TEMPLATE — REVIEW BEFORE PUBLISHING This document is a generic boilerplate that ships with claudephpframework. It is not legal advice. Before publishing it on a real site, replace every [BRACKETED] placeholder, remove any sections that don't match what you actually do, add any sections specific to your operation, and have a qualified privacy lawyer review the result. Privacy laws differ by jurisdiction (GDPR, UK GDPR, CCPA/CPRA, PIPEDA, LGPD, APPI, etc.) and the specifics matter — generic boilerplate is a starting point, not a compliance guarantee.
Effective date: [EFFECTIVE DATE] Last updated: [DATE OF LAST UPDATE]
This Privacy Policy explains how [YOUR ORGANIZATION NAME] ("we", "us", or "our") collects, uses, and shares personal information about you when you use the website and services located at [WEBSITE URL] (the "Service").
1. Who is the data controller?
The data controller for personal information processed under this Policy is:
[YOUR ORGANIZATION LEGAL NAME] [REGISTERED ADDRESS] [COUNTRY]
You can contact us about privacy matters at [DPO OR PRIVACY CONTACT EMAIL].
2. What information we collect
2.1 Information you provide
- Account information: when you register, we collect your email address,
the password you set (stored as a salted hash, never in plain text), and any name, username, or profile information you choose to provide.
- Profile information: any biographical text, avatar image, contact
details, or preferences you add to your profile.
- Content you submit: posts, comments, messages, files, form
submissions, and other content you create or upload through the Service.
- Communications: messages you send to us, including support requests
and feedback.
- Date of birth (if applicable): where the Service is configured to
enforce a minimum age at registration, we collect and store your date of birth to verify eligibility.
- Payment information (if applicable): if you make a purchase, your
payment details are collected by our third-party payment processor. We do not store full card numbers ourselves; we receive only the truncated reference data needed to identify a transaction.
2.2 Information collected automatically
- Authentication and session data: when you sign in we issue a session
cookie and store the corresponding session record on the server, with your user identifier, the time of last activity, and a truncated record of your User-Agent and IP address.
- Audit logs: we record significant account events (logins, logouts,
password changes, two-factor changes, administrative actions) in an internal audit log. These logs include the actor's user identifier, the action, a timestamp, and limited request context (truncated User- Agent, source IP).
- Cookies and similar technologies: see our Cookie Policy
for the categories of cookies we use and how to control them.
- Server logs: our hosting infrastructure may log incoming requests,
including IP addresses, paths requested, response codes, and timing, for the purposes of operating, securing, and debugging the Service.
2.3 Information from third parties
- OAuth providers: if you sign in via a third-party identity provider
(for example, Google, Microsoft, Apple, Facebook, or LinkedIn), we receive a subset of your profile information from that provider as authorised by you in their consent screen.
- Email-delivery feedback: our email-delivery providers report
bounces and complaints back to us, which we use to maintain a suppression list (so we don't keep emailing addresses that don't receive successfully).
3. How we use information
We use personal information for the following purposes:
- to create and operate your account, authenticate you, and provide the
Service to you;
- to respond to your support requests and to communicate with you about
the Service;
- to process transactions and provide receipts;
- to send you transactional notifications (account events, purchase
confirmations, security alerts) and, where you have consented, marketing communications;
- to operate, secure, and improve the Service, including troubleshooting
problems and detecting fraud or abuse;
- to comply with legal obligations and enforce our Terms of Service;
- to maintain audit logs for security, compliance, and accountability
purposes.
4. Legal bases for processing (GDPR / UK GDPR)
If you are in the European Economic Area or the United Kingdom, we process personal information on the following legal bases:
- Contract — to provide the Service you have signed up for.
- Consent — for non-essential cookies, marketing communications, and
any other processing for which we ask your consent. You can withdraw your consent at any time.
- Legitimate interests — to operate, secure, and improve the Service
(for example, to prevent fraud, debug failures, and maintain audit logs). When we rely on legitimate interests, we balance them against your rights and interests.
- Legal obligation — to comply with laws applicable to us, including
tax, accounting, and law-enforcement requests.
5. How long we keep information
We retain personal information for as long as necessary for the purposes described in this Policy:
- Account information: while your account is active, plus a limited
period afterwards for legal, accounting, and dispute-resolution purposes (typically up to [N] years).
- Audit logs: retained for a period balancing accountability and
data minimisation; configurable by site administrators and reviewed periodically.
- Cookies: see our Cookie Policy for per-cookie
retention.
- Backups: may persist for a limited window after deletion in the
primary system, after which they are overwritten.
Where retention is governed by a legal obligation (for example, financial records that must be retained for tax purposes), we keep information for the period that obligation requires, and may anonymise rather than delete records that we are not permitted to remove entirely.
