Fast answer
Publish three pages — Privacy Policy, Terms of Service, Refund Policy — that describe what your site actually collects, how you actually deliver, and how someone actually gets their money back. Link all three from the footer of every page.
What must be true before you publish
These are templates to adapt, not legal advice. The point is accuracy: a page that lists five analytics tools when you run none is a liability, and a page that omits the email tool you do run is a bigger one.
- You can name every tool that receives visitor data.
- You know how long you keep it, or can say you delete on request.
- Your refund window matches what you tell customers at checkout.
- There is a real address or email where a request can be sent.
- The policy has a visible last-updated date.
Privacy Policy
Structure it around what you collect, not around legal clauses. A reader — and a regulator — wants to know: what data, why, who else sees it, how long you keep it, and how to make you delete it.
- Identity and contact of the data controller.
- What is collected: form submissions, payment details handled by a processor, analytics, cookies.
- Why: to deliver the service, to answer enquiries, to measure traffic.
- Who processes it: name your email provider, payment processor and analytics tool explicitly.
- Retention: a real number of months, not “as long as necessary”.
- Rights: access, correction, deletion, and the email address to exercise them.
Terms of Service
Keep it short and specific. What you sell, what the buyer may do with it, what you do not promise, and which law applies. If you sell a digital product, say clearly that delivery is immediate and that this affects cancellation rights in some jurisdictions.
Refund Policy
The refund section is where most disputes start. State the window in days, the condition, the process, and the expected time to money back. If you offer no refunds on a digital download, say so before checkout — not only inside the policy page.
Imprint and contact
If you sell into the EU, most buyers expect a business name, a contact address, and an email on the site itself. A contact page with only a form and no address is the single most common reason a new site looks untrustworthy to a careful buyer.
Checklist for this step
- Privacy, Terms and Refund pages exist and load
- All three linked in the footer of every page
- Every third-party tool that receives data is named
- Retention period stated in months
- A working email for data requests
- Refund window matches the checkout wording
- Visible last-updated date on each page
- Contact page shows a real reachable address or email
Common mistakes
- Copying a policy from a site in a different industry. It describes data flows you do not have.
- Linking policies only from the checkout. They belong in the footer of every page.
- Promising “we never share your data” while running an analytics tool that does.
- Leaving the template’s placeholder company name in the document.
N — Not legal advice
This guide is educational. If you handle health, financial or children’s data, or you sell into several jurisdictions, have the adapted pages reviewed by a lawyer where you operate.
Keep the order.
Every step assumes the one before it is finished. Skipping ahead is how sites end up rebuilt twice.