By platform

Privacy Policy Generator for Framer

Written for Framer forms, the CMS, custom code in site settings and third-party embeds.

Generate your privacy policy Read the privacy policy guide

On Framer the privacy policy is short but specific, because the site is usually a marketing front with a handful of deliberately-added tools. Getting it right means opening site settings and listing what is actually there rather than guessing from a template.

Framer sites are usually marketing sites for products and studios, built quickly and instrumented immediately: an analytics script, a scheduling embed, a form that posts to an email tool, and often a chat widget. The platform is light on default tracking, so almost everything collecting data was added deliberately.

Framer acts as a processor for form submissions and hosting, publishes a data processing addendum, and stores form entries in the dashboard until deleted. Its own cookie footprint is small, but custom code added under site settings loads exactly where you put it.

The pattern that causes trouble is speed. A Framer site can go from blank to launched in an afternoon, and the legal pages are typically the last thing added - if they are added at all.

What a privacy policy for a Framer site has to cover

Framer as processor for hosting and form submissions, with the addendum referenced
Every script in site settings custom code, named with its purpose
Form submissions: what is stored in the dashboard, where notifications go, and retention
Embeds - scheduling, video, chat - and the data they collect directly
The operator of the site, named, including after an agency hand-over

How a Framer site actually moves personal data

Form submissions

Name, email and message stored in the Framer dashboard, plus a copy wherever the notification is sent.

Analytics added via custom code

Plausible, Fathom, GA4 or a product analytics snippet, loading on first paint unless deliberately deferred.

Scheduling and demo embeds

Calendly or Cal.com iframes that collect booking data directly into the provider.

Chat widgets

Intercom or Crisp, which set cookies and retain conversation transcripts.

Framer hosting and CDN

Server logs including IP addresses, retained by the platform under its own policy.

CMS collections

Where a policy or blog is CMS-driven, editorial data lives alongside the site content.

Third parties the draft will ask you about

Framer B.V. · Calendly or Cal.com · Plausible or Google Analytics 4 · Intercom or Crisp · Loops or Resend · Stripe

The rules that apply

Framer Terms and DPA

Framer processes form submissions and site data on your behalf, with a published addendum.

Custom code placement

Scripts added to the head or body of site settings load on every page unless gated deliberately.

Form submission storage

Entries are retained in the Framer dashboard and usually forwarded to an email address or webhook.

Third-party embeds

Calendly, Typeform, YouTube and Loom embeds each set their own cookies from their own domains.

CMS-driven pages

A single policy template can render several documents, which keeps them consistent if used deliberately.

What the generated privacy policy contains

Identity and contact details of the controller
Your legal entity, trading name, registered address and a working contact route - plus a representative or DPO where one is required.
Categories of personal data and their sources
What you collect directly, what you observe automatically, and what you receive from third parties such as payment providers or ad platforms.
Purposes and lawful basis, purpose by purpose
A table that pairs each processing purpose with its lawful basis rather than listing all six bases and hoping one fits.
Recipients and sub-processors
The categories of recipient, and for the ones that matter to users - payment, hosting, analytics, support - the named provider.
International transfers and their safeguards
Where data leaves its home jurisdiction, and the mechanism relied on: adequacy, standard contractual clauses, the UK addendum or IDTA.
Retention periods per data category
Concrete periods or the criteria used to set them, which is what regulators ask for first when a complaint lands.
Rights and how to exercise them
Access, rectification, erasure, portability, objection and restriction, with the actual route to make a request and the deadline you work to.
Complaints and supervisory authority
The regulator a user can escalate to, named, with a link - not a generic "your local authority".

Publishing the document on Framer

Create a page per document with a clean path
Or a CMS collection if you want one template to render several policies.
Link them in the footer component
So every page carries the link, including new ones.
List everything in site settings custom code
That list is your recipients and cookies disclosure.
Gate analytics and chat behind consent
For UK and EU visitors, before they load rather than after.
Set a form retention routine
And delete entries on that schedule.
Set the page-level SEO title and description
Framer will not do it for you, and a policy page with no metadata renders poorly in search.

Where this usually goes wrong

Launching without any legal pages

The most common Framer failure, because the build is fast and the pages are an afterthought.

Analytics and chat loading before consent

For UK and EU traffic, both need consent before they run.

Scheduling embeds collecting data invisibly

A Calendly iframe collects name, email and sometimes phone directly into Calendly’s systems.

Form entries kept indefinitely

They sit in the dashboard until someone deletes them.

No named controller on a studio site

Agency-built sites frequently launch with no identifiable operator in the policy.

Frequently asked questions

Does Framer include legal pages?

No. Framer provides hosting, forms and a data processing addendum for its own role. Every document on the site is yours to write and publish.

Where do Framer form submissions go?

Into the Framer dashboard, and usually also to whichever email address or webhook you configured - two copies with two retention positions.

Do I need a cookie banner on a Framer site?

If you serve UK or EU visitors and run analytics, chat or embeds, yes - and it has to hold those until consent rather than merely announce them.

Is a privacy policy legally required?

If you process personal data, in almost every market yes. GDPR and UK GDPR require the disclosure at the point of collection, CCPA/CPRA requires a notice at collection plus an annually reviewed policy, and app stores and payment processors require a public policy URL before they will list or onboard you.

Can I copy another company’s privacy policy?

It is both a copyright problem and a compliance problem. A copied policy describes someone else’s data flows, processors and retention periods, so it is inaccurate the moment you publish it - and an inaccurate transparency notice is itself a breach of GDPR Article 13.

How often does a privacy policy need updating?

Whenever your processing changes - a new analytics tool, a new payment provider, a new market - and as a backstop, review it annually. CPRA makes the twelve-month review explicit.

Does PolicifyAI give legal advice?

No. PolicifyAI is a technology provider, not a law firm. The output is a structured, jurisdiction-aware draft that a qualified adviser should review before you rely on it.