Does a SaaS need a privacy policy and terms?

A privacy policy explains data handling; Terms of Service set the rules of use. Most SaaS products publish both, and many add a Cookie Policy.

What is a subprocessor?

A third-party service that processes personal data on your behalf, such as hosting, email or payments. GDPR Article 13 asks you to name recipients or categories of recipients.

GDPR (EU) · Platform guide

Privacy policy for SaaS and web apps

A SaaS or web app that collects account data needs a privacy policy. For EU users, GDPR Article 13 lists what to tell people when you collect their data: who you are and how to contact you, the purposes and legal basis, recipients such as subprocessors, how long you keep data, and their rights.

§ 1

What GDPR (EU) requires

Article 13 — Information to be provided

“the identity and the contact details of the controller and, where applicable, of the controller’s representative”

Source: gdpr-info.eu verified 2026-10-30

1.1Purposes and legal basis. Article 13 also requires “the purposes of the processing for which the personal data are intended as well as the legal basis for the processing”. Source: gdpr-info.eu

1.2Retention. State “the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”. Source: gdpr-info.eu

1.3Analytics disclosure. If you use Google Analytics, its terms say “You must disclose the use of Google Analytics, and how it collects and processes data.” Source: marketingplatform.google.com

§ 2

What common SDKs collect

SDK / API	Data it collects	Source
Google Analytics	Cookies or device identifiers Usage events	Source: marketingplatform.google.com
Stripe (payments)	Payment and transaction data Stripe receives as a processor for your business (Stripe calls your customers End Customers)	Source: stripe.com

Everything in this table must appear in your policy if the SDK ships in your build.

§ 3

Where to put the URL

3.1Site footer on every page, and on sign-up and checkout screens.
3.2Link it from your Terms of Service and Cookie Policy.

§ 4

Sample clause

§ 4.1 · Subprocessors

We use trusted service providers (subprocessors) to run the service: our cloud host stores your account data, Stripe processes payments, and our email provider sends account emails. They process data only on our instructions. The current list is at /subprocessors.

Illustrative wording. Your generated policy is written from your own answers.

§ 5

Questions

Does a SaaS need a privacy policy and terms?: A privacy policy explains data handling; Terms of Service set the rules of use. Most SaaS products publish both, and many add a Cookie Policy.
What is a subprocessor?: A third-party service that processes personal data on your behalf, such as hosting, email or payments. GDPR Article 13 asks you to name recipients or categories of recipients.