Write a Privacy Notice That Matches Your App’s Real Data Flows

TL;DR — The fastest way to get an accurate privacy notice is to inventory every place your app collects, stores, sends, and deletes personal data, then write the notice directly from that inventory. The most common fix is to stop guessing from old legal text and instead compare your live app screens, forms, analytics, email tools, payments, and support tools against a simple data-flow table. Reading time: ~5 min

Goal

When you finish, you will have a published privacy notice that matches your app’s current behavior: the data users can enter, the third parties (outside services) your app uses, how long data is kept, and how people can contact you about privacy requests.

Prerequisites

• Access to your live app as a normal user and, if possible, as an admin
• Access to wherever your website content is edited: your CMS (content management system), site builder, repo, or hosting control panel
• A list of the tools your business uses with the app, such as:
  • analytics
  • error tracking
  • email sending
  • payment processor
  • customer support/help desk
  • CRM (customer relationship manager)
  • cloud storage
• Someone on your team who can confirm business processes if you are unsure (founder, product owner, developer, or ops)
• The public contact details you want to publish for privacy requests, for example privacy@yourdomain.com
• If your site is code-based, access to the app settings or environment variables where integrations are listed

Steps

Step 1: Create a data inventory from the live app

Open your app and list every place a person can submit data.

Use this checklist exactly:

Sign up form
Login form
Profile/account page
Checkout/payment page
Contact form
Newsletter form
Support/chat widget
File upload screen
Cookie banner/preferences
Admin-only user import/export screens
Mobile app permissions (camera, location, contacts, photos, microphone)

Create a table in a doc or spreadsheet with these exact columns:

What you should see when this step succeeds: every user-facing form, tracking tool, and integration is listed in one table.

Step 2: Check your actual third-party services

In your provider dashboards and app settings, open each service you use and add it to the table from Step 1.

Use these common menu paths where available:

Your website/CMS admin → Settings → Integrations
Your hosting control panel → Environment Variables / App Settings
Your payment provider dashboard → Developers / API keys / Webhooks
Your email platform → Settings → Sending domains / API
Your analytics dashboard → Admin / Data collection / Tracking ID
Your support tool → Settings → Channels / Widget / Customer data

Add a row for each service, using literal names such as:

Google Analytics
PostHog
Stripe
PayPal
Mailchimp
SendGrid
Intercom
Zendesk
Sentry
AWS S3
Google Cloud Storage

What you should see when this step succeeds: every outside service that receives personal data from your app appears in the table.

Step 3: Record the real data flow in plain language

Turn the inventory into a simple map so you can spot missing disclosures.

[User]
  |
  | 1. enters email, name, message
  v
[App] ---- 2. stores account/profile ----> [Database]
[App] ---- 3. sends receipts/support ----> [Email Provider]
[App] ---- 4. sends payments ----> [Payment Provider]
[App] ---- 5. sends usage events ----> [Analytics]
[App] ---- 6. sends errors/logs ----> [Error Tracking]

Then write one sentence per flow in your notes, using this pattern exactly:

We collect [data type] when you [action].
We use it to [purpose].
We share it with [service/provider] to [purpose].
We keep it for [time period or rule].

What you should see when this step succeeds: you can explain every data flow in one sentence without technical jargon.

Step 4: Draft the privacy notice from the inventory

Create a page called Privacy Notice or Privacy Policy in your site editor.

Use these section headings exactly:

1. Who we are
2. What information we collect
3. How we use your information
4. When we share your information
5. Cookies and similar technologies
6. How long we keep information
7. Your choices and rights
8. How to contact us
9. Changes to this notice

Paste this starter text and replace the bracketed parts with your real details:

Who we are
[Company name] provides [app name/service]. You can contact us at [privacy email] or [postal address if you publish one].

What information we collect
We collect information you provide directly, such as [account details, profile information, payment details handled by provider, support messages, uploaded files].
We also collect information automatically, such as [IP address, device/browser information, log data, usage events, cookie identifiers].

