It's tempting. You find a privacy policy you like, you change the company name, and you call it done. Takes five minutes and costs nothing.
Here's why that's a problem.
The legal issue
Privacy policies are protected by copyright. The text belongs to whoever wrote it. Copying it without permission is technically copyright infringement — even if you change the names.
In practice, most companies won't chase you for copying their privacy policy. But that's not the real problem.
The bigger problem: it's almost certainly wrong for your product
A privacy policy isn't a generic document. It's a legal statement about what your business does with your users' data. If you copy someone else's policy, it describes their business — not yours.
Here's what goes wrong:
Wrong data types. Their policy says they collect location data. You don't. Or you collect payment information and their policy doesn't mention it. Either way, your policy is inaccurate.
Wrong third parties. Their policy lists Salesforce and HubSpot as data processors. You use Stripe and Supabase. Completely different. If a user asks who has their data, your policy gives them the wrong answer.
Wrong jurisdiction. Their policy is written for US law. You're a UK company. GDPR requirements are different from California's CCPA. A policy written for one jurisdiction doesn't meet the requirements of another.
Wrong refund policy. They offer 30-day refunds. You don't offer refunds at all. You've just told your users they're entitled to something they're not.
The GDPR risk specifically
Under GDPR, your privacy policy must be accurate. If you say you collect certain data but you actually collect more, or you say you use certain processors but you use different ones, you're in violation — not because you copied, but because you're misrepresenting your data practices to users.
GDPR fines for inaccurate privacy policies aren't common for small businesses, but the risk increases every time you collect more data or bring on more users.
What to do instead
Write one that's actually about your product. You don't need a lawyer for this — you need a document that accurately reflects what your product does.
InkTerms generates a personalised privacy policy based on answers about your specific product — what data you collect, who you share it with, what jurisdiction you're in, and how users can exercise their rights.
It takes about three minutes and costs £9.
Originally published on InkTerms Blog
For further actions, you may consider blocking this person and/or reporting abuse
