Privacy Policy - US Baseline

[COMPANY NAME] U.S. PRIVACY NOTICE

Effective Date: [__/__/____]
Last Updated: [__/__/____]

This Privacy Notice explains how [COMPANY LEGAL NAME] ("Company," "we," "us," or "our") collects, uses, retains, and discloses personal data through [LIST WEBSITES, APPS, PRODUCTS, AND SERVICES] (collectively, the "Services"). It also explains privacy choices and rights that may be available under applicable law.

1. SCOPE AND CONTACT DETAILS

Company legal name: [________________________________]

Business address: [________________________________]

Privacy email: [________________________________]

Toll-free number, if used: [________________________________]

Privacy request form: [________________________________]

Appeal method: [________________________________]

This Notice applies to: [DESCRIBE COVERED CONSUMERS, SERVICES, AND INTERACTIONS].

This Notice does not apply to: [IDENTIFY EMPLOYEE, APPLICANT, BUSINESS-CONTACT, OFFLINE, OR SEPARATELY NOTICED PROCESSING THAT IS OUTSIDE THIS NOTICE].

2. PERSONAL DATA WE COLLECT

We may create aggregated or deidentified information from personal data. We will maintain and use deidentified information without attempting to reidentify it except as permitted by applicable law.

3. HOW WE USE PERSONAL DATA

We use personal data for the purposes disclosed in the table above and, as applicable, to:

• provide, maintain, personalize, and improve the Services;
• create and administer accounts;
• process transactions and provide requested products or services;
• communicate about accounts, transactions, support requests, updates, and offers;
• authenticate users and protect the security and integrity of the Services;
• detect, investigate, and prevent fraud, abuse, and other harmful activity;
• measure performance and conduct analytics and research;
• conduct advertising and marketing described in this Notice;
• comply with law, legal process, and enforceable governmental requests;
• establish, exercise, or defend legal claims; and
• carry out a merger, financing, acquisition, bankruptcy, dissolution, or transfer of all or part of our business.

We will provide any notice or obtain any consent required before using personal data for a materially different or incompatible purpose.

4. HOW WE DISCLOSE PERSONAL DATA

Our contracts with processors or service providers address the nature and purpose of processing and impose applicable confidentiality, security, deletion or return, assistance, and use restrictions.

5. SALES, SHARING, TARGETED ADVERTISING, AND PROFILING

State privacy laws define "sale," "sharing," "targeted advertising," and "profiling" differently. Complete the following based on actual practices and the definitions that apply to the Company.

During the period required by applicable law, we:

☐ did not sell personal data for monetary or other valuable consideration.

☐ sold the following categories of personal data: [________________________________].

☐ did not share personal data for cross-context behavioral advertising.

☐ shared the following categories for cross-context behavioral advertising: [________________________________].

☐ processed personal data for targeted advertising: [DESCRIBE CATEGORIES AND PARTNERS].

☐ processed personal data for profiling in furtherance of decisions that produce legal or similarly significant effects: [DESCRIBE OR STATE NONE].

Opt-out methods:

• Privacy choices link: [DO NOT SELL OR SHARE / TARGETED ADVERTISING LINK]
• Request form: [________________________________]
• Email or other designated address: [________________________________]

Where required, we process a recognized universal opt-out preference signal as a request to opt out of the applicable browser- or device-level processing. [STATE THE SIGNAL USED, SUCH AS GLOBAL PRIVACY CONTROL, AND EXPLAIN ANY ACCOUNT-LEVEL OPTION.]

6. COOKIES AND OTHER TRACKING TECHNOLOGIES

We and our partners use cookies, pixels, SDKs, local storage, and similar technologies for the following purposes:

Browser Do Not Track disclosure: [STATE WHETHER AND HOW THE SERVICES RESPOND TO DNT SIGNALS OR OTHER CHOICE MECHANISMS].

Third-party tracking disclosure: [STATE WHETHER OTHER PARTIES COLLECT DATA ABOUT USERS' ONLINE ACTIVITIES OVER TIME AND ACROSS DIFFERENT WEBSITES OR SERVICES].

7. SENSITIVE PERSONAL DATA

We collect and use sensitive personal data only for the purposes described in this Notice. Where applicable law requires consent, we will obtain it before processing sensitive personal data and provide a method to withdraw consent. Where applicable law grants a right to limit certain uses or disclosures of sensitive personal information, the request may be submitted through [LINK OR METHOD].

We do not use or disclose sensitive personal data to infer characteristics about an individual except as follows: [DESCRIBE OR STATE NONE].

8. DATA RETENTION

We retain each category of personal data only for the period reasonably necessary and proportionate to the disclosed purpose, subject to legal, accounting, security, fraud-prevention, and dispute-resolution needs.

Our retention decisions consider:

• the length and nature of the customer or user relationship;
• the amount, nature, and sensitivity of the data;
• the purposes for which the data was collected and whether those purposes can be achieved by other means;
• security, fraud-prevention, and abuse-prevention needs;
• legal, contractual, accounting, and reporting requirements; and
• pending or reasonably anticipated disputes or investigations.

