DOCUMENT 3 — PRIVACY POLICY
[COMPANY LEGAL NAME] Privacy Policy
Version 1.0 — Effective [DATE] · Last updated [DATE]
1. Scope
This Privacy Policy explains how [COMPANY LEGAL NAME] ("we," "us") collects, uses, discloses, and retains personal information when you visit [SITE], create an account, place an order, or communicate with us. It does not apply to third-party sites we link to.
2. Personal information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, legal name as signed, email, phone, postal address, account ID, IP address | You; automatically |
| Commercial information | Order history, products viewed, amounts, returns, communications about orders | You; automatically |
| Professional or employment information | Employer or institution, role or title, entity type, stated research application | You |
| Financial information | Payment method type, last four digits, billing address, transaction identifiers | You; our payment processors |
| Compliance and attestation records | Attestation text and version accepted, checkbox selections, typed signature, timestamp, IP address, user agent, verification documents | You; automatically |
| Internet or network activity | Pages viewed, referring URL, session identifiers, device and browser type, cookie identifiers | Automatically |
| Geolocation | Approximate location inferred from IP address | Automatically |
| Customer service records | Emails, chat transcripts, support tickets, call notes | You |
| Inferences | Purchaser qualification status, fraud and risk scoring | Derived |
We do not knowingly collect sensitive personal information as defined by applicable law, and we do not request health information, government identification numbers, biometric data, or precise geolocation. Do not send us health information or describe personal use of our products.
[We do not collect full payment card numbers. Card data is submitted directly to our payment processor.]
We do not knowingly collect personal information from anyone under 21. If we learn we have, we will delete it.
3. How we use personal information
- Create, verify, and maintain your account, including purchaser qualification
- Process, fulfill, ship, and support your orders, and handle returns and claims
- Record and retain your intended-use attestations as evidence of the terms you accepted
- Communicate with you about orders, account status, service issues, and policy changes
- Detect, investigate, and prevent fraud, misrepresentation of intended use, abuse, and security incidents
- Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims
- Operate, secure, analyze, and improve the Site
- Send marketing communications where permitted, subject to your choices
- Any other purpose disclosed at the point of collection or to which you consent
We use personal information only for purposes compatible with those disclosed here.
4. When we disclose personal information
We disclose personal information to:
- Service providers acting on our behalf under contract — payment processors, fraud and risk vendors, hosting and cloud infrastructure, email delivery, analytics, customer support tooling, carriers and logistics providers, and professional advisors
- Suppliers and fulfillment partners, limited to what is needed to ship your order
- Professional advisors, auditors, insurers, and payment card networks or acquiring banks, including in connection with underwriting, chargeback, or compliance review
- Law enforcement, regulators, and other authorities where required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect rights, safety, or property
- Parties to a corporate transaction such as a merger, financing, acquisition, or sale of assets, subject to confidentiality
- Any party with your direction or consent
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. [If this becomes inaccurate, you must add a conspicuous "Do Not Sell or Share My Personal Information" link, offer at least two opt-out methods, honor the Global Privacy Control browser signal, respond within 15 business days, and wait 12 months before asking a consumer to opt back in (California Attorney General).]
5. Cookies, analytics, and tracking
We use strictly necessary cookies for authentication, cart function, and security, and [analytics cookies] to understand Site usage. [We use [ANALYTICS PROVIDER].] You can control cookies through your browser settings; disabling strictly necessary cookies will break account and checkout functionality. [We honor the Global Privacy Control signal.] [We do not respond to Do Not Track signals, as no common standard exists.] [We do not use advertising or retargeting pixels.]
