If you offer a SaaS app, you're legally required to have and post a Privacy Policy.
In this article, we'll walk you through why you need a SaaS Privacy Policy and what your SaaS Privacy Policy should contain. We've also provided a sample SaaS Privacy Policy template to help you design and write your own.
Our Privacy Policy Generator makes it easy to create a Privacy Policy for your business. Just follow these steps:
You'll be able to instantly access and download your new Privacy Policy.A Privacy Policy is a statement or legal document that discloses how an organization collects, uses, stores, and processes personal information. Keep in mind that you need to tailor your SaaS Privacy Policy to your specific business and website, but there are some common elements that all policies should include:
A Privacy Policy is required by law if your SaaS app collects personal data. This is required in most countries around the world, including but not limited to the following locations and laws:
Almost all SaaS applications collect at least one piece of personal information from their users: an email address. Collecting email addresses is enough to make having a Privacy Policy a requirement.
In addition to government regulations, many industry-specific standards apply to collecting and using personal data. For instance, the Payment Card Industry Data Security Standard (PCI DSS) applies to any company that "that accepts, transmits or stores any cardholder data."
So, it's not enough to have a Privacy Policy because you "should." Your SaaS company needs a Privacy Policy because it is legally required to have one.
More and more people use software as a service (SaaS) products in today's world. These products offer many advantages to the end user, including convenience and ease of use.
However, there is often a trade-off between what these services can provide and their ability to protect customer data. Although Facebook isn't a SaaS company, a good example of the kind of trade-off between delivering a service and protecting user data is a huge Facebook scandal which took place in 2013.
During that shocking incident, Cambridge Analytica, a British consulting firm, improperly gained access to millions of Facebook users' personal information without their consent or knowledge.
For this reason and others, a Privacy Policy is essential for any tech company that collects information about subscriptions and account services. That includes companies with a SaaS model.
Moreover, a SaaS Privacy Policy must be robust and transparent, providing customers with straightforward and easy-to-understand details on how the company protects personal data and more.
Privacy is a fundamental human right. With the advent of the internet, people share large amounts of their personal information online, sometimes unknowingly.
As an organization that collects personal information from its users (visitors), you should take every precaution to protect it by having a detailed and easily accessible Privacy Policy.
Your Privacy Policy must include at least the following information to be compliant with most privacy directives:
Your business's nature, your location, your customers, and the laws that apply to you, as well as any third-party services you use, will determine what you should include in your Privacy Policy.
At the same time, there are many ways to present your Privacy Policy, and there are various formats. But, there are particular things that you do absolutely need to include.
Let's take a look at some of the required, most important clauses.
An essential clause that you must include lets users know what type of personal information you collect.
For example, perhaps you collect information like:
Any or all of that data might be collected:
The point is that your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.
Note how Adobe is transparent about all the types of data it collects from Cloud users:
SurveyMonkey's Privacy Policy includes an "Information we collect about you" clause that does this:
SaaS businesses generally collect three types of personal data:
These categories are addressed separately in the Privacy Policy below for Emma, an email marketing SaaS. It explains how each type of data is collected and provides specific examples for each, so there can be no doubt in users' minds as to what data the company may collect from them:
Buffer's Privacy Policy breaks down the different types of personal information it collects through various methods. First, it has a clause to cover personal information provided directly by users. Here's an excerpt:
It includes a clause sub-section that addresses personal information collected through connected social media accounts Here's an excerpt:
The next sub-section discloses the personal information that's automatically collected when users interact with the Buffer service. Here's an excerpt:
While it isn't necessary to create separate clauses like this, it definitely helps break the information down in an easy-to-understand way.
The point is that your SaaS Privacy Policy must provide users with precise information on the types of data you collect. Remember that being transparent helps ensure trust and a positive user experience.
This clause informs users about how you collect their information, and what your purpose for collecting it is. You must describe every method you use to collect information about users, whether it's online or through automated backend procedures.
This information is often included with the previous clause, with companies stating in the same clause what information they collect and via what methods. If you go that route, this clause can then explain what you use the information for.
You should also explain your reasons for collecting this data. Users want to know why you're collecting it as well as how you will use it.
When explaining why you collect personal information, you should also provide information about the legal grounds you rely on to process that data, your retention schedule (how long you keep a user's personal data), and how users can request their data or have it deleted.
Salesforce discusses the methods it uses to collect data including the types of technology used in the process:
If you fall within the scope of the GDPR, you'll need to provide your lawful bases for processing personal data.
Here's how Moz does this in a short but compliant clause:
Be as clear, concise and specific as possible when letting users know what information you collect and for what purpose.
Let people know what you use their data for, such as for marketing purposes, fulfilling orders, or to improve your website. This clause should provide specific categories and examples, relevant to the nature of the service you provide.
Oracle's Privacy Policy explains personal data may be used for both business and commercial purposes. It provides a detailed explanation of each purpose:
Being transparent with users about how their personal data may be used is an important feature of a Privacy Policy.
