Generating a Privacy Policy Page

Requires SureCookie 1.5.0 or later version.

SureCookie can build a privacy policy page for your site from your cookie and consent settings. It covers the two things only SureCookie knows: what your consent records contain, and what leaves your server when a visitor answers the banner.

The result is a reviewed starting point, not a finished legal document. SureCookie creates a policy based on your site’s configuration. You should review and adjust it to meet your legal requirements, and have it checked by someone qualified for your jurisdiction before you publish.

Before you begin: fill in SureCookie → Compliance → Business Details. The page