Facens

I had to face the decision too, for Iubenda, and ended up with an Srl. I went for the most hassle-free choice, since incorporating abroad can be time consuming and hide additional costs (loss of focus included). About the Srl, I wrote this article a while ago which can clarify some of the expenses: http://thinkamination.com/migliorare-srl-italiana/ [ITA]

We're doing this right now at http://www.iubenda.com and Privacy Policies are our starting point. Anyway, I can assure you that's far from being simple :) Here you can see a sneak peek of the upcoming new version: http://www.iubenda.com/blog/2011/10/12/a-brand-new-version-s... :)

We are based in Italy, and we know European laws very well, so you're in good hands. One of the team members is a lawyer, of course :)

About the problem, it's weak if you own a personal website, but relevant if you sell websites to other people, for example if you are a freelance web designer or a web agency.

One of the goals of this first period of MVP was to test the need, and now we have many, many people praising for the product :)

I think that the problem is if the market is big enough for this product. Since the market is 'every website in the world', we can afford that part of it doesn't care of the problem, and still keep having millions and millions of potential customers.

YourPrivacyPolicy.com will never ever be a brand :)

lol, you're not the first to ask it ^^

Thanks again for replying.

About "embedding vs template", templates just suck. Our product is about giving users a far better privacy policy, which is a piece of design, usability and information architecture. You can't achieve this without embedding.

Moreover, embedding is better because: - It's faster to integrate - No maintenance needed - The policy can be updated remotely (both by us and by the user) - The result is just beautiful, opens as a lightbox, has icons :)

There are also business-related reasons why embedding is better than template.

About the UI, the lags are caused by my development local machine, on the production server there's instant feedback on every action. Sorry for that.

On the rest, I get your point, and again: the reason for the private beta wall is that we're not ready. About the product itself, I can assure that our users are crazy about it :)

Thank you for this comment.

I wrote a comment on HN before, about privacy policies and why current solutions suck. Here's the link: http://news.ycombinator.com/item?id=2911830

The reason why we didn't launch the product yet, is that we are not ready. We are working really hard with our beta testers to improve it, and to solve some of the problems you mentioned too.

Now, instead of a bunch of useless words, can I ask you to watch a demo of what we're about to launch? Skip if you want, but take a look at the real product and tell me what you think:

http://f.cl.ly/items/3Q2600072w2w3a0V3B3B/Screeny%20Video%20...

I will surely disclose more in the next future, granted.

About what's real, I think that it's mostly the need. I read every tweet that comes on the "iubenda" search, and frequently look to the profile of the user behind. Most of the times the user is a web designer, which proves that people subscribe because they feel the need. Moreover, I interview almost every beta tester that we invite, and again I get people really passionate about the product.

I think that the marketing-driven risk is mitigated by the fact that the product is explained very well on the website, and people signup only if in need of the product.

Another point is that Online wins on Offline, definitely. Offline events or press can lead to social proof, but they don't drive subscriptions.

Thanks for the reply, it's exactly my opinion

Ok but the real point is: how do you get the first thousand people to know about your product? That's the hard part, and a viral system can help there. If there's a bad product behind, I think that it'll end up being a failure anyway, and in the end the product is surely what really matters.

Something quite interesting that I forgot to disclose is how Facebook and Twitter performed, one compared to the other. I expected Facebook to be more effective, and it was, but the percentage of users coming from FB was just slightly greater.

So far, nobody tried. I think that Creative Commons can teach a lesson :)

You are not required to do it. Only if you want early access :)

Did you get any commit so far?

Your point is right, not a privacy policy if considered strictly, but still valuable for the conversation I think :)

The tradeoff sounds scaring: - Extremely accurate Privacy Policies nobody read; - Simplified Privacy Policies everybody read, but missing something.

Facebook has probably reasons for not including too much detail on that page, but Facebook also uses users' data like nobody else. For the average website this problem is much simpler, even for the average SaaS startup which is not a social network (or a simple one like Quora). Probably that kind of website can really have a privacy policy covering every personal data use within a simplified popup, without missing relevant information.

