Tech, AI and SaaS
Privacy policy
Matched to what your product actually does with personal information. Terms for your customers, users and partners.
What it is
A privacy policy tells people what personal information you collect, why, and who receives it. It also explains where the information is stored, how long you keep it, and how people can access it, withdraw consent or contact you. We review your data practices under PIPEDA first, including your vendors, SDKs and AI features, so the policy describes what your product really does.
PIPEDA requires a business that collects personal information in the course of commercial activity to make its privacy practices readily available, and Quebec requires a published policy if you collect personal information from people there online. Apple and Google Play require one for every app. A policy that doesn’t match your real data flows can mislead users, and business customers compare it with your security review answers.
You likely need this if
- You’re launching an app, website or online store
- You collect emails through a newsletter, waitlist or contact form
- You use analytics, ad pixels or other tools that receive user data
- You have users or customers in Quebec or outside Canada
- App Store or Google Play review, Stripe or Shopify asked for a privacy policy
- An enterprise customer’s security review asked for your privacy policy
- You’re adding AI features that send user data to a model provider
- You’re using a generated or template policy that doesn’t match your product
What the starting price includes
- Privacy policy for one website or product
- Review of your data practices under PIPEDA
- Standard analytics, email and payment tools
What can change the price
- Users in Quebec (Law 25) or outside Canada
- Mobile apps, health information or AI features
We tell you before doing anything outside the agreed scope, and agree the fee first.
Terms you’ll hear
Often needed with it
Questions founders ask
Do I legally need a privacy policy in Canada?
If you collect personal information from customers or users, in practice yes. PIPEDA requires you to make information about your privacy practices readily available, and Quebec requires a business that collects personal information through technological means to publish a privacy policy on its website.
What must a Canadian privacy policy include?
What you collect and why, who receives it, where it may be stored or processed, how long you keep it, how you protect it, how people can access or correct it and withdraw consent, and who is accountable for privacy, with contact details.
Can I use a privacy policy generator?
A generator produces text from a template, not from your data flows. The Privacy Commissioner of Canada advises businesses to avoid templates and boilerplate, and the policy needs to match what your product collects and where that information goes, including to your vendors.
Do Quebec users change anything?
Yes. Quebec’s privacy law, often called Law 25, requires a policy published on your website in clear and simple language, the title and contact details of the person in charge of privacy, notice before you use tracking or profiling features, and an assessment before personal information leaves Quebec. That can change the scope, and we quote any change before work starts.
What if our product uses AI?
If user content goes to a model provider, or personal information is used to train or improve models, the policy should say so in plain terms, and consent may need to be express. We look at that as part of the data practices review.
Is a privacy policy the same as consent?
No. The policy explains your practices. The Privacy Commissioner’s consent guidelines expect the key points to be highlighted when people sign up or grant a permission, not left only in the policy.
General information, not legal advice.
How it works
- A free 15-minute call. What you’re building and what you need.
- A written scope and fixed fee. Before any work starts.
- A short, tailored intake. A few focused questions for your matter, so we start with what we need.
- Drafting or review. Most work is back within three business days.