# BrewMetrics Privacy Policy
**Effective Date:** [Effective Date]
BrewMetrics ("BrewMetrics," "we," "us," or "our") is a SaaS platform based in Austin, Texas that helps craft breweries track inventory and sales analytics. We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data.
This policy applies to users in the United States, the European Economic Area (EEA), the United Kingdom, and other regions where we operate. It is designed to comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the CPRA.
## Information We Collect
We collect the following categories of information:
- **Account Information:** Your name, email address, password, job title, and company information (such as brewery name, address, and size).
- **Payment Information:** Billing details are collected and processed by our payment processor, Stripe. BrewMetrics does not store full credit card numbers on our servers.
- **Usage Data:** Information about how you interact with our platform, including pages visited, features used, click activity, device type, browser, IP address, and timestamps.
- **Support Communications:** Messages, chat transcripts, and related metadata when you contact us through Intercom or by email.
- **Cookies and Similar Technologies:** See the Cookies section below.
## How We Use Your Information
We use your information to:
- Provide, operate, and maintain the BrewMetrics platform.
- Process payments and manage subscriptions.
- Authenticate users and secure accounts.
- Respond to support inquiries and send service-related notifications.
- Analyze product usage to improve features, performance, and user experience.
- Send occasional marketing communications (you may opt out at any time).
- Comply with legal obligations and enforce our terms.
**Legal Bases (GDPR):** We process personal data based on (1) performance of a contract, (2) your consent, (3) our legitimate interests in operating and improving the service, and (4) compliance with legal obligations.
## How We Share Your Information
We do not sell your personal information. We share data only with trusted service providers that help us deliver the BrewMetrics service, including:
- **Stripe** – payment processing
- **Google Analytics** – product and website analytics
- **Intercom** – customer support and in-app messaging
- **Cloud hosting and infrastructure providers** – secure data storage
We may also disclose information when required by law, to protect our rights, or in connection with a business transaction such as a merger or acquisition.
## International Data Transfers
BrewMetrics is headquartered in the United States. If you are located in the EEA or UK, your personal data may be transferred to and processed in the U.S. We rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) to protect cross-border transfers.
## Data Retention
We retain personal information for as long as necessary to provide the service, fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements. When data is no longer needed, we securely delete or anonymize it.
## Data Security
We implement industry-standard technical and organizational measures to protect your data, including encryption in transit, access controls, and regular security reviews. No system is 100% secure, but we work hard to safeguard your information.
## Cookies
BrewMetrics and our service providers use cookies and similar technologies to operate the platform, remember preferences, analyze usage, and support customer interactions. Categories include:
- **Essential cookies** – required for login and core functionality.
- **Analytics cookies** – used by Google Analytics to understand how users engage with our product.
- **Support cookies** – used by Intercom to provide live chat and messaging.
You can control cookies through your browser settings or our cookie consent banner (where applicable).
## Your Rights
**GDPR (EEA/UK users):** You have the right to access, correct, delete, restrict, or object to our processing of your personal data, as well as the right to data portability and to withdraw consent at any time. You may also file a complaint with your local data protection authority.
**CCPA/CPRA (California users):** You have the right to:
- Know what personal information we collect and how it is used.
- Request deletion or correction of your personal information.
- Opt out of the "sale" or "sharing" of personal information (BrewMetrics does not sell personal information).
- Limit the use of sensitive personal information.
- Not be discriminated against for exercising your rights.
To exercise any of these rights, contact us at [Contact Email]. We will verify your request and respond within the timeframes required by law.
## Children's Privacy
BrewMetrics is not intended for individuals under 16, and we do not knowingly collect personal information from children.
## Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and, where appropriate, notify you by email or through the platform.
## Contact Us
If you have questions about this Privacy Policy or your personal data, please contact us:
**BrewMetrics**
Austin, Texas, USA
Email: [Contact Email]
For EU/UK users, you may also contact our designated representative at [Contact Email].
Generate a Privacy Policy for Your Startup
Tested prompts for privacy policy for startup website compared across 5 leading AI models.