Your users should know about the people with whom you'll be sharing personal data. For the purposes of transparency, it's good practice to include an explanation of what data you share with third parties and why.
For instance, most SaaS companies use third-party software to perform certain services. This is typically done through a website or mobile app. Google Adsense is an example of a third party that provides analytics services.
If you're using a third party like Google Adsense to help with your services, be sure to disclose that fact within your SaaS Privacy Policy. You also must not forget to divulge whether or not you sell personal information to third parties.
Here's an example of such a clause:
Polte, a location system SaaS, sets out eight specific ways in which it may share user data with a third party:
As you can see, the list of bases on which you may share user data should be exhaustive and detailed.
Any personal information collected from an individual should be kept safe and accessible only by authorized personnel. Whether you store that information locally or in the cloud, keep in mind that it's your responsibility to keep it secure.
With that in mind, you must be as transparent as possible about the security measures you've put in place to ensure data safety and what steps you'll take if a data breach ever occurs.
Providing users with this information is crucial when it comes to maintaining trust. Remember that many data breaches have taken place over the last few years, and those companies that had significant losses of information ended up facing severe financial and legal consequences.
Here's Datadog's statement on how it ensures the protection of personal information:
Slack includes a broad, purposive clause regarding data protection measures in its Privacy Policy as well as a link to its security practices. Its security practices page then provides a very detailed description of all the steps Slack takes regarding data security:
Your app users will care greatly about the security of their data. SaaS apps are commonly used by businesses to process a lot of important and confidential data.
While you don't need to get specific about the security protocols you have in place with your app, let users know that you do take measures to keep their data safe.
ConvertKit notes that security protocols are in place to help keep data secure. It places the responsibility of protecting account security on the users, and provides contact information for reporting unauthorized account uses or security breaches:
This older clause from Asana is a great example of sharing some details about what security measures you implement, while providing more resources and details via links to other documents or sites:
This clause will let users know how you retain personal information, and for how long. It also outline users' rights regarding managing their own data and your rights to retain personal information to process it. It is essential to have a data retention clause, especially for account management and subscriptions.
You have a right to keep personal data, but according to the GDPR, this time period is "for no longer than is necessary for the purposes for which the personal data are processed."
That means you can't keep it forever. So, you need to be as upfront and forthcoming as possible when letting users know how long you actually need to keep each type of data you store.
In practical terms, this may mean you need to draw up a "retention schedule" and outline that in your SaaS Privacy Policy.
Specifics you can mention in this clause include things like:
Here's an example from Datadog:
In its Privacy Statement, Intuit explains it retains data for legitimate business or legal purposes. It also identifies how personal data is stored, in the event it cannot be deleted or de-identified:
Users need to be aware of how long you retain their data and what happens to their data upon termination of their account.
Not all SaaS companies have products or services that utilize or collect medical data. If yours doesn't, then you won't need a medical data clause in your Privacy Policy.
However, if you do, you'll need to ensure you let users know that you're in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Here's how Commonwealth Care Alliance lets users know it is in compliance with HIPAA:
Having a cookies clause within your Privacy Policy is essential because it will inform your website visitors that you use cookies and how they can manage them.
When it comes to Privacy Policies for SaaS companies specifically, the main question is what type of information is stored in these cookies?
It's critical to note that there are two types of cookies: session cookies (which only last until a user leaves your site) and persistent/tracking cookies (that help identify users across multiple sessions). Session Cookies expire when the browser window closes, whereas persistent/tracking cookies remain on the device for future visits or sometimes even indefinitely.
The point here is that cookies are now a tool commonly used by SaaS businesses to track how users interact with their mobile apps and websites.
Cookies can be privacy-invasive, and due to that fact, they are also a legal risk. Because of that, many companies have a completely separate Cookies Policy, which is displayed on its own landing page.
However, you can alternatively outline what types of cookies your company uses and how you use them within your Privacy Policy and then link to your full Cookies Policy from there.
Cloudflare does exactly that:
SailPoint, a SaaS that facilitates secure user access to business IT networks, does this very clearly in its Privacy Statement. In simple, easy-to-understand language, it explains what cookies are and how it uses them and provides a comprehensive list of their purposes:
SurveyMonkey discloses the use of cookies in a robust Cookies clause. The full Cookies Policy is linked, and users are informed about why cookies are used:
Moz includes its cookies information within a clause that also covers usage details, IP addresses and "other technologies:"
ConvertKit's Privacy Policy has a clause called "Cookies and Other Tracking Technologies" that addresses cookies, web beacons and third-party tracking for advertising:
As long as the information is there, it's ok to create either a separate cookies clause or include the information in a more broad but relevant clause.
