ATF PRIVACY BUILDER
Fintech privacy policy draft generator · v1.0
Runs entirely in your browser
Business basics
These populate the identity section of your policy. Nothing is sent anywhere.
Where are your users?
Obligations follow your users, not your incorporation. Select every region you serve.
CCPA thresholds — do any apply?
Regulatory status
The GLBA definition of "financial institution" is broader than most founders expect. Enabling technology can qualify.
Other regimes that may apply
What data do you collect?
Be honest here. The policy must describe what your systems actually do, not what you intended.
Tracking on your site
Open devtools, load a page with a form, and watch the network tab. Every outbound call to a domain you do not own belongs here.
Who receives the data?
Categories of processors and recipients. Name the specific vendors in your final document.
Do any of these transfer data outside your users' region?
Automated decisions
If an algorithm affects access, pricing or credit, GDPR Article 22 and new CCPA ADMT rules become relevant.
Retention periods
This is the section most policies get wrong. Set a real number per category, or say what determines it.
CategoryKeep forDriver
KYC / identity recordsAML statute
Transaction recordsFinancial reporting
Account and profile dataContract
Marketing contact dataConsent
Analytics and logsLegitimate interest
Support and chat logsDispute defence
BackupsResilience
Backup check. If your backup rotation is longer than any retention promise above, your policy is inaccurate the day you publish it. Deletions must propagate through backups within the period you state.
Rights and security
Only claim mechanisms that already work. A rights request you cannot fulfil in time is a violation in slow motion.
How can users exercise their rights?
Security controls in place
Your draft is ready
Review the flags first, then the draft. This is a starting point for your lawyer, not a finished document.
Regimes that likely apply
Risk flags
This tool produces an unreviewed draft for internal use. It is not legal advice and does not create an attorney-client relationship. Regulatory requirements vary by jurisdiction and change frequently. Have a qualified lawyer review any privacy policy before publishing it for a regulated financial service. Nothing you enter is transmitted, stored or logged — the tool runs entirely in your browser.