If you just launched a startup website and realized you need a privacy policy, you are not alone. Most founders hit this wall the moment they add a contact form, email signup, or analytics script. Legally, if you collect any data from visitors, including names, email addresses, or even just IP addresses via Google Analytics, you need a privacy policy. It is not optional in most jurisdictions, and missing one can block you from app store approvals, payment processor accounts, and advertising platforms.
The real problem is not finding a template. Templates are everywhere. The problem is finding language that actually matches what your startup does, without paying a lawyer $500 to draft something from scratch. AI models can generate a solid first draft in under two minutes if you give them the right inputs about your data practices.
This page shows you exactly how to prompt an AI to generate a privacy policy for your startup website, compares outputs across four models, and tells you what to watch for before you publish. The goal is a usable, legally grounded document you can put live today and refine as your product grows.
When to use this
Using AI to generate your startup privacy policy works well when you are in early stages, have straightforward data collection practices, and need something live quickly. It is the right move for pre-seed and seed-stage companies that collect standard data types like emails, names, and usage analytics, and have not yet built complex data pipelines or third-party integrations that require custom legal language.
- You are launching a landing page or MVP and need a privacy policy before going live
- You are applying to an app store, ad network, or payment processor that requires a posted policy
- You collect email addresses via a signup form and use a tool like Mailchimp or ConvertKit
- You run Google Analytics, Meta Pixel, or similar tracking and need to disclose it
- You are a solo founder or small team without budget for a startup attorney right now
When this format breaks down
- Your startup handles sensitive data categories such as health records, financial account data, or data about children under 13. HIPAA, GLBA, and COPPA require precision that AI drafts alone cannot guarantee.
- You operate in multiple jurisdictions with materially different obligations, such as GDPR in the EU and CCPA in California simultaneously, and your data flows are complex. A lawyer needs to map those interactions.
- You are about to close a Series A or later funding round where investors will conduct legal due diligence on your compliance posture. An AI-generated policy that was never reviewed by counsel is a red flag in that context.
- You are building a marketplace or platform where third-party sellers also collect user data. That layered data relationship requires custom drafting, not a generic template.
The prompt we tested
You are a legal writing assistant specializing in drafting clear, compliant privacy policies for startup websites. Use the startup details provided below to generate a complete, professional privacy policy that addresses data collection, use, storage, sharing, user rights, cookies, third-party services, and contact information. Instructions: Write the privacy policy in plain, accessible English using clearly labeled sections with markdown headings (e.g., ## Information We Collect, ## How We Use Your Information, ## Cookies, ## Your Rights, ## Contact Us). Include GDPR and CCPA-aligned language where relevant, use placeholders like [Effective Date] and [Contact Email] when specifics are missing, and keep the total length between 600 and 900 words. Startup details: Our startup is called BrewMetrics, a SaaS platform based in Austin, Texas that helps craft breweries track inventory and sales analytics. We collect user email addresses, names, company info, and payment details through Stripe, and we use Google Analytics and Intercom for product analytics and support. We have customers in the US and EU and want the policy to cover GDPR and CCPA. Produce the full privacy policy now.
Model comparison
| Model | Quality | Cost | Latency | Tokens |
|---|---|---|---|---|
| Claude Opus 4.7 | 8 | $0.1380 | 24.4s | 398 / 1760 |
| Claude Haiku 4.5 | 8 | $0.0065 | 11.5s | 268 / 1251 |
| Gemini 2.5 Pro | 4 | $0.0016 | 20.0s | 238 / 254 |
| Grok 4.1 Fast Reasoning | 8 | $0.0006 | 12.3s | 384 / 981 |
Outputs
# Privacy Policy for BrewMetrics
**Effective Date:** [Effective Date]
BrewMetrics ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our SaaS platform (collectively, the "Service").
Please read this policy carefully. By accessing or using BrewMetrics, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.
