A Note, Not a Policy: The Privacy Page You'd Actually Want to Read

Scroll to the bottom of almost any creative's website and you'll find the same three links: Contact, Terms, Privacy. Two of them get clicked. The third sits there like a fire extinguisher behind glass — technically reassuring, rarely examined, and often written by someone who last saw daylight in 2014.

That's a shame. The privacy page is one of the few places on a personal site where you can be completely straightforward. No portfolio polish, no clever copy. Just a plain answer to a fair question: what happens to my information if I get in touch?

Why bother when hardly anyone reads it

Fair challenge. Most visitors will never open your privacy page. But the ones who do tend to be the ones who matter: a client checking you're not a cowboys outfit, a journalist doing due diligence, a fellow freelancer who wants to know whether your newsletter is worth the inbox space. A generic wall of legalese tells them nothing except that you copied it from a template. A short, human note tells them you've actually thought about it.

There's a practical angle too. If you run a contact form, a newsletter, or any kind of analytics, you're handling personal data. Under UK GDPR and PECR, you're expected to tell people what you're doing with it. You don't need a law degree to get the basics right, but you do need to say something honest. The ICO has decent plain-English guidance for small organisations, and it's worth half an hour of your time.

What a privacy note actually needs to say

You don't need to cover every edge case. You need to answer the questions a reasonable person would ask. Six things, roughly:

• Who you are and how to reach you. A name, an email address, maybe a postal address if you have one. That's it.
• What you collect. Analytics data, server logs, contact form details, newsletter sign-ups, cookies. Be specific about the categories.
• Why you collect it. 'To see which pages people read' is a reason. 'To improve user experience' is a fog.
• How long you keep it. 'Until you ask me to delete it' is acceptable if that's true. 'Indefinitely' is not a great look.
• Who else sees it. Your hosting company, your email provider, your newsletter platform, your analytics tool. Name the categories, not necessarily every supplier.
• How to say no. Unsubscribe links, deletion requests, cookie settings. Make the exit as clear as the entrance.

That's the whole skeleton. Everything else is decoration.

The bits people genuinely worry about

When someone lands on your privacy page, they're usually wondering one of three things. Am I going to get spammed? Is this site tracking my every move? And who actually reads what I type into that contact form?

Answer those directly and you're most of the way there. If you use Google Analytics 4, say so. If you use Plausible or Fathom, say that too — those are lighter-touch and people appreciate knowing. If your site sets no cookies at all, say it plainly: 'This site doesn't use cookies.' That's a genuinely nice thing to read.

Contact forms are worth a sentence. Where does the message go? Straight to your inbox, into a CRM, through a form service like Formspree? If it's just you reading it, say 'I read every message myself.' That's not legal boilerplate. That's a trust signal.

Newsletters need the same treatment. Which platform do you use? Does it track opens? Is there a one-click unsubscribe? You don't need to write an essay. A couple of lines will do.

Write it like a person, not a legal department

Here's the test I use: read the page aloud. If you wouldn't say it to a client over a cuppa, rewrite it. 'We may share your data with third-party processors for the purpose of service delivery' becomes 'I use a few tools to run this site — my hosting company, my email provider, and my newsletter platform. They only see what they need to.'

Use the first person if you're a sole trader. 'I' is warmer than 'we' and more accurate if there's only one of you. If you're a small studio, 'we' is fine, but keep it consistent.

Don't pretend to be a lawyer. You're not giving legal advice; you're telling people what you do. A line near the top like 'This is a plain-English note, not legal advice' sets the right tone and keeps everyone honest.

A skeleton you can adapt

Here's a structure that works for most personal sites and small studios:

1. A short intro: who you are and what this page is.
2. What I collect: analytics, forms, newsletter, cookies.
3. Why I collect it: one line each.
4. How long I keep it: be honest.
5. Who else is involved: hosting, email, analytics, newsletter.
6. Your choices: unsubscribe, deletion, cookie settings.
7. How to contact me: one email address.
8. Last updated: a date.

That's it. You can write it in under 500 words. You can link it from the footer and forget about it until something changes.

The small print about the small print

You don't need to name every supplier unless you want to. You don't need a cookie banner if you're not setting non-essential cookies — check what your tools actually do, because the answer varies. And you don't need to update the page every five minutes. Once a year, or whenever you add a new tool, is plenty.

What you do need is a date. 'Last updated: November 2026' tells people the note is alive. A page with no date feels like it was written by a ghost.

Spend twenty minutes on this. Write it in your own voice. Read it back. Then put it in the footer and get on with the work that pays the bills. The privacy page will never be your most visited URL, but it might be the one that makes a stranger trust you just a little bit more.