6. How we share information
We share personal information only as described below. We do not sell your personal information for monetary consideration.
- Service providers: we use third-party providers to host the
Service, deliver email and SMS, process payments, run analytics (where enabled), and provide other infrastructure. They process personal information on our behalf under contractual obligations.
- Other users: content you publish (for example, comments, public
posts, public profile fields) is visible to other users or to the public as appropriate to where you publish it.
- Legal and safety: we may share information when required by law,
in response to a valid legal process, or where we reasonably believe it necessary to protect rights, safety, or property.
- Business transfers: if we are involved in a merger, acquisition,
or asset sale, personal information may be transferred as part of that transaction, subject to confidentiality obligations.
7. International transfers
We may transfer personal information to countries outside your country of residence, including to providers based in the United States or elsewhere. Where we transfer personal information out of the European Economic Area, the United Kingdom, or other regions with cross-border restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, equivalent UK transfer mechanisms, or another lawful basis recognized by applicable law.
8. Your rights
Depending on where you live, you may have some or all of the following rights regarding your personal information.
8.1 Rights under GDPR / UK GDPR
- Access to a copy of your personal information.
- Rectification of inaccurate or incomplete information.
- Erasure ("right to be forgotten") in certain circumstances.
- Restriction of processing in certain circumstances.
- Portability — to receive your information in a structured,
machine-readable format.
- Objection to processing based on our legitimate interests, and to
any direct-marketing processing.
- Withdrawal of consent for any processing based on consent.
- Lodging a complaint with your supervisory authority.
You can exercise the access, portability, and erasure rights directly from your account at /account/data. For other rights, or if you have trouble using the in-product tools, contact us at [DPO OR PRIVACY CONTACT EMAIL].
8.2 California rights (CCPA / CPRA)
If you are a California resident, you have the right to:
- know what categories of personal information we have collected,
used, disclosed, and shared;
- access and obtain a copy of your personal information;
- request deletion of your personal information;
- correct inaccurate personal information;
- limit the use and disclosure of sensitive personal information;
- opt out of the sale or sharing of personal information.
We do not sell personal information for monetary consideration. To the extent that any of our processing constitutes "sharing" under the CPRA (for example, by sending information to certain analytics or advertising providers), you can opt out at /do-not-sell. We honor the Global Privacy Control (Sec-GPC) signal as an opt-out request.
We will not discriminate against you for exercising any of these rights.
8.3 Other jurisdictions
If you live in another jurisdiction with privacy rights (for example, Canada, Brazil, Australia, Japan, South Korea, India, or others), the rights described above apply to the extent your local law grants them, and additional rights may apply under your local law. Contact us at [DPO OR PRIVACY CONTACT EMAIL] for any privacy request.
9. Children
The Service is not directed to children under the age of [MINIMUM AGE, USUALLY 13 OR 16]. Where the Service is configured to enforce an age gate at registration, we will refuse the registration of any user who attests to a date of birth below the configured threshold and will not retain the date of birth they provided in connection with that refusal (only an audit record indicating that an under-age registration was attempted, with no personally identifying details).
If you believe a child has provided personal information to us in violation of this Policy, please contact us at [CONTACT EMAIL] and we will take appropriate steps to remove the information.
10. Security
We implement reasonable technical and organizational measures designed to protect personal information, including encrypted transport (TLS), hashed password storage, configurable two-factor authentication, session management with rotation on login, audit logging, infrastructure access controls, and routine security review. No system is perfectly secure, however, and we cannot guarantee the absolute security of personal information.
11. Cookies and tracking
See our separate Cookie Policy for full details on the cookies we use, what they do, and how to control them. The Service's cookie consent banner lets you choose which non-essential categories to enable; your choice is recorded with a timestamp and a record of which categories you accepted.
12. Automated decision-making
We do not engage in automated decision-making that produces legal or similarly significant effects on you without human involvement. If this changes, we will update this Policy and provide notice.
13. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices or applicable law. Where the changes are material, we will notify you by email or by prominent notice on the Service before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised.
14. Contact us
If you have questions, complaints, or requests regarding this Policy or your personal information:
- Privacy contact: [DPO OR PRIVACY CONTACT EMAIL]
- General contact: [CONTACT EMAIL]
- Postal: [POSTAL ADDRESS]
- EU representative (if applicable, under GDPR Art. 27): [REPRESENTATIVE NAME AND ADDRESS]
- UK representative (if applicable, under UK GDPR Art. 27): [REPRESENTATIVE NAME AND ADDRESS]
You also have the right to lodge a complaint with your local data protection authority. In the European Union, you can find your authority via the European Data Protection Board's directory; in the United Kingdom, the Information Commissioner's Office; in California, the California Privacy Protection Agency.