## Information We Collect
We collect information in the following ways:
**Information You Provide Directly:**
- Account registration data, including name, email address, and company information
- Payment information (credit card details processed through Stripe; we do not store full payment card data)
- User-generated content, such as inventory records, sales data, and analytics queries
- Communication data, including support requests and feedback submitted through our platform
**Information Collected Automatically:**
- Device information (device type, operating system, browser type)
- Usage analytics (pages visited, features used, time spent, clickstreams)
- IP address and approximate geographic location
- Cookies and similar tracking technologies
## How We Use Your Information
BrewMetrics uses collected information for the following purposes:
- **Service Delivery:** Providing, maintaining, and improving the BrewMetrics platform
- **Account Management:** Creating and managing your account, processing payments, and sending transactional emails
- **Customer Support:** Responding to inquiries and providing technical assistance through Intercom
- **Analytics:** Analyzing platform usage patterns via Google Analytics to enhance user experience and features
- **Marketing & Communications:** Sending promotional emails (only where permitted by law and with your consent)
- **Compliance:** Meeting legal obligations and enforcing our Terms of Service
- **Security:** Detecting fraud, preventing abuse, and maintaining platform security
## Information Sharing and Third Parties
We do not sell your personal data. However, we share information with trusted service providers:
- **Stripe:** Payment processing (see [Stripe Privacy Policy](https://stripe.com/en-us/privacy))
- **Google Analytics:** Usage analytics (see [Google Analytics Privacy Policy](https://policies.google.com/privacy))
- **Intercom:** Customer support and messaging (see [Intercom Privacy Policy](https://www.intercom.com/privacy))
We may disclose your information if required by law, court order, government request, or when necessary to protect our legal rights or user safety. In the event of a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.
## Data Storage and Security
BrewMetrics implements industry-standard security measures, including encryption in transit (TLS/SSL) and at rest, access controls, and regular security audits. However, no system is completely secure. We retain personal data only as long as necessary to provide the Service or comply with legal obligations. Upon account deletion, we remove your personal data within 30 days, except where legally required to retain it.
## Cookies and Tracking Technologies
BrewMetrics uses cookies and similar technologies to enhance functionality and user experience. These include:
- **Essential Cookies:** Required for platform functionality
- **Analytics Cookies:** Used by Google Analytics to understand usage patterns
- **Preference Cookies:** To remember your settings and preferences
You can control cookie preferences through your browser settings. Disabling cookies may limit Service functionality. We do not currently honor Do Not Track (DNT) signals, as no standard has been established.
## Your Privacy Rights
Depending on your location, you may have the following rights:
**GDPR Rights (EU Residents):**
- Right to access your personal data
- Right to rectification (correction) of inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with your data protection authority
**CCPA Rights (California Residents):**
- Right to know what personal data is collected
- Right to delete personal data (with limited exceptions)
- Right to opt-out of the sale or sharing of personal data
- Right to non-discrimination for exercising CCPA rights
To exercise any of these rights, contact us at [Contact Email]. We will respond within 30 days (45 days for GDPR requests). We may require verification of your identity before processing requests.
## Children's Privacy
BrewMetrics is not intended for users under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that a child has provided us with information, we will delete such data and terminate the child's account.
## Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. The "Effective Date" at the top will be updated accordingly. Continued use of BrewMetrics following changes constitutes your acceptance of the revised policy.
## Contact Us
For questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact:
**BrewMetrics Privacy Team**
Email: [Contact Email]
Address: Austin, Texas, USA
Response Time: 5–10 business days
By using BrewMetrics, you trust us with your data. We are committed to protecting that trust through transparent, lawful, and ethical privacy practices.
Of course. Here is a complete, professional privacy policy for BrewMetrics, drafted according to your specifications.
***
# Privacy Policy for BrewMetrics
**Effective Date:** [Effective Date]
## 1. Introduction
Welcome to BrewMetrics! We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy explains how BrewMetrics ("we," "us," or "our") collects, uses, shares, and protects your information when you use our software-as-a-service (SaaS) platform for inventory and sales analytics (the "Service").
This policy applies to all users of our Service, including those in the United States and the European Union. We have designed it to be compliant with key privacy frameworks, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
By using our Service, you agree to the collection and use of information in accordance with this policy.
