Under 13
It's not likely that many kids under the age of 13 will register for your SaaS product or service. But, you never know.
Zoom goes further and lets users know that it doesn't allow anyone under the age of 16 to sign up for its services:
Contact Information Clause
A contact information clause is used to give users a way to contact you primarily about any privacy concerns they might have.
It is good to make sure that any methods of communication you provide are simple and effective. For example, you might list a specific phone number or email address. Whatever you do, ensure that you have someone who will address user concerns ready to receive the communications.
Transparency, openness, and customer service are key here.
Here's an example of a contact information clause:
Changes to Your Policy and Notifications About it
A very common and important clause in most legal agreements is the clause that reserves the right to change the legal agreement in the future.
For example, T-Mobile's website footer clearly displays a link to its Privacy Notice:
Here's an example of this in action:
For example, say your SaaS app offers a mobile app component to increase productivity while on the go. However, users cannot sign up for an account via the mobile app. Instead, they must sign up via your website, and the mobile app is an extension of that website-created account.
Here's how Zoom does this:
- The types of personal information you collect
- How you collect and use that information
- With whom you share data
- Whether you sell data
- How you protect personal information
- How long you retain personal data
- Your cookies policy
- What happens to user data if there is a business transfer
- How you communicate with customers
- How you protect kids under the age of 13
- How users can contact you with privacy concerns
- Collecting and Using Personal Information
- Usage Data
- Use of Personal Information
- Transfer of Personal Information
- Disclosure of Personal Information
- Security of Personal Information
- Links to Other Websites
- Contact Information
More specific Privacy Templates are available on our blog.