Does my small business website need a privacy policy?
The short answer
If your site collects anything about visitors — a contact form, a booking, a mailing list, or analytics — then yes, in most jurisdictions. The threshold is much lower than people assume: analytics alone usually triggers it. A short, accurate page describing what you collect and why is enough for a small business, and it is better than a long generic one copied from elsewhere.
On this page
The threshold is lower than you think
The common assumption is that privacy policies are for large companies handling sensitive data. They are not. The trigger is generally collecting personal data at all, and small business sites collect more than their owners realise:
- A contact form — name, email, message
- A booking — name, phone, sometimes dietary or health notes
- A mailing list signup
- Analytics, which typically involves identifiers and often an IP address
- A chat widget
- Anything embedded that sets cookies
Analytics alone usually crosses the line, which catches most sites — including plenty that believe they collect nothing.
This is not legal advice, and specifics vary by jurisdiction. But the practical answer for nearly every small business site is: you need one, and it is not difficult.
What the page should actually say
Plain language, and specific to you. The useful shape:
What you collect. List it concretely — form submissions, booking details, analytics data. Not "certain information may be gathered".
Why. To answer enquiries, take bookings, understand which pages are used.
Who else sees it. Your booking system, your email provider, your analytics tool. Name them. This is the section most copied templates get wrong, because the template names services you do not use and omits the ones you do.
How long you keep it, and what happens then.
How someone gets it deleted. An email address that a person actually reads.
Your contact details, so the page has an accountable owner.
The copied-template trap
The instinct is to find a policy you like and adapt it. The problem is that a privacy policy is a factual description of your practices, so a copied one is usually inaccurate the moment it lands.
Worse, an inaccurate policy is arguably a bigger problem than a missing one, because you have made a specific written claim about your handling of people's data that does not match what you do. If your policy says you do not use analytics and you do, that is a statement you cannot defend.
If you start from a template, go through it line by line and delete everything that is not true of you. The result will be much shorter, and it will be correct.
Cookie banners, honestly
Separate from the policy, and the source of most of the irritation.
If you set only strictly necessary cookies, you generally do not need a consent banner. If you use analytics or anything advertising-related, you generally do, and in several jurisdictions consent must be given rather than assumed — meaning a banner that says "by continuing you agree" is not doing what it looks like it is doing.
The practical simplification: if you can live without behavioural analytics, or use a tool that avoids personal identifiers, the requirement often gets much lighter. Fewer things collected is fewer things to explain, and it is the only approach that reduces work rather than adding to it.
What else belongs on a business site
Rules vary, but commonly expected:
| Page | When you need it |
|---|---|
| Privacy policy | You collect anything at all |
| Cookie notice | You set non-essential cookies |
| Terms | You sell or take bookings online |
| Business details | Company name, registration and address, in many jurisdictions |
Unglamorous, quick to produce, and the sort of thing that only becomes expensive when someone asks for it and it is not there.
The policy is shorter when the site collects less
A privacy policy is a description of what you actually do. So the cheapest way to make one both simple and true is to collect less in the first place.
Most small business sites collect three things: whatever people type into a contact form, whatever the analytics records, and whatever any embedded third party takes on its own initiative. The third is the one nobody accounts for and it is usually the largest — an embedded map, a video, a chat widget, a font served from someone else's domain.
Helm's own side of that is deliberately narrow. Analytics uses no cookies to identify anyone; the session lives in the browser's own session storage. Visitor IP addresses are hashed rather than kept, so there is no raw address sitting in a table waiting to be described in your policy. Form submissions are yours, held in your dashboard, and pruned automatically rather than accumulating for ever.
That does not write the document for you, and you should still say plainly what you collect and why. It does mean the honest version is short — which is the only kind anybody reads.