## 2. Information We Collect
We collect information in a few different ways to provide and improve our Service to you.
#### a. Information You Provide Directly
* **Account Information:** When you sign up for BrewMetrics, we collect your name, email
# BrewMetrics Privacy Policy **Effective Date: [Effective Date]** BrewMetrics, a SaaS platform based in Austin, Texas, helps craft breweries track inventory and sales analytics. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website (brewmetrics.com) or services. It applies to visitors, users, and customers in the US (including California residents under CCPA) and EU (under GDPR). By using our services, you consent to the practices described here. If you have questions, contact us at [Contact Email]. ## Information We Collect We collect information to provide and improve our services. This includes: - **Account and Contact Information**: When you sign up, we collect your name, email address, company name, and brewery details. - **Payment Information**: We process payments via Stripe, which collects billing details like credit card info. We do not store full payment details ourselves. - **Usage Data**: Automatically collected via Google Analytics and Intercom, including IP address, browser type, device info, pages visited, time spent on site, and interaction data (e.g., feature usage for analytics and support). - **Communications**: Messages sent via Intercom support chats or email. - **Cookies and Tracking**: See "Cookies" section below. We collect this to deliver personalized services. For California residents (CCPA), this is our notice at collection: categories include identifiers, commercial info, internet activity, and inferences. EU residents: We are the data controller under GDPR. ## How We Use Your Information We use your information for: - Providing our SaaS platform (e.g., inventory tracking, analytics dashboards). - Processing payments and subscriptions via Stripe. - Communicating via email or Intercom (e.g., support, updates). - Improving services through analytics (Google Analytics for site traffic; Intercom for product usage). - Marketing (e.g., newsletters; you can opt out anytime). - Legal compliance, fraud prevention, and security. We retain data only as long as needed for these purposes or legal requirements (e.g., 7 years for financial records). ## Cookies and Similar Technologies We use cookies and tracking technologies for functionality, analytics, and personalization: - **Essential Cookies**: For login and core features. - **Analytics Cookies**: Google Analytics tracks site usage (anonymized where possible). - **Support Cookies**: Intercom for chat and user sessions. You can manage cookies via browser settings. Disabling them may limit functionality. We use Google Analytics opt-out tools. No third-party advertising cookies. ## How We Share Your Information We do not sell your personal information (CCPA opt-out not applicable). We share with: - **Service Providers**: Stripe (payments), Google Analytics (analytics), Intercom (support/product data). These are bound by contracts to protect your data. - **Business Transfers**: In mergers or acquisitions. - **Legal Requirements**: To comply with laws, subpoenas, or protect rights. No sharing with unrelated third parties. ## Data Storage and Security Data is stored in secure US-based servers (e.g., AWS). We use encryption, access controls, firewalls, and regular audits. For EU users, we ensure GDPR-compliant transfers via Standard Contractual Clauses with providers. ## Your Rights You have control over your data. To exercise rights, contact [Contact Email]. We respond within 45 days (extendable). - **Access**: Request a copy of your data. - **Correction**: Update inaccurate info. - **Deletion**: Request erasure (subject to legal exceptions). - **Objection/Restriction**: Object to processing (e.g., marketing); restrict in disputes. - **Portability**: Receive data in machine-readable format (GDPR). - **CCPA Rights** (CA residents): Know categories disclosed/sold (none sold); delete; opt-out of sale/sharing (email [Contact Email] or Do Not Sell link). Verify identity via email/security questions. No discrimination for exercising rights. EU users: No automated decisions with legal effect. ## Children's Privacy Our services are not for children under 16 (or 13 in some US states). We do not knowingly collect children's data. Parents can contact us to delete. ## International Data Transfers For EU/UK users, data may transfer to the US. We use GDPR-approved mechanisms like Standard Contractual Clauses. ## Changes to This Policy We may update this policy. Changes post on our site with notice (e.g., email). Continued use means acceptance. ## Contact Us Questions? Email [Contact Email] or write: BrewMetrics [Your Address] Austin, TX [ZIP] For EU GDPR complaints, contact us first; if unresolved, your data protection authority. *Word count: 748*
What makes these work
-
01Name your tools explicitly
The single biggest improvement you can make to your prompt is listing every third-party tool you use: analytics, email marketing, payments, ads, cloud storage. Generic prompts produce generic policies. When you write 'we use Mixpanel for analytics and Stripe for payments,' the AI can name those processors directly in the policy, which is what GDPR and CCPA actually require you to disclose.
