Website privacy, terms, and contact pages: a practical starting point

An old or generic privacy template can describe cookies your site does not set and miss services you actually use. For a five-page brochure site the legal side is genuinely small, but it isn’t zero, and it gets bigger the moment you add a contact form, a booking tool, a newsletter, or analytics. This guide helps you draft three useful pages and identify obligations that need a separate check.

This is practical setup guidance, not legal advice. We’re a website-cost site, not a law firm. If your business handles health, financial, or children’s information, or you’re unsure whether any of this applies to you, a short conversation with a lawyer is money well spent, and the sections below will make that conversation faster.

The principle that makes this simple

A useful starting principle is: tell people what you collect, why, and who sees it, then collect only that. A site that collects almost nothing has almost nothing to explain. That is why we keep pointing you toward cookieless analytics, forms that ask for the minimum, and tools that don’t track. The cheapest compliance strategy is not needing much.

Page 1: Privacy

The page should be readable by a customer, not a lawyer. Write it as answers to five questions:

What do we collect? List it concretely. “Your name, email address, and message when you use the contact form. The pages you visit, in aggregate, through Cloudflare Web Analytics, which does not use cookies or identify you.”
Why? “To reply to your enquiry. To see which pages are useful.”
Who else sees it? Name the services: the form tool, the booking tool, the email provider, the payment processor. Each of these is a third party that holds some customer data on your behalf.
How long do we keep it, and how do you get it removed? State the actual retention period or criteria, the contact route for a request, and any applicable exceptions for records you must retain. Do not promise unconditional deletion if the business cannot lawfully provide it.
Who’s responsible and how do you reach them? A name or role and an email address.

Then add a plain sentence about cookies. If you have checked the actual site and embedded services and they set none, say so; it’s a selling point. If it sets one for a preference, as ours does for the CA/US switch, name it and say what it does. If a tool you embed sets cookies, say which tool and why.

Canada: the federal law is PIPEDA, which applies to personal information collected in the course of commercial activity, and British Columbia, Alberta, and Quebec have substantially similar private-sector laws for covered activity within those provinces. PIPEDA can still apply to interprovincial or international transfers and federally regulated businesses; review the actual scope. The Privacy Commissioner publishes plain-language guidance for businesses. Quebec's Law 25 adds specifics: a named person responsible for the protection of personal information (by default the person in charge of the business), their title and contact details published, and a privacy policy written in clear language. Quebec businesses should also review whether the site's customer-facing content meets French-language requirements. The Commission d'accès à l'information is the authority.

United States: privacy obligations vary by state, activity, and data. California's CCPA has coverage thresholds, but those are not a blanket small-business exemption from other laws. CalOPPA covers commercial website and online-service operators collecting personally identifiable information online about California consumers and requires a posted privacy policy. Describe your actual practices and review the relevant state rules. Children's information can bring COPPA into scope; HIPAA applies to covered entities and business associates, rather than every business that happens to collect a health detail. Sensitive or regulated activity warrants qualified review.

Email deserves its own paragraph

If you send marketing email, the rules are stricter than for a website, and the free tools in the tools stack help with parts of the process: a real sender name, a working unsubscribe link, and your postal address in the footer.

Canada: CASL requires consent before you send commercial email, and you must be able to show that consent. A contact-form enquiry is not consent to a newsletter; an optional, unchecked signup box with the required information can provide express consent when the person actively chooses it. Keep the record of when and how each person agreed. Existing customers give you a limited implied consent for a period after a purchase, but an explicit opt-in is simpler to defend.

United States: CAN-SPAM is an opt-out law: you can send without prior consent, but every message needs accurate header information, an honest subject line, your physical postal address, and an unsubscribe route honoured within ten business days. Most small businesses still run opt-in lists because they perform better.

Page 2: Terms

For a brochure site, “terms” mostly means managing expectations: prices on the site are indicative and may change, the information is provided as a guide, links to other sites are not endorsements, and you’re not liable for someone acting on a blog post. If you sell or take bookings through the site, terms grow to cover payment, cancellation, refunds, and delivery, and this is where a template from your payment or booking tool is a reasonable start.

Write it in the same plain voice as the rest of the site. A terms page nobody can read protects nobody.

Page 3: Contact (that actually works)

The least glamorous and most tested page. Every privacy law above assumes someone can reach you, and so does every customer. The page needs:

An email address at your domain that a person reads. Not a form alone, because forms break silently. The free business email guide sets one up in an afternoon.
Your business’s legal name and, where you have one, a postal address. Both Canadian and US email rules require an address in marketing email anyway.
Your phone number, if you take calls, formatted so phones make it tappable.

Send yourself a message through every route on the page once a quarter. A contact page whose form goes nowhere is worse than none, because customers assume you ignored them.

Accessibility, briefly

Review whether customers can read, contact, book, and pay using a keyboard or assistive technology. A simple static site, builder template, high scan score, or AI response does not establish accessibility conformance. W3C explains that preliminary checks can miss significant barriers. Follow the practical accessibility review and record fixes and retests.

Canada: Ontario’s specific public-website rule covers designated public-sector organizations and businesses or nonprofits with 50 or more employees. Read Ontario’s guidance for scope and exceptions. Smaller size is not a Canada-wide exemption from every accessibility obligation.United States: DOJ’s guidance for businesses open to the public describes the ADA Title III context. State and local government’s Title II deadlines should not be applied indiscriminately to private businesses.

Our own pages, as a worked example

We eat our own cooking. Our privacy page is written to the five questions above: it lists what is collected (aggregate, cookieless analytics and the host’s standard request logs), says outright that no Google Analytics is used, names the one functional preference the CA/US switch saves and what happens if you clear it, explains which tools keep data only in your browser and which share links carry your entries in the address, and says who to contact. Our terms page covers price accuracy, affiliate links, and content use in plain language. Copy the structure, not the words: your pages must describe your site.

When to pay a lawyer

Get qualified advice if any of these are true: you collect health or financial details; you serve children; you sell across borders at scale; you run a membership or subscription; or you’ve received a complaint or legal letter. These pages are a starting point. Applicable privacy, accessibility, consumer, and sector obligations depend on the business and actual customer journey; writing three pages does not resolve every obligation.