Retention schedule location or summary: [________________________________]

9. YOUR PRIVACY RIGHTS

Depending on residence, applicable law, and the nature of the processing, a consumer may have the right to:

• confirm whether we process personal data and access that data;
• obtain a portable copy of certain personal data;
• correct inaccuracies;
• delete personal data;
• obtain information about categories of data, sources, purposes, and recipients;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• limit certain uses and disclosures of sensitive personal information;
• consent to or withdraw consent from processing where consent is the legal requirement;
• appeal our refusal to act on a request; and
• receive equal service and not be unlawfully discriminated against for exercising a privacy right.

Not every right applies in every jurisdiction. Rights are subject to authentication and statutory exceptions.

Submit a Request

• Web form: [________________________________]
• Email: [________________________________]
• Toll-free number: [________________________________]
• Postal address: [________________________________]

Describe the request and provide information reasonably necessary to authenticate it. We will use personal data provided for authentication only to verify and respond to the request, prevent fraud, and keep legally required records.

Authorized Agents

Where permitted, an authorized agent may submit an opt-out or other privacy request on a consumer's behalf. We may request proof of authorization and may ask the consumer to verify identity or confirm the authorization directly, subject to applicable law.

Response and Appeal

We will respond within the period required by applicable law and will notify the requester if a lawful extension is needed. If we decline to act, we will explain the basis where required and provide appeal instructions if the applicable law grants an appeal right.

Submit an appeal through: [________________________________].

If an appeal is denied, we will provide any regulator-contact method required by applicable law.

10. CHILDREN'S PRIVACY

☐ General-audience option: The Services are not directed to children under 13, and we do not knowingly collect personal information online from a child under 13.

☐ Child-directed or actual-knowledge option: We provide a separate children's privacy notice at [LINK], give parents the notices required by the Children's Online Privacy Protection Act and 16 C.F.R. Part 312, and obtain verifiable parental consent before collecting, using, or disclosing a child's personal information unless an exception applies.

If you believe a child provided personal information contrary to this Notice, contact us at [PRIVACY EMAIL].

11. FINANCIAL INCENTIVES AND LOYALTY PROGRAMS

☐ We do not offer a program that requires a notice of financial incentive or bona fide loyalty-program disclosure.

☐ We offer the following program: [PROGRAM NAME AND MATERIAL TERMS]. The program involves the following personal data: [CATEGORIES]. The value calculation and opt-in or withdrawal method are described here: [LINK OR FULL DISCLOSURE].

Participation is voluntary. A consumer may withdraw through [METHOD], subject to the program's disclosed terms.

12. SECURITY

We maintain administrative, technical, and physical safeguards designed to protect personal data and appropriate to the volume and nature of the data we process. No security measure is guaranteed to prevent every incident.

13. INTERNATIONAL DATA TRANSFERS

Personal data may be processed in [COUNTRIES OR REGIONS]. Where a transfer mechanism or additional safeguard is legally required, we use [DESCRIBE MECHANISM].

14. CHANGES TO THIS NOTICE

The "Last Updated" date shows when this Notice was last revised. We will provide notice of material changes in the manner and at the time required by applicable law. If a change requires consent, we will seek consent before applying the change to the affected processing.

15. CONTACT US

Questions or complaints may be sent to:

[COMPANY LEGAL NAME]

Attn: [PRIVACY TEAM OR OFFICER]

[STREET ADDRESS]

[CITY, STATE ZIP]

Email: [________________________________]

Telephone: [________________________________]

16. CALIFORNIA DISCLOSURES

Notice at Collection

At or before the point of collection, provide a separate, readily available notice that states:

• the categories of personal information and sensitive personal information to be collected;
• the purposes for which each category is collected or used;
• whether each category is sold or shared;
• the applicable retention period, or criteria used to determine it; and
• a link to this full Notice and the applicable opt-out or limitation method.

Prior 12-Month Practices

For the 12 months preceding the Last Updated date:

California requests may be submitted through the methods in Section 9. The Company will describe any California-specific verification, agent, opt-out, limitation, and financial-incentive procedures here: [________________________________].

17. U.S. STATE-LAW IMPLEMENTATION CHECKLIST

The following laws have materially different thresholds, exemptions, definitions, consumer rights, consent rules, appeal processes, opt-out-signal requirements, and enforcement provisions. Before publication, counsel should determine which laws apply and customize this Notice and the underlying request workflow.

This checklist is not a substitute for sector-specific review. Add separate notices and controls where the Company handles regulated health, biometric, financial, education, communications, insurance, employment, or children's data, or acts as a data broker.

SOURCES AND REFERENCES

• 15 U.S.C. § 45 — unfair or deceptive acts or practices
• 15 U.S.C. § 6502 — COPPA operator duties
• 16 C.F.R. Part 312 — current COPPA Rule
• FTC — Children's Online Privacy Protection Rule
• FTC — Privacy and Security Enforcement
• California Privacy Protection Agency — CCPA Regulations effective January 1, 2026

This template must be conformed to the Company's actual data inventory, request operations, vendor contracts, advertising technologies, retention schedule, and applicable-law analysis before publication.