Template · Legal
Website privacy policy starter
A plain-language privacy policy for a small charity's website: what you collect, why, who you share it with, cookies, children, choices and how to contact you.
Three editable formats: Word (.docx), Rich Text (.rtf) and plain text (.txt). Reviewed October 21, 2026.
How to use this template
- Download it as a Word file (.docx), which opens in Microsoft Word, Google Docs, Pages and LibreOffice, or as Rich Text (.rtf) or plain text (.txt). All three are editable.
- Fill in every blank. Blanks are in square brackets, like [ORGANIZATION NAME], and are highlighted in the preview below. Delete any bracketed notes you don't need.
- Make it yours. Check it against your bylaws and your state's rules, and change anything that doesn't fit. Have your board approve it where it says so.
- Printing? Print this page: the printout leaves out the site's menus and shows the template with lines for the blanks.
A privacy policy tells visitors, donors and volunteers what information your charity collects through its website, why, and what you do with it. Writing one is also a useful check: if you can't explain why you collect something, you probably shouldn't. Our data privacy basics guide explains the principles behind it.
Why have one
Some state laws require a posted privacy policy, and a law can apply to you because of where your visitors live. One example is the California Online Privacy Protection Act (CalOPPA). The California Attorney General says it requires operators of commercial websites and online services that collect personally identifiable information on California consumers to conspicuously post a privacy policy.
The law itself (Business and Professions Code § 22575) says the policy must:
- the categories of personally identifiable information you collect,
- the third parties you share it with,
- any process people have to review and request changes to their information,
- how you'll tell people about material changes to the policy,
- its effective date,
- how you respond to browser "do not track" signals, and
- whether other parties may collect information about a person's online activities over time and across sites when they use your site.
The same section says an operator is in violation of the posting requirement only if it fails to post its policy within 30 days after being notified. The law is written for "commercial" websites, and whether it applies to a particular charity's site is a question for a lawyer. Other states have their own privacy laws, which differ, so the safest course is to post a clear policy whatever your size, and follow it.
If your website is directed to children under 13, or you know you collect personal information from them, the FTC's COPPA rule may apply. The FTC says COPPA applies to commercial websites and online services, not to nonprofits that would otherwise be exempt from the FTC Act. Even so, a charity that collects children's information online should get legal advice first, and should avoid collecting it if it can.
How to adapt it
- Describe what you really do. A privacy policy that doesn't match your practices is worse than none. List every form, tool and plug-in on your site: donation pages, newsletter sign-ups, volunteer forms, analytics, embedded videos, social media buttons.
- Ask your providers. Your donation processor, email platform and website host collect data too. Their own terms say what they do with it.
- Delete what doesn't apply, and add anything that's missing.
- Keep the language plain. Use short sentences. Translate it into the languages your community reads.
- Link it from every page, usually in the footer, and from every form that collects personal information.
- Review it once a year, and whenever you add a new form or tool. Change the "last updated" date when you do.
Preview
Privacy policy
[ORGANIZATION NAME]
Last updated: [DATE]
[ORGANIZATION NAME] ("we", "us") is a nonprofit organization based in [CITY, STATE]. This policy explains what personal information we collect through [WEBSITE ADDRESS], why we collect it, how we use and share it, and the choices you have. If you have questions, contact us using the details at the end.
Information we collect
Information you give us. We collect information you choose to give us, for example when you:
- make a donation: [NAME, EMAIL, POSTAL ADDRESS, DONATION AMOUNT, AND ANY DEDICATION]
- sign up for our newsletter: [NAME AND EMAIL ADDRESS]
- apply to volunteer: [CONTACT DETAILS, AVAILABILITY AND ANY OTHER FIELDS ON THE FORM]
- contact us: [WHATEVER YOU INCLUDE IN YOUR MESSAGE]
- [OTHER FORMS, FOR EXAMPLE EVENT REGISTRATION OR REQUESTS FOR HELP]
We don't receive or store your full card or bank details. Payments are handled by our payment processor, [PAYMENT PROCESSOR NAME], under its own privacy policy.
Information collected automatically. When you visit our website, we [and our website host and analytics provider] may collect technical information such as your IP address, browser type, the pages you visit and how you arrived at our site. [DESCRIBE ANY ANALYTICS TOOL YOU USE AND WHAT IT COLLECTS, OR DELETE THIS PARAGRAPH IF YOU DON'T USE ONE.]
