" You do need to have a privacy policy that discloses what data you’re collecting, how you’ll use that data, and provide someone signing up to your service with a means to consent to data collection. It can just be a checkbox "