-
02State your jurisdictions up front
GDPR, CCPA, PIPEDA, and Australia's Privacy Act have meaningfully different requirements around consent, user rights, and breach notification timelines. Tell the AI which laws apply to you based on where your users are located, not just where you are incorporated. A US-incorporated startup with European users must address GDPR regardless of where it is registered.
-
03Specify what you do NOT do with data
Policies that include clear negative disclosures, such as 'we do not sell personal data' or 'we do not share data with advertisers,' build user trust and also satisfy CCPA's requirement to disclose whether you sell data. Include these in your prompt explicitly so the AI builds them into the policy language rather than leaving them ambiguous.
-
04Request a contact method and effective date
Every enforceable privacy policy needs a way for users to reach you with privacy requests and a date showing when the policy took effect or was last updated. Ask the AI to include a placeholder for your privacy contact email and a last-updated date. These two small elements are what regulators and app store reviewers check first.
More example scenarios
Write a privacy policy for a SaaS startup called Trackr. We help freelancers log billable hours. We collect email addresses at signup, usage data through Mixpanel, and payment info through Stripe. We do not sell user data. We store data on AWS servers in the US. Users can delete their accounts at any time. We are subject to GDPR and CCPA.
A privacy policy covering: identity of the data controller (Trackr), categories of data collected (email, usage, payment), processors used (Mixpanel, Stripe, AWS), legal bases under GDPR, CCPA rights disclosure including right to know and delete, data retention tied to account lifecycle, and a contact email for privacy requests. Should include an effective date and a plain-language summary at the top.
Generate a privacy policy for a direct-to-consumer skincare startup called Lumis. We collect names, shipping addresses, emails, and credit card info processed through Shopify. We use Klaviyo for email marketing and Meta Pixel for retargeting ads. We ship only in the US. We do not sell customer data to third parties.
Policy covering: data collected at checkout and account creation, use of Shopify as the payment processor with a link to their policy, Meta Pixel disclosure and how to opt out of ad targeting, Klaviyo email marketing with unsubscribe instructions, US-only data storage, and a section on cookies and tracking technologies. Should note that credit card numbers are never stored directly by Lumis.
Write a privacy policy for a fitness app called PaceUp. We collect GPS location during workouts, health data like heart rate if the user connects a wearable, and in-app purchase history. We use Firebase for analytics. Free users see ads served by Google AdMob. Paid users do not. Users can export and delete their data. We operate under GDPR.
Policy covering: sensitive health data handling and explicit consent requirements, GPS data collection scope (only during active workouts), wearable integration and what data is pulled, differentiated ad experience between free and paid tiers with AdMob disclosure, Firebase analytics use, GDPR rights (access, portability, erasure), and a data export mechanism description. Should clarify that health data is never shared with advertisers.
I need a simple privacy policy for a landing page for my startup idea, Draftly, a B2B writing tool. The page has one email capture form. I use Google Analytics 4. No product is live yet. I am based in the UK and the GDPR applies.
A lightweight policy disclosing: collection of email addresses via the waitlist form and the purpose (product updates only), use of GA4 with a note about IP anonymization, no data selling or sharing with third parties, UK GDPR rights including right to withdraw consent and right to erasure, contact details for the data controller, and a cookie notice covering the GA4 cookie specifically.
Draft a privacy policy for a two-sided marketplace called Handoff that connects homeowners with local contractors. We collect data from both homeowners and contractors including names, addresses, phone numbers, and job history. Contractors go through identity verification via Stripe Identity. We store data on Google Cloud. We operate in the US and Canada.
