Academy › Build › Create your website

One piece of data, one line: that's how you write your website's policy

By the end, you'll have a privacy policy with one line for every real spot on your site where you ask for information (a form, a booking, WhatsApp, payment), with no borrowed clauses from a template.

By Yodai · Published on September 6, 2026 · Updated on October 12, 2026

4 min read

Your site has to say what information you keep about the people who buy from you. You go into a privacy policy generator, paste in your business name, and out comes a three-page document full of clauses about third-party advertising cookies, international data transfers, and a data controller that sounds like some other company. All you have is a contact form, a booking button, and a WhatsApp number. Which of those clauses is actually yours?

Short answer: nothing you don't actually do. Who you are belongs in your legal notice, with your name and your contact information. Here, your job is to say what you ask for in return: what information comes in through your site, where it comes in, and what you do with it. A privacy policy isn't impressive because it's long, it's impressive because it's exact.

Four places where your website asks for data

Before you write a single line, walk through your own site and mark every spot where a real person's information comes in. For a lot of small businesses, it comes down to these four, and if two of them don't apply to you, even better: that's less to write.

The four entry points

1The contact form
It asks for a name, an email, and the message the person writes, and sometimes a phone number. That data lands in your inbox, the one on your business domain, not some random Gmail address, and it's not used for anything other than answering that inquiry.
2Appointment booking
It asks for a name, phone number, and the time slot chosen. It's stored in your calendar or your booking dashboard, whether that's one system or two if you split up services, so you can give notice of a change or send a reminder. Nothing more.
3Your business WhatsApp
The phone number of whoever writes in stays in the conversation, and if you use a dashboard or a bot to reply, it stays in that system too. It's the data that lasts the longest: WhatsApp doesn't delete the history just because the conversation ended months ago.
4Payments
You never see the card, your payment processor does, Stripe, Square, or whichever one you use. What reaches you is the name of the person who paid, the amount, and whether the charge went through or not. That difference changes the whole clause: you don't store the card number, the processor does, so you name the processor, not yourself.

One line per piece of data, not a paragraph out of fear

For each of the four points, write the same thing, in this order: what data you ask for, what you use it for, how long you keep it, and whether anyone besides you sees it. Four questions, four short answers, one after another. You don't need a long paragraph for each one: the shorter the line, the easier it is to check that it's true.

Those lines aren't the whole policy. Privacy laws also require you to say who you are and how to reach you, the reason for each use (for example, that the person is booking an appointment with you, or that they gave you their consent), and the rights they have: to ask to see their data, correct or delete it, restrict or object to how you use it, take it to another service, withdraw their consent if they gave it, and file a complaint with their state attorney general or the FTC.

If you share the data with someone, your payment processor, your booking system, whoever manages your WhatsApp, name them. Don't write third-party providers: write the actual name of the tool you use. That's the difference between a clause you can back up and one that's just filling space, the generic template that isn't really yours.

What you don't need to write

If you don't run ads, skip the advertising cookies clause. The clause about transfers outside the US doesn't just depend on where your site is hosted: if you use services from companies based elsewhere (for payments, messaging, email), check their policy to see if they send data outside the United States, and if they do, say so. If there truly aren't any, don't write it: it only makes the document longer without saying anything about you. Every extra line doesn't protect more, it protects less, because it makes it harder for the reader to tell which clause actually applies to them.

How to write the booking line

When you book an appointment on this website, we keep your name, phone number, and the time you choose. We use them only to confirm the booking and to let you know if there's a change or a cancellation. They're stored in [name of the booking system you use] for twelve months from the appointment date, then deleted. They aren't shared with anyone other than you.

The costly mistake: the clause that isn't yours

The costly mistake isn't forgetting a clause, it's leaving in one that isn't yours. If your policy says you share data with business partners for advertising and you don't actually do that, the day someone asks you to name those partners, you won't have a single name to give, and that empty promise weighs more against you than if you'd never written it. And the other way around: if you really do share the phone number with whoever manages your WhatsApp or with your payment processor, and that line is missing, that's the one that's truly missing. The rule is simple: one line for every real place where data comes in, no line for what you don't do.

What you'll walk away with

You've pinpointed the four places where your website asks for data: the contact form, booking, WhatsApp, and payment.
Each one has its line written out: what data, what for, how long it's kept, and who else sees it.
There's no borrowed clause left over from a generator for data your website doesn't even collect.
The next lesson covers which cookies you actually need to disclose, and which ones don't even exist on your website.

NextThe cookie notice you don't need, and the one that doesn't do its job