Use our Cookie Consent all-in-one solution (Privacy Consent) for cookies management to comply with GDPR & CCPA/CPRA and other privacy laws:
Create your Cookie Consent banner today to comply with GDPR, CCPA/CPRA and other privacy laws:
Display the Cookie Consent banner on your website by copy-paste the installation code in the section of your website. Instructions how to add in the code for specific platforms (WordPress, Shopify, Wix and more) are available on the Install page.Because SaaS businesses are bought and sold regularly, users have a right to know what happens to their personal data if a new company buys them out. You can use a business transfer clause to provide them with relevant details.
Cloudflare doesn't create a separate clause for this issue, but instead incorporates that information into its section on sharing data with third parties. This is also acceptable as long as you, in fact, are transparent about what might happen in the case of a merger, etc.:
Let your users know that a business transfer may happen and how their personal information will be affected by it. You can do this in a simple Business Transfers clause.
Here's an example of a great standard clause that addresses how personal information may be affected by a business transfer:
Unbounce discloses this in a very short and basic clause. It's simple, but it's adequate:
To stay compliant with laws like the Children's Online Privacy Protection Act (COPPA), your Privacy Policy should state that your products and services aren't intended for anyone under the age of 13.
It's not likely that many kids under the age of 13 will register for your SaaS product or service. But, you never know.
Zoom goes further and lets users know that it doesn't allow anyone under the age of 16 to sign up for its services:
A contact information clause is used to give users a way to contact you primarily about any privacy concerns they might have.
It is good to make sure that any methods of communication you provide are simple and effective. For example, you might list a specific phone number or email address. Whatever you do, ensure that you have someone who will address user concerns ready to receive the communications.
Transparency, openness, and customer service are key here.
Here's an example of a contact information clause:
Let users know that your Privacy Policy may be updated in the future. This is normal, as laws may change and your business practices likely will, too. You can also let users know how you will update them of changes.
Make sure that any notification you send out includes information on how users can access your Privacy Policy to view the updates/changes, as well as how they can change their personal data or unsubscribe from your services.
Splunk's clause on this subject is a bit sparse, but it does let users know what happens and how they'll be notified when the Privacy Policy is updated:
A very common and important clause in most legal agreements is the clause that reserves the right to change the legal agreement in the future.
Baremetrics encourages users to frequently check its Privacy Policy page to find out about any changes that have been made.
Moz lets its users know that changes will be posted to the Privacy Policy page, but that any material changes will come with notifications. The notifications will be either through email or a notice (such as a banner notice) on the site's homepage:
You can even include the last updated date in your site footer next to the Privacy Policy link, like so:
Now that you know what goes into a Privacy Policy, let’s take a look at how you should display your SaaS Privacy Policy.
It's important to ensure your Privacy Policy appears on both your website and app. It should be clearly displayed and easily accessible to users.
We recommend including a link to your Privacy Policy when a user signs up to or purchases your SaaS. This notifies the user of your Privacy Policy in advance and allows them to decide whether to accept its terms and proceed with their purchase or set up an account.
You should always use clickwrap and things like "I Agree" checkboxes to get agreement to your Privacy Policy.
You should also include a link to your Privacy Policy in your website footer or app menu.
For example, T-Mobile's website footer clearly displays a link to its Privacy Notice:
This allows existing users to easily access your Privacy Policy to check for updates.
Don't forget to get consent for your Privacy Policy. Your customers must agree to be bound by the terms, rules, and guidelines as you set them in your legal agreements, and the best way to ensure consent to these agreements from users is what's called the clickwrap method.
Here's an example of this in action:
Clickwrap is a great way to ensure that the customers of your SaaS application will agree to your Privacy Policy.
You can use clickwrap to get agreement to your Privacy Policy regardless of whether you allow users to sign up for an account via your website only, mobile app only, or both.
For example, say your SaaS app offers a mobile app component to increase productivity while on the go. However, users cannot sign up for an account via the mobile app. Instead, they must sign up via your website, and the mobile app is an extension of that website-created account.
In a case like this, you can still use clickwrap on your website as seen above to get users to agree to your Privacy Policy. You should also display your Privacy Policy somewhere within your SaaS mobile app for users to access from within the app at any time.
Here's how Zoom does this:
A Privacy Policy is not simply a legal requirement but also an opportunity to communicate your company's values. Think of it as the "About Us" section on your website, only more important.
Every SaaS Privacy Policy should include clauses on:
Your Privacy Policy is supposed to be easy to find and understand, so make sure that you place links to it in prominent locations, such as on registration forms and on your website's footer.
If you're worried about putting one together yourself, we have the tools and expertise to help. We recommend using our Privacy Policy Generator or taking advantage of our free SaaS Privacy Policy template and allowing it to provide structure and inspiration as a starting point.
The end game is to ensure that you have a well-written Privacy Policy that is easily accessible on your website or app, which can help you create and maintain a trusting and open relationship with current and future customers.
Our Sample SaaS Privacy Policy is available for download, for free. The template includes these sections:
You can download the Sample SaaS Privacy Policy Template as HTML code below. Copy it from the box field below (right-click > Select All and then Copy-paste) and then paste it on your website pages.