The Facebook's popup surely has issues, but I still love it since it's something people read, and it helps people take better choices. This is what, to me, is really important of Privacy Policies.

Also notice that we are working with a top-notch designer ^^ http://dribbble.com/jonnotie/projects/15616-iubenda

The best part is that we are making it automatic, just check our main website, our goal is to help website owners to get rid of the hassle of writing a privacy policy :)

I think that it's too complex to work on a scale. Maybe our service will embed it in the future, maybe we'll rethink a new standard (since p3p is a bit outdated) :)

Look a the Facebook's example shown in the post. Facebook could have replaced that popup with a text broth, but it didn't, and this payed. The main privacy policy of Facebook is another example. They redesigned it with the help of TRUSTe, when they realized all that people want is to keep control of what they share (and my opinion is cleared in the article). Furthermore, TRUSTe bases its business on the assumption that well written privacy policies increase conversions, because when people have to provide their credit card (an example), they get scared by a broth-like privacy policy.

Also think about Creative Commons: many people use it and many people rely on it when needing to know how to share content. The world is a better place with Creative Commons, and I think it will be a better place with simpler Privacy Policies and TOS :)

Most people don't know what to put on a privacy policy, and we built a service with lawyers behind, assuring compliance and top quality service. Since yours is of course a good point, consider that our product will be very cheap, and I'd seriously pay a cheap price instad of spending those 20 minutes. Also consider that your privacy policy currently lacks the parties involved, and it's not "completely compliant". Our goal is to save your time on this side, for a reasonable price and giving something very polished in change :)

What do you think?

There's probably still need of a legalese document behind, but we are working on cutting that part too :P Even with the need of having a strictly law-compliant page, having a first page which is simple and readable at a glance is always a good idea. Consider that we are seriously working on bringing that model to the mass (read end of the article :) )

The service is in private beta, we are simply not ready to welcome too many users, and I'm sorry for this. Nobody forces you to spam your social media network, you can simply wait :)

Privacy is about making people confident, about making people trust you. If people feel safe, they will share anything, and a clear privacy policy makes people feel safer.

TRUSTe reported several tests on this side, even Facebook had a huge benefit from changing the "privacy policy" policy to something more clear.

Just to tell something more on this side, we are working with http://dribbble.com/jonnotie to make our privacy policies not only useful, but even beautiful :) Stay tuned :P

-------------------------------------------------------------------

Short answer to the question

Any of the current solutions to the Privacy Policy / TOS problem make you waste money and time. I've experienced this problem myself and decided to solve this hell of hassle once and for all, creating a privacy policy generator that is really compliant, with a company making money behind (and this grants quality), built to speak web designers' language (not lawyers' one), allowing to generate a fully-customized high-quality privacy policy within 3 minutes, by pressing a few buttons.

Here's the website: http://www.iubenda.com I'm the founder.

-------------------------------------------------------------------

-

# Small intro

As a web designer I've always faced this problem myself, that terrible hassle of getting rid of the privacy policy. Two years ago I told myself: why the hell nobody solves this problem once and for all? So, I started working on iubenda (http://www.iubenda.com), with the goal of giving any website owner in the world a way to generate a Privacy Policy without having to read a single legalese word.

After a whole year of thinking, another year of cust dev, a seed round and even the awesome Seedcamp experience, we are here to conquer the footer of every website in the world :P

To date we have 2k people waiting to try out the product, we're approaching 1M pageviews served by our privacy policy icon, we have 100 beta testers and we're able to generate a privacy policy both in English and Italian languages.

-------------------------------------------------------------------

-

# Why every solution mentioned is a mess (most of the times)

If you have to spend money and time on that boring document that nobody reads (aka privacy policy), the best you can hope is that the money is actually well spent.

The tough truth? Most of the times it's not, and I'll explain why.

-

## What are Privacy Policies about?

A Privacy Policy must inform the users visiting a website about the personal data collected, the use of those data, the parties involved (first and third parties) and few other minimal things.

The problem here is that every website is slightly different, different because is using different services collecting different data. Any web designer can get it, on some websites you put Google Analytics, on some others Google Analytics and Google Adsense, sometimes you use Mailchimp to manage a mailing list, and so on.

