The short answer
A SaaS or AI app's privacy policy must say who you are and how to contact you, what personal data you collect and why, the legal basis, every recipient including AI model providers, how long you keep data, where it's transferred, people's rights and how to use them, and how to complain. AI apps should also explain what happens to prompts and outputs, and whether data is used for training.
Key takeaways
- The most common failure is a mismatch: the policy names vendors you don't use and misses the ones you do.
- GDPR Art. 13 requires recipients, so every analytics, email, payment, hosting and AI provider must be named or categorised.
- California's CalOPPA requires a policy at any size, including how the site responds to Do Not Track.
- India's DPDP Rules require a standalone, itemised notice before consent from 14 May 2027.
- SafeLaunch drafts the privacy notice from what it finds in your product, so the policy matches the code.
On this page
01
What must every privacy policy include?
| Content | GDPR | CCPA / CalOPPA | India DPDP |
|---|---|---|---|
| Who you are and how to contact you | Art. 13(1)(a) | Contact for requests | §8(9); Rule 9 contact |
| What data you collect | Art. 13 to 14 | Categories (§1798.100; §22575(b)(1)) | Itemised data (Rule 3) |
| Why you use it (purposes) | Art. 13(1)(c) | Purposes | Specified purpose (§5) |
| Legal basis | Art. 13(1)(c) | Not required | Consent or legitimate use (§4) |
| Who receives it | Art. 13(1)(e) | Third parties and categories | Processors listed in practice |
| How long you keep it | Art. 13(2)(a) | Retention per category (CPRA) | Erasure when purpose is served (§8(7)) |
| Transfers abroad | Art. 13(1)(f) | Not required | Restricted countries (§16) |
| Rights and how to use them | Art. 13(2)(b) | Know, delete, correct, opt out | Access, correct, erase, nominate (§11 to 14) |
| Right to complain | Art. 13(2)(d) | Not required | To the Data Protection Board (Rule 3) |
| Do Not Track response | Not required | §22575(b)(5) | Not required |
| Effective date and changes | Good practice | §22575(b)(3) to (4) | Good practice |
02
What should an AI app's privacy policy add?
- Which AI providers receive data, such as the model API you call, and that they act as your processors or service providers.
- What happens to prompts and outputs: whether you store them, for how long, and who can see them.
- Whether data is used to train models, yours or the provider's, and how to opt out if you offer that.
- Automated decisions: if AI makes decisions with legal or similarly significant effects, the logic involved and how to get human review (GDPR Art. 22).
- AI disclosure in the product itself: the EU AI Act's Article 50 requires people to be told they're interacting with AI, which a policy alone doesn't satisfy.
03
How do I check my privacy policy matches my app?
- 01
List every service your app contacts
Open the site with the browser's network tab, and search the code for API calls. Note hosting, database, auth, email, payments, analytics, error tracking, chat, fonts and AI providers.
- 02
List every field your forms collect
Including hidden fields, uploads and free-text boxes, and what each is for.
- 03
Compare both lists with the policy
Every service and every data type should appear. Anything in the policy that you don't use should come out.
- 04
Repeat on every release
Each new integration adds a recipient. The rules file for AI builders asks your agent to flag new services.
SafeLaunch does all four automatically: it reads your notice, lists the services the site contacts (in a real browser on paid audits) and in code, traces form fields, and reports each mismatch with the article cited. Launch Fix then drafts a privacy notice, cookie notice and terms written for your product.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading