> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Organization: Acme Inc

## Purpose

This document compares your generated privacy policy against industry standards and best practices. It identifies gaps, provides recommendations, and benchmarks against privacy policies from leading technology companies.

For questions about this comparison, contact legal@acme.com.

## Coverage Score

23 / 23 items covered (100%)

#################### 100%

Excellent coverage. Your privacy policy meets or exceeds industry standards.

## Checklist Comparison

# | Section | Covered | Regulation | Industry Standard
--- | --- | --- | --- | ---
1 | Data Controller Identity | Yes | GDPR Art. 13(1)(a) | Stripe, Vercel, Linear
2 | DPO Contact Information | Yes | GDPR Art. 13(1)(b) | Stripe, Vercel, Linear
3 | Types of Data Collected | Yes | GDPR Art. 13(1)(d) | Stripe, Vercel, Linear
4 | Purpose of Processing | Yes | GDPR Art. 13(1)(c) | Stripe, Vercel, Linear
5 | Legal Basis for Processing | Yes | GDPR Art. 13(1)(c) | Stripe, Vercel, Linear
6 | Data Retention Periods | Yes | GDPR Art. 13(2)(a) | Stripe, Vercel, Linear
7 | User Rights (Access, Rectification, Erasure, Portability) | Yes | GDPR Art. 13(2)(b-d) | Stripe, Vercel, Linear
8 | Third-Party Data Sharing | Yes | GDPR Art. 13(1)(e-f) | Stripe, Vercel, Linear
9 | International Data Transfers | Yes | GDPR Art. 13(1)(f) | Stripe, Vercel, Linear
10 | Cookie Policy / Tracking Technologies | Yes | ePrivacy Directive Art. 5(3) | Stripe, Vercel, Linear
11 | AI / Automated Decision-Making Disclosure | Yes | GDPR Art. 22, EU AI Act | Notion, Linear, Vercel
12 | Children's Privacy (COPPA) | Yes | COPPA, GDPR Art. 8 | Stripe, Notion, GitHub
13 | Security Measures | Yes | GDPR Art. 32 | Stripe, Vercel, Linear
14 | Consent Collection / Withdrawal | Yes | GDPR Art. 7 | Stripe, Vercel, Linear
15 | Right to Lodge a Complaint | Yes | GDPR Art. 13(2)(d) | Stripe, Vercel, Linear
16 | Policy Update Notification | Yes | Best practice | Stripe, Vercel, Linear
17 | Contact Information for Privacy Inquiries | Yes | GDPR Art. 13(1)(a) | Stripe, Vercel, Linear
18 | CCPA-Specific Disclosures | Yes | CCPA/CPRA | Stripe, Vercel, Notion
19 | Do Not Sell My Personal Information | Yes | CCPA Sec. 1798.120 | Stripe, Notion, GitHub
20 | Data Breach Notification Procedures | Yes | GDPR Art. 34 | Stripe, Vercel
21 | Sub-Processor List | Yes | GDPR Art. 28(2) | Stripe, Vercel, Linear
22 | Data Portability | Yes | GDPR Art. 20 | Stripe, Linear, Notion
23 | EU Representative | Yes | GDPR Art. 27 | Stripe, Notion

## Industry Benchmarks

How leading companies handle their privacy policies:

### Stripe

Privacy Policy: https://stripe.com/privacy

Strengths:

- Comprehensive sub-processor list with change notification
- Clear data flow descriptions per product
- Jurisdiction-specific addenda (EU, UK, Japan, Brazil)
- Dedicated privacy center with visual data map

Notable Features:

- Interactive privacy center
- Per-product data processing details
- Published DPA template
- Regular sub-processor change notifications

### Vercel

Privacy Policy: https://vercel.com/legal/privacy-policy

Strengths:

- Clear distinction between customer data and visitor data
- Specific analytics data collection disclosure
- Edge function data processing transparency

Notable Features:

- Developer-friendly privacy documentation
- Clear data residency information
- Published sub-processor list

### Linear

Privacy Policy: https://linear.app/privacy

Strengths:

- Concise yet comprehensive privacy policy
- Clear AI feature data usage disclosure
- Specific data retention periods

Notable Features:

- AI feature transparency
- Clear data minimization practices
- SOC 2 Type II reference

### Notion

Privacy Policy: https://www.notion.so/Privacy-Policy

Strengths:

- Detailed AI training data opt-out
- Comprehensive third-party service disclosure
- Clear data portability instructions

Notable Features:

- AI training data transparency
- Workspace admin controls documentation
- Data export functionality highlighted

### GitHub

Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement

Strengths:

- Extremely detailed data collection inventory
- Repository data handling specifics
- Copilot AI data usage transparency

Notable Features:

- Per-feature data collection breakdown
- Open-source policy approach
- Detailed telemetry disclosure

## Recommendations

### Priority Actions

All checklist items are covered. Consider the following enhancements to further align with industry leaders:

- Add an interactive privacy center (like Stripe)
- Publish per-feature data collection breakdowns (like GitHub)
- Provide visual data flow diagrams in your privacy policy
- Add jurisdiction-specific addenda for key markets
- Implement a privacy policy changelog with version history

## Improving Your Score

To improve your privacy policy coverage, update your `.codepliantrc.json` configuration:

    {
      "companyName": "Your Company Name",
      "contactEmail": "privacy@yourcompany.com",
      "dpoName": "Jane Doe",
      "dpoEmail": "dpo@yourcompany.com",
      "euRepresentative": "EU Rep Name, Address",
      "dataRetentionDays": 365,
      "jurisdiction": "GDPR",
      "jurisdictions": ["GDPR", "CCPA"]
    }

Each configured field enables additional privacy policy sections that align with regulatory requirements.

## Review Schedule

This comparison should be reviewed:

- Quarterly to track improvement progress
- When updating your privacy policy
- When adding new third-party services
- When entering new geographic markets

This privacy policy comparison was generated by Codepliant based on automated code analysis. This is an internal assessment tool and does not constitute legal advice. Consult with a qualified privacy attorney for compliance guidance.