Academy › Build › Create your website

Four pages, one link each, in the right place

Publish all four links where your customer needs them before paying or booking, and confirm that each page tells the truth about your business.

By Yodai · Published September 6, 2026 · Updated October 13, 2026

Legal notice, privacy policy, terms of service, and cookie policy: if you've already written all four pages and decided what happens when someone cancels, the text itself is locked in. But a page nobody can find is, in practical terms, the same as not having one.

The most expensive mistake isn't writing those pages badly. It's writing them well and then leaving them disconnected, with no link from anywhere real. The customer never sees them until they file a complaint, and by then it's too late. If your customer is an individual consumer, Spain's General Law for the Protection of Consumers and Users requires that your terms not refer to text that wasn't given to the customer before or at the moment the contract was closed, and it puts the burden on you to prove that you informed them. If the complaint comes in as a payment dispute, it counts too: for disputes where the customer claims they're owed a refund, Stripe recommends a return or cancellation policy that's easy to find or shown before the purchase, and among the evidence it suggests providing is an explanation of how and where you showed it to the customer before they paid.

Today you're not writing anything new. You're placing the four links where they need to go and checking, page by page, that what they say matches what your business actually does.

The places where the link has to be

The link doesn't say 'here' or 'learn more.' It says what it is: 'Terms of Service,' 'Privacy Policy.' Whoever reads it needs to know what they'll find before they click, without guessing. That's what the Article 29 Working Party's European transparency guidelines require for privacy: a direct link, visible on every page of the site, with a commonly used name, like Privacy Policy.

And it doesn't work to hide it in a dropdown menu inside your logo or on a 'Legal' page that people have to go searching for. Those same guidelines don't consider a link easy to access if it's placed somewhere hard to spot. For the cookie link, the AEPD guide recommends areas 'where the average user would expect to find them, since it's a common and widespread practice.' The simplest way to keep them visible on every page, as the European guidelines require for the privacy link, is the footer: it repeats the same way across the whole site, so the links are always in the same place, not just on the home page.

Before paying, not after

The checkbox should come unchecked. If it's checked by default, your customer didn't check it, consent has to be their own action, a click they make, not something that sneaks in while they're filling out their card. And if you're also asking permission to use their data for something else, like sending them offers, that permission goes separately, in its own checkbox, also unchecked: the General Data Protection Regulation (GDPR) requires that this request be "clearly distinguishable from other matters" and states that "silence, pre-ticked boxes or inactivity should not constitute consent." And the terms need to be visible beforehand: Spain's Information Society Services Act (LSSI) requires making them available to the customer before starting the purchase, so they can save and reproduce them.

If you sell with a reservation instead of an immediate payment, the same text goes before "Confirm reservation," swapping "terms of service" for "cancellation policy." That's the page you decided on in the previous lesson: this is where you link to it, not somewhere off to the side. It matters especially for reservations: Stripe points out that for services paid in advance, like tickets and reservations, proof of your cancellation policy can matter a lot in a dispute where the customer asks for their money back.

If your store doesn't let you add the checkbox, make sure the link to the terms shows up right above the checkout button.

The cookie banner: does it cover the screen or sit in a corner?

Making sure what it says matches what you do

What you put on those pages is binding. If your customer is an individual consumer, that same consumer law makes the terms and guarantees you offer enforceable even if they're not in the contract, and when a clause's meaning is unclear, it has to be read in the customer's favor. Watch out for a deadline the law sets, not you: on a distance sale to an individual consumer, the customer can withdraw within fourteen calendar days, except for the cases the law itself lists, like certain services already fully performed. If your template mentions those fourteen days, don't just delete them; adjust them to your situation. Go through each page one by one. The legal notice should clearly show your name, tax ID, address, and email, plus your registration with the Commercial Registry or professional association if you have one, as required by Article 10 of the LSSI. The privacy policy should cover the data your own form actually asks for and explain what you use it for, as required by Article 13 of the GDPR when collecting it: not a generic list of 'name, email, and phone' if you also ask for an address. And the cookie policy should only name the cookies your site actually installs, not one more: the same AEPD guide requires detailed information 'about what type of cookies are used on that page and for what purposes.'

Once the four links are in place and each page tells the truth about your business, you're ready to take that first dollar without leaving any loose ends behind.