Now, the problem is that most of the privacy policies I read don't mention these services, making the privacy policy completely useless.

-

## So, you're basically telling me that I payed $1k for my privacy policy, and IT IS USELESS?

Yeah dude, the privacy policy can't be general, it must be specific, or it's just like not having a privacy policy at all. Of course you can fall into this hole while copy/pasting, while paying for a lawyer or while using a low-quality generator. Sometimes you may of course find a good lawyer or a good web company (like TRUSTe), but that kind of lawyer/service is usually expensive.

-

## Not every lawyer writes wrong privacy policies: here's a simple way to check yours

Try to ask your lawyer what a "cookie" actually is. Most will start talking about chocolate biscuits.

-

## So, what?

Since the world is never white or black, the Privacy Policy World is not about having or not having a privacy policy, there's a gray area in the middle: having a privacy policy that sucks. Sad but true, this is the most common situation.

-------------------------------------------------------------------

-

# Carrot after the stick

After analyzing this situation and getting to the conclusion above (privacy policies are expensive, and they even suck), I simply started working on a solution, and here I tell you what I did.

-

## Rethinking the Privacy Policy from scratch

The Privacy Policy model had to be rebuilt from scratch. The current model was a lawyer's parturition, but the only thing that lawyers are able to build is boring documents that nobody ever read. How can you accept such a state of things?

So I studied the law to extract the naked privacy requirements: personal data collected, use of those data, parties involved (first and third parties).

-

## Personal data

The personal data collected depend on the services used on the website, such as Google Analytics or Google Adsense. Other ways to collect data are the mailing list, the registration form, the comment system. All these uses are standardized, they're the same on every website. Since the web design world is moving fast to SaaS services, outsourcing most of the personal data collection, the standardization is even increasing.

-

## Use of the data

Another requirement for the Privacy Policy is the data collection purpose, but if the world is made of websites using standardized services, the purpose corresponds to the purpose of those services, like "analytics" or "advertising". Another point is gone.

-

## Parties involved

The website itself will always be an involved party, but what about the others? Wait, those SaaS services have a company behind, and that company is that third party we are looking for (such as Google for Google Analytics). Bingo!

-

## We have the ingredients, now the recipe

The next step was to put this all into a simple UI, allowing to generate a Privacy Policy with all the complexity hidden behind.

The good news is that we made it.

The model required a database made of privacy policy pieces referring to the standardized services (Google Analytics, etc), with some room for customization too (e.g. Registration forms don't always ask the same information). These pieces had to be assembled like a puzzle, and that's the reason why software exists.

-

## Who's more clever than me?

Ok, I'm kidding. The truth is that the process is simple, very simple, but quite powerful. And it generates beautiful privacy policies with nearly no effort. Completely awesome.

FYI, my cat on the keyboard says: "'0ììp"

-------------------------------------------------------------------

-

# SO WHAT?!

Ehm, I spent a whole hour writing this comment, you spent a few minutes of your valuable time to read.

Since our motto is "conquering the footer of every website in the world", I feel more or less like Brain from "Pinky and the Brain": - What are we going to do tonight, Brain? - The same thing we do every night, Pinky... Try and take over the world!

If you're interested in solving once and for all that hell of hassle of writing a privacy policy (w/ TOS coming soon), be sure to try out our product:

http://www.iubenda.com

(we're in private beta, but out moving fast)

Ah, of course we rely on a strong legal cofounder ;)

Thank you for the mention, I'm the founder of iubenda. Any question is welcomed :)

How many days will you stay?

This needs some experiments, and we'll try to proceed in that direction. Let's see what happens, at the moment we are focused on getting feedback from website owners, to improve the "generation side" of the privacy policy. If you care about us, spread the voice and keep in touch :)

Are you somehow involved in the project? I think that the approach is not so easy to understand for end users, but it can be considered as a starting point for further improvement. I'm in touch with Aza Raskin too, who released these beautiful privacy icons: http://www.azarask.in/blog/post/privacy-icons/