Do you need a privacy policy on a small website?

The site is live. The contact form stores messages. There is no privacy page in the footer.

A Lovable preview, a Webflow page, or a static host can look finished without one. The gap shows up the first time someone asks what you do with their email.

I am not a lawyer, and this is not advice for your country. Read the rules that apply to your audience. Ask someone qualified if the traffic is large or the data is sensitive.

Write down what already lands in a database

A brochure with no forms and no trackers can wait. Add a policy when you start storing visitor details.

These are the usual collection points on a small site:

• A contact form, waiting list, or newsletter field that keeps an email
• A download that asks for an address before sending the file
• A job application with a CV
• A quote form with a name, a message, or an uploaded brief
• Visitor analytics, even when it does not set a cookie
• Payments, accounts, or a third-party pixel

A form that only shows “Thanks” in the browser still needs a notice if the message is stored. So does cookieless pageview analytics. Sitebase’s analytics hashes a daily visitor from IP, user agent, and site. It does not use a cookie. It still records that someone visited a page.

If the list is empty, you can wait. Write the page when you add the first collection point.

Name the tools you use

Search results are full of templates that list Google Analytics, Mailchimp, and Stripe. Visitors notice when your site uses none of those.

Write the services you pasted in. If you collect emails through a waiting list, say that. If a form posts to Sitebase, write that. If you use Cloudflare Turnstile on a public form, say that. If you do not run ads, skip the advertising section.

Keep it short. Name, email, and “we use this to reply” is clearer than a paragraph about processing activities.

Say who you are and how to reach you

A usable privacy page answers questions a visitor can check.

Who operates the site. What you collect. Why you collect it. Which services store it. How long you keep it. How someone can ask you to export or delete their details.

Put a contact email on the page. Use an address you read. A form that stores inquiries needs a way for that same person to ask what you kept.

If you later add a pixel or a payment provider, update the page. The notice has to match the live site, not last month’s draft.

A cookie banner is a different job. It asks for consent before optional scripts run. The policy explains the collection. Follow the cookie banner guide if you still need to decide about that prompt.

Put the page where people can find it

The notice has to be reachable from the public site. A footer link is the usual place. Link it from any form that collects an email, and from a cookie banner if you have one.

You can host the page on your own domain. You can also use a hosted document and link it.

Sitebase’s legal pages host a privacy policy, terms of service, and cookie policy. You answer a questionnaire about the operator and what the site uses. That produces a markdown draft you edit before publishing. Treat the draft as starting text, not legal advice. Unpublished documents stay off the public URL.

Sitebase is in private beta. Public signup isn’t open.

The hosted privacy page looks like this. Replace YOUR_LEGAL_KEY with the key from your dashboard:

<footer>
  <nav aria-label="Legal">
    <a href="https://sitebase.dev/embed/YOUR_LEGAL_KEY?variant=privacy">Privacy policy</a>
  </nav>
</footer>

?variant=terms and ?variant=cookie_policy are the other two documents. Without a variant, the URL lists every published page.

If you would rather render the text inside your own layout, the same feature has a script snippet with data-sitebase-variant="privacy". Saving a published document updates the live page. Unpublishing replaces it with a placeholder and keeps your draft.

If you also use Sitebase’s cookie banner, point the banner’s cookie policy link at the hosted cookie_policy URL so the two stay in sync.

Read it on the public URL

Open the published site in a fresh window. Click the footer link. Read the page against the list you wrote down.

Does it name the forms you run? Does it skip tools you never added? Can you send the contact email?

Submit a test inquiry or signup you control. Check that the stored record matches what the policy describes. Then complete the other checks in the launch checklist.