6. Retention
We retain personal information for as long as needed for the purposes described, then delete or de-identify it. Specifically:
| Record type | Retention |
|---|---|
| Account and profile records | Life of the account plus [X] years |
| Order and transaction records | [7] years, for tax, accounting, and warranty purposes |
| Attestation and qualification records | [7] years from the later of account closure or last order, as evidence of the terms accepted |
| Customer service communications | [3] years |
| Server and security logs | [12–24] months |
| Marketing preferences and suppression lists | Until withdrawn, and indefinitely for suppression records |
We may retain information longer where required by law or where reasonably necessary to defend a legal claim or respond to a regulatory inquiry.
7. Your privacy rights
Depending on where you live, you may have the right to:
- Know or access the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of recipients
- Delete personal information we hold about you, subject to exceptions
- Correct inaccurate personal information
- Opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or profiling in furtherance of decisions with significant effects
- Limit the use and disclosure of sensitive personal information
- Portability — receive a copy in a portable, readily usable format
- Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a right
- Withdraw consent where processing is based on consent
- Appeal a denial of a request, where your state provides that right
Important limitation: we will generally decline deletion of order records and intended-use attestation records where retention is necessary to complete a transaction, comply with a legal obligation, detect or prevent fraud or misrepresentation, or establish, exercise, or defend legal claims. We will tell you which exception we relied on.
How to submit a request. Email [PRIVACY EMAIL] with the subject "Privacy Request," or write to us at [MAILING ADDRESS]. [Or use the request form at [SITE]/privacy-request.] We will verify your identity by matching the information you provide against our records, and we may request additional information used solely for verification. We do not require an account to submit an opt-out request.
Timing. We acknowledge requests within 10 days and respond within 45 days, extendable by an additional 45 days with notice. Opt-out requests are honored as soon as feasible and no later than 15 business days.
Authorized agents. An agent may submit a request with written authorization signed by you; we may contact you to confirm.
Appeals. If we deny your request, you may appeal by emailing [PRIVACY EMAIL] with the subject "Privacy Appeal" within [60] days. We will respond in writing within [45] days with our decision and reasons, and will tell you how to contact your state attorney general if you remain dissatisfied.
8. Notice to California residents
Section 2 above serves as our notice at collection, listing the categories of personal information we collect and the purposes for which we use them. In the preceding 12 months we collected the categories listed in Section 2, for the purposes in Section 3, and disclosed them for business purposes to the recipients in Section 4. We did not sell or share personal information for cross-context behavioral advertising. California residents may exercise the rights in Section 7, and may designate an authorized agent. We do not use personal information for automated decision-making that produces legal or similarly significant effects [other than fraud and risk screening, which you may ask us to review manually].
9. Notice to residents of other states
Residents of states with comprehensive privacy laws — including [Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Florida] — have the rights described in Section 7 to the extent provided by their state's law, including the right to appeal. We do not process personal data for targeted advertising, sale, or profiling in furtherance of decisions producing legal or similarly significant effects, so no opt-out is required for those activities.
10. Security
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls and least-privilege permissions, logging, and vendor diligence. Attestation records are maintained in append-only form. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Notify us immediately at [PRIVACY EMAIL] if you believe your account has been compromised. We will notify you and applicable regulators of a breach affecting your personal information as required by law.
11. International visitors
We operate in the United States, and your information will be transferred to, stored in, and processed in the United States, which may have different data protection rules than your jurisdiction. [We do not offer products in the European Economic Area, United Kingdom, or Switzerland, and this policy does not address GDPR rights.] [If you do sell into those regions, you need a GDPR-specific section covering legal bases, transfer mechanisms, data subject rights, and any EU/UK representative — have counsel draft it.]
12. Third-party links
The Site may link to third-party sites and services, including our payment processor and carriers. Their privacy practices are their own, and we are not responsible for them.
13. Changes to this Policy
We may update this Policy. We will post the updated version with a new effective date and version number and, for material changes, provide notice by email or a conspicuous Site notice before the change takes effect.
14. Contact
[COMPANY LEGAL NAME], Attn: Privacy, [MAILING ADDRESS] · [PRIVACY EMAIL] · [PHONE]