How to add a privacy policy to Wix, Squarespace, Webflow, or Shopify

Prepare the policy text, then publish it as a normal text page in your builder. Use headings and lists that remain readable on a phone, and keep the page available without sign-in. The exact menu labels vary by builder, but the publication steps are the same:

1. Create a new blank page and name it Privacy Policy.
2. Set a short page URL, such as /privacy-policy, and keep it stable.
3. Add a text block and paste in your policy. If your builder supports rich text paste, headings and lists usually survive. If not, paste section by section.
4. Add the effective date at the top of the page.
5. Hide the page from the main navigation if you prefer, but keep it published and publicly accessible.
6. Open the shared footer and add a text link labelled Privacy Policy that points to the new page. On Webflow, put it in a reusable footer component so it appears on every page.
7. Publish the site and test the link on desktop and mobile in a private window.

If you would rather link to a hosted copy, step 3 becomes a link to the hosted URL, but keep a footer link either way. Our main guide on creating a privacy policy for a website explains what to write before you paste.

Shopify treats store policies as a dedicated part of the admin, and its help center explains how to add a privacy policy alongside refund, shipping, and terms of service policies. Shopify also offers templates, but it reminds merchants that they are responsible for following the policies they publish, so treat any template as a starting point.

What a Shopify privacy policy needs on top of the basics:

• Orders and checkout: names, addresses, order history, and payment handling, including which payment providers process card data.
• Apps: each installed app can access store data. List the apps that process customer information and what they do.
• Marketing: email and SMS marketing, abandoned cart messages, and advertising pixels.
• Fulfilment: shipping carriers and fulfilment services that receive delivery details.
• Customer accounts: login data and saved addresses.

App developers have their own obligations to merchants, covered in our Shopify privacy policy requirements guide. For your store policy, the e-commerce privacy policy generator asks about payments, fulfilment, and marketing providers.

Both approaches work, and the right one depends on how you prefer to maintain the document.

Pasting the policy into a builder page keeps everything on your own domain and inside your builder's design. The downside is manual updates: every time the policy changes, you paste again and check the formatting.

Linking to a hosted policy gives you a stable public URL that you can also paste into app stores, ad platforms, and email tools. Updates happen in one place. The trade-off is that the policy lives on a different page design than your site.

The Website Privacy Policy Generator from Legal Policy Generator supports both. The simple HTML and PDF download is free, and the HTML can be pasted into a builder page. If you want a public web page to link to, optional hosting adds $0.99 once, so an advanced hosted policy totals $5.99, and the $5 monthly subscription includes hosting while it is active. Whichever route you choose, keep the footer link on your own site pointing at the current version.

Every hosted builder processes some visitor data simply to serve pages. Beyond that, what happens depends on the platform and the features you enable.

• Squarespace publishes a list of the cookies it uses on customer sites, split into necessary cookies and non-essential analytics and performance cookies that collect information on the site owner's behalf.
• Wix publishes a help article on cookies and your Wix site, and notes that business solutions such as Wix Stores or Bookings, third-party apps, and integrations like Google Analytics or Facebook Ads may place additional cookies.
• Webflow states in its cookie policy that the cookies described there apply to Webflow's own pages, and that changes customers make, such as enabling Google Analytics or adding custom code, can add cookies to their sites.
• Shopify stores run checkout, customer accounts, and apps that each process customer data.

The lesson is the same everywhere: read your builder's current cookie documentation, then check your live site in a private browser window to see what actually loads. Those findings feed directly into your policy.

Builders make it easy to switch on features with a click, and each one can add a data flow your policy must describe. Go through this checklist for your site:

• Forms: contact, quote, and booking forms store submissions in the builder and often email them to you.
• Email marketing: built-in newsletter tools collect addresses and usually track opens and clicks.
• Online store: orders, shipping addresses, payment processing, and abandoned cart emails.
• Bookings and events: names, contact details, appointment times, and sometimes notes.
• Member areas: account credentials, profiles, and activity.
• Live chat: messages and visitor details.
• Built-in analytics: visit counts, sources, and device details.
• Marketing integrations: Google Analytics, Google Ads, Meta Pixel, and similar tags.
• Third-party apps and code embeds: each app has its own provider and data practices.

For online stores, the e-commerce privacy policy generator covers orders, payments, and fulfilment providers, while the website generator covers content sites and small business pages.

No. A cookie banner collects choices; a privacy policy explains your processing. You usually need both when you have visitors in the EU or UK and use non-essential cookies.

Some builders include a banner. Wix offers a cookie consent banner through a partnership with Usercentrics, and explains that with an active banner only essential cookies and scripts load until a visitor consents to other categories. Squarespace offers a cookie banner with options such as a Decline all button and a Manage cookies button, and notes that the banner restricts some, but not all, connected third-party services. Webflow lists third-party cookie consent tools among its integrations.

Two practical warnings:

1. Test what the banner actually blocks. Embeds, custom code, and some integrations may load regardless of the visitor's choice.
2. Make sure the banner text and your privacy policy describe the same behavior. If tags load before consent, do not claim they wait for it.

For the legal background on when consent is needed, read do you need a cookie banner?

No. This is the most common misunderstanding among site builder users. The builder's privacy policy describes how the builder handles data about its own customers and, in part, about visitors to the sites it hosts. It does not describe your business, your purposes, your newsletter, your analytics choices, or the apps you added.

Squarespace's sample privacy policy text illustrates the split well. It suggests telling visitors that the website is hosted by Squarespace, that Squarespace collects information such as browser and device details, pages visited, and IP address when people visit, and it points to Squarespace's own privacy policy for how Squarespace uses some of that data for its own purposes. That is one paragraph of your policy, not the whole thing.

So think of the builder as one provider among several. Your policy still needs to explain who you are, what you collect through the site, why, who else receives it, how long you keep it, and how visitors can exercise their rights. If you are not sure you need a policy at all, read do I need a privacy policy?

Run through this list before you call the job done:

• The policy names your business and a working privacy contact address.
• Every form, store feature, booking tool, and member area on the site is described.
• The builder is named as a hosting provider, with a pointer to its own policy for the data it uses for its own purposes.
• Analytics, marketing pixels, and embedded content are listed with their providers.
• The cookie section matches what your banner actually does.
• Regional sections match where your visitors are and which laws apply.
• The page is published, publicly accessible, and linked in the footer of every page.
• The link appears near forms and at checkout.
• You saved a dated copy of this version.

For link placement details, including CalOPPA's “conspicuously post” rule, see where to put a privacy policy link. Generated or template text is not legal advice, so ask a qualified adviser if your site handles health, financial, or children's data.