A Privacy Policy is a public document in which a company tells you, in writing, what personal data it collects from you, why it collects it, who it shares that data with, how long it keeps it, and what rights you have over it. It's the counterpart to the Terms of Service, which governs the relationship between you and the company. The Privacy Policy governs the relationship between the company and your data.
What a Privacy Policy must contain
Under the EU's GDPR — the most influential privacy regulation in the world — a Privacy Policy must clearly disclose:
- The identity and contact details of the data controller.
- What categories of personal data are collected (account info, payment info, device identifiers, location, behavioral data, and so on).
- The lawful basis for processing — consent, contract, legitimate interest, legal obligation, vital interest or public task.
- Who the data is shared with (subprocessors, advertising partners, regulators).
- Whether data is transferred outside the EU, and under what safeguards.
- How long data is retained.
- The user's rights: access, correction, deletion, portability, restriction, and objection.
- The right to lodge a complaint with a supervisory authority.
California's CCPA/CPRA imposes a similar but distinct set of obligations, with extra disclosures around the sale or sharing of personal information and the right to opt out of both.
Why Privacy Policies change so often
A Privacy Policy isn't a static legal document — it's a public mirror of how the company actually handles data. Every time the company adds a subprocessor, signs a new advertising partner, launches a new feature that collects new data, or opens a new market, the policy is supposed to be updated to match. Most large platforms do this several times a year. Many never tell their users.
That's the gap Termsight fills: we re-read every tracked Privacy Policy every 24 hours and tell you, in plain English, what actually changed.