How we use your information
We use your information to provide the service, create and manage accounts, process payments, send service messages, provide support, improve the app, secure the service, and comply with legal obligations.

When we share your information
We share information with service providers that help us run the app, such as [payment provider], [email provider], [analytics provider], [hosting provider], and [support provider]. We may also share information when required by law or to protect our rights.

Cookies and similar technologies
We use cookies and similar technologies for [essential site functions, analytics, preferences, marketing if applicable]. You can control non-essential cookies through [your cookie banner/settings link].

How long we keep information
We keep information for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. Typical periods: [example: account data until deletion request or 24 months after last activity; support tickets 24 months; analytics 14 months; invoices 7 years].

Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your information, and to object to or limit some processing. To make a request, contact us at [privacy email].

How to contact us
Email: [privacy email]

Changes to this notice
We may update this notice from time to time. We will post the updated version on this page and update the effective date.

What you should see when this step succeeds: you have a complete draft with no bracketed placeholders left.

Step 5: Remove anything your app does not actually do

Read the draft line by line against your inventory table and delete claims that are not true.

Delete examples like these if they do not apply:

"We collect precise location data"
"We use your contacts"
"We sell personal information"
"We use advertising cookies"
"We transfer data to social media partners"
"We record calls"

What you should see when this step succeeds: every sentence in the notice maps to a row in your inventory table.

Step 6: Publish the notice and link it from the app

In your site editor or CMS, publish the page and add links in these exact places:

Website footer → add link text "Privacy Notice"
Sign-up page → below submit button add link text "Privacy Notice"
Cookie banner/settings page → add link text "Privacy Notice"
Checkout page → footer or legal text area add link text "Privacy Notice"

If your site is code-based, add a footer link with this exact HTML and replace the URL:

<a href="/privacy">Privacy Notice</a>

What you should see when this step succeeds: the notice opens from your footer and from any page where users give you personal data.

Verify it works

Use this checklist on the live site:

1. Open the published Privacy Notice page.
2. Confirm the page includes your real company/app name.
3. Confirm every third-party service in your dashboards appears in the notice.
4. Submit a test form or create a test account.
5. Check that the data created by that action is described in the notice.
6. Click the footer link, sign-up link, and cookie/settings link; all should open the same notice.
7. Send a test email to the published privacy contact address; it should arrive successfully.

Expected result: the live notice matches the app’s forms, integrations, and user journey, and every privacy link opens the published page.

Common pitfalls

You copied a template that mentions tools you do not use

Mistake: publishing a generic legal template without checking it against your app. Symptom: the notice mentions location tracking, ads, or social login that your app does not have. Fix: delete every sentence that does not map to a row in your inventory table.

You forgot server-side tools users never see

Mistake: only documenting visible forms and forgetting analytics, logs, error tracking, backups, or email delivery. Symptom: your notice says little or nothing about automatic collection or service providers. Fix: review Settings → Integrations, hosting environment variables, and provider dashboards, then add each service by name.

Your retention section says nothing specific

Mistake: writing only "we keep data as long as necessary" with no examples. Symptom: reviewers or customers ask how long accounts, tickets, or analytics are kept. Fix: add literal periods or rules, such as "support tickets 24 months" or "inactive accounts deleted after 24 months unless law requires longer retention."

The notice is published, but not linked where data is collected

Mistake: adding the page only in the footer. Symptom: users can submit forms or create accounts without seeing the notice nearby. Fix: add the same "Privacy Notice" link on sign-up, checkout, contact, and cookie/settings screens.

The contact address is missing or unmonitored

Mistake: publishing privacy@ without creating the mailbox or forwarding rule. Symptom: privacy requests bounce or go unanswered. Fix: create the mailbox or forwarding rule in your email admin, then send a test message and confirm delivery.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.