A small business website privacy policy tells visitors what happens to the information they give you. On a typical service site that means the quote form, the phone number they tap, analytics, and the company that hosts the site. It is not a place to paste a policy from another industry and hope it fits.
This is a content guide, not legal advice. Rules differ by state and by what you collect. If you run ad pixels, sell customer lists, or take payments on the site, have a lawyer review the page before you publish it. A web design scope can place the page and write a plain first draft. It cannot replace that review.
Say what you actually collect
List the real paths on your site. For many US service businesses the list is short:
- Quote or contact form. Name, phone, email, city, and the job they described.
- Phone and email links. You receive the call or the message. The site itself may not store a recording unless a call-tracking tool does.
- Analytics. Pages visited, rough location, device type. Name the product if you use one, such as a privacy-friendly analytics tool or Google Analytics.
- Hosting and email. The company that serves the site and the inbox that receives form mail.
- Embedded media. A map, a chat widget, or a YouTube video can set its own cookies. If those embeds are on the site, mention them.
If you do not run a shop, do not claim you store credit cards. If you do not sell data, say you do not sell personal information. Only write that if it is true.
The form that collects the lead should match this page. The fields and the follow-up are discussed in the guide to estimate forms for service businesses. Link the form to the privacy page in a quiet line under the button, not in a modal that blocks the form.
Cookies, in one honest paragraph
A cookie notice is the short version. The policy is the longer one.
Say whether you use:
- A cookie that remembers a form or a login, if you have a customer login
- Analytics cookies
- Advertising cookies, if a pixel from an ad platform is installed
If the site is a brochure and a form, and you are not running ad pixels, do not announce a complicated consent banner you copied from a store. Say what you use. If you add a pixel later, update the page the same week. Security headers for marketing sites are a separate topic. They protect the browser connection. They are not a privacy policy.
Who you share information with
Name categories, not a fantasy list of partners:
- The person at your company who answers the form
- Your website host and email provider
- A financing company, only if the customer chooses to apply and you send them there
- A lawyer or insurer, if a dispute requires it
Say how long you keep quote requests. “Until the job is done, plus the period we keep invoices” is clearer than “indefinitely,” and you should match it to what the inbox actually does. If you have no retention habit, the policy should not invent one. Decide the habit, then write it down.
What visitors can ask you to do
Give a real contact: the same email or phone you publish elsewhere. For WebSolNet that is info@websolnet.com and (850) 610-7214. Your page should use your own contacts, not a form that nobody checks.
In plain language, tell people they can ask what you hold from a form submission and ask you to delete a quote request you no longer need. If a state law gives residents extra rights, your lawyer can add that section. Do not copy California language onto a site that never serves California customers unless counsel tells you to.
Where the page lives
Give it a stable URL such as /privacy/ and link it from the footer of every page. Keep it out of the main service menu so it does not compete with the pages that earn calls.
The title can be direct. “Privacy Policy” plus your business name is enough. Do not stuff city names into it.
When the site is redesigned, keep this URL or redirect the old one. A missing privacy link is one of the details that makes a new site feel unfinished. The web design scope should include the page, the footer link, and a note about who updates it when tools change.
Basic site security, such as updates and admin access, is covered in WordPress security basics for owners. Mention in the policy that the site is served over HTTPS if that is true. Do not claim certifications you did not earn.
Review the page when the stack changes
Update the policy when you:
- Add a chat widget, a pixel, or a new form tool
- Switch hosts or analytics
- Start taking payment or applications on the site
- Stop using a tool the policy still names
Put the month and year of the last update at the top or the bottom. An undated policy that mentions a tool you removed is worse than a short page that matches the site.
FAQ
Can I copy another company’s privacy policy?
No. Their tools, states, and data uses are not yours. A copied policy is how you end up promising a customer portal you do not have, or staying silent about a pixel you do.
Do I need a cookie banner?
You need an accurate description of the cookies you use. Whether you also need a consent banner depends on the tools and the visitors you serve. That is a legal question. A design project can implement the choice after you make it.
Should the policy name every plugin?
Name the ones that collect visitor data: forms, analytics, chat, embeds, payments. You do not need a paragraph for a slider that never sees personal information.
Is the privacy page bad for SEO?
It will not rank for your services, and it should not try. Give it a clear title, a real description, and a footer link. Keep service keywords on the service pages.
Write the page you can keep true
A small business website privacy policy should match the form, the analytics, and the host you use today. Keep it plain, date it, and change it when the stack changes. Have counsel review it when the site collects more than a quote request.
Contact WebSolNet at (850) 610-7214 if you want the page included in a new site. Launch is $800, Grow is $1,200, and Scale starts at $2,000. The draft still needs your confirmation that the tools list is complete.