Policy with separate sections for homeowner data and contractor data, disclosure of Stripe Identity as a verification processor, explanation of why phone numbers and addresses are collected and when they are shared between the two parties, Google Cloud as infrastructure provider, retention policy for job history records, Canadian PIPEDA compliance acknowledgment alongside US practices, and instructions for both user types to request data deletion.
Common mistakes to avoid
-
Using a generic template without editing
Publishing a privacy policy that mentions data practices your startup does not have, or omits ones you do, creates legal exposure. If your policy says you do not use cookies but you run Google Analytics, that is a false statement. Always review the AI output against your actual tech stack line by line before publishing.
-
Ignoring jurisdiction-specific sections
CCPA requires a specific 'Your California Privacy Rights' section. GDPR requires you to name a legal basis for each processing activity. Leaving these out because your prompt did not specify your jurisdictions means your policy is non-compliant the moment someone from that region visits your site. State your applicable laws in every prompt.
-
Never updating the policy as you grow
A privacy policy drafted for a landing page becomes outdated the moment you add a payment processor, launch a mobile app, or start using retargeting ads. Treat your privacy policy as a living document. Set a reminder to review it every time you add a new tool that touches user data.
-
Assuming AI output is attorney-client advice
AI-generated privacy policies are drafts, not legal opinions. If your startup is handling sensitive data categories, raising institutional funding, or operating in a regulated industry, have a startup attorney review the output before publishing. The cost of a one-hour review is far lower than the cost of a regulatory inquiry.
-
Posting the policy with no link in the footer
Google's ad policies, Apple's App Store guidelines, and most payment processors require that your privacy policy be reachable from every page of your site, typically via a footer link. Generating the document is only half the job. If it is not publicly linked and accessible, it does not count as posted for compliance purposes.
Related queries
Frequently asked questions
Is a privacy policy legally required for a startup website?
Yes, in most cases. If your website collects any personal data from visitors, including email addresses, names, or even just IP addresses via analytics tools, privacy laws in California (CCPA), the EU (GDPR), Canada (PIPEDA), and other jurisdictions require you to disclose your data practices. Beyond legal requirements, app stores, ad networks, and payment processors all require a posted policy before they will approve your account.
Can I use a free privacy policy generator instead of an AI prompt?
Free generators like Termly or PrivacyPolicies.com ask you multiple-choice questions and output a policy, which works fine for basic use cases. The advantage of using an AI with a detailed prompt is that you can describe nuanced situations, specific third-party tools, and unique data flows that a form-based generator cannot capture. Both approaches require you to review the output before publishing.
Do I need a separate privacy policy for GDPR and CCPA?
No. Most startups use a single privacy policy that includes sections addressing each law. You would have a general data practices section, a section labeled 'Additional Rights for California Residents' covering CCPA, and a section covering GDPR rights for EU residents. One document, structured to address multiple laws, is the standard approach for early-stage companies.
How long does a startup privacy policy need to be?
There is no minimum length, but there are minimum required topics: what data you collect, why you collect it, who you share it with, how long you keep it, user rights, and how to contact you. A simple landing page policy might be 400 words. A SaaS product with multiple integrations and multi-jurisdiction obligations might run 1,500 words or more. Length should match complexity, not pad for appearance.
Does my privacy policy need to be reviewed by a lawyer?
For a basic landing page or early MVP with standard data collection, an AI-generated and self-reviewed policy is a reasonable starting point. If you handle health data, financial data, or children's data, or if you are raising venture funding, you should have a startup attorney review it. Many startup attorneys offer flat-fee privacy policy reviews in the $300 to $600 range.
What happens if I do not have a privacy policy on my startup website?
Short-term consequences include being rejected by Google Ads, Meta Ads, the Apple App Store, or Stripe when you try to set up accounts. Longer-term, operating without a required privacy policy can result in regulatory fines, particularly under GDPR where fines can reach 4% of global annual revenue, and CCPA which allows statutory damages per violation. Starting with even a basic policy eliminates most of this risk immediately.