Cookies and tracking
Cookies are small files a website stores on your device. We use cookies [ONLY TO MAKE THE SITE WORK / TO MAKE THE SITE WORK AND TO UNDERSTAND HOW IT IS USED]. [LIST ANY THIRD-PARTY TOOLS, SUCH AS EMBEDDED VIDEOS, SOCIAL MEDIA BUTTONS OR ADVERTISING PIXELS, THAT MAY COLLECT INFORMATION ABOUT YOUR ACTIVITY ON OUR SITE AND OTHER SITES.]
Do Not Track. Some browsers send a "Do Not Track" signal. [EXPLAIN HOW YOUR SITE RESPONDS, FOR EXAMPLE: "Our website does not currently change what it does when it receives a Do Not Track signal."]
You can block or delete cookies in your browser settings. Some parts of the site may not work without them.
How we use your information
We use personal information to:
- process donations and send receipts and acknowledgments
- send newsletters and updates you've asked for
- organize volunteers and events
- answer your questions
- keep our records and meet our legal and tax obligations
- understand how our website is used, so we can improve it
- [OTHER PURPOSES]
We will only use your information in ways that fit why you gave it to us.
Who we share it with
We don't sell or rent your personal information, and we don't trade it with other organizations. [CHECK THIS IS TRUE BEFORE YOU PUBLISH IT.]
We share information only:
- with service providers who help us run our work, such as our website host, payment processor, email platform and donor database, and only for that purpose: [LIST CATEGORIES OR NAMES]
- when the law requires it, or to protect the safety of any person
- [WITH YOUR PERMISSION, FOR EXAMPLE IF YOU ASK US TO TELL A HONOREE ABOUT YOUR GIFT]
How long we keep it
We keep personal information only as long as we need it for the purposes above, or as long as the law requires, under our document retention policy. [GIVE EXAMPLES, SUCH AS: "We keep donation records for [NUMBER] years for tax purposes."]
How we protect it
We use reasonable safeguards, such as limiting access to people who need it, using strong passwords and two-step login, and choosing providers that protect data. No website or system is completely secure. If a breach affects your personal information, we will tell you as the law requires.
Your choices
- Emails: you can unsubscribe at any time using the link in any email, or by contacting us.
- Your information: you can ask to see, correct or delete the personal information we hold about you by contacting us at [EMAIL]. We'll respond within [NUMBER] days. We may need to keep some records, such as donation records, where the law requires it.
- Postal mail and phone: tell us if you'd like us to stop.
Children
Our website is not directed to children under 13, and we don't knowingly collect personal information from them online. If you believe a child has given us personal information, contact us and we'll delete it. [IF YOUR SITE IS FOR CHILDREN, OR YOU COLLECT CHILDREN'S INFORMATION ONLINE, GET LEGAL ADVICE AND REPLACE THIS SECTION.]
Links to other sites
Our website may link to other websites, such as social media or partners' sites. Their privacy practices are their own, and this policy doesn't cover them.
Changes to this policy
If we make important changes, we'll update the date at the top and [POST A NOTICE ON OUR HOMEPAGE / EMAIL PEOPLE ON OUR LIST]. The current version will always be at [PRIVACY POLICY ADDRESS].
Contact us
[ORGANIZATION NAME] [POSTAL ADDRESS] Email: [EMAIL] Phone: [PHONE]
Template from Golden Hint: goldenhint.org/resources/templates/privacy-policy-starter. Reviewed October 21, 2026. General information, not legal or tax advice.
General information. Not legal, tax or financial advice. Rules change and every situation is different, so check the official sources and talk to a qualified professional before you act. More about this.
Keep going
- GuideDirectors and officers (D&O) insuranceWhat D&O insurance covers and leaves out, who needs it, and how it fits with the federal Volunteer Protection Act and state rules for volunteer board members.
- GuideFiling your first Form 990Which return your charity files (990-N, 990-EZ or 990), when it's due, how to file, what's public, and what happens if you miss it.
- Founder pathwayStaying compliantThe yearly duties that keep your charity in good standing: state registration, the Form 990 family, public disclosure, donor receipts and the political rules.
- Founder toolCompliance calendarYour charity's federal and state deadlines for the year, from your year end and state.
Sources
Checked on October 21, 2026. Rules and fees change, so follow the links for the current version.
Was this page useful?
Need help with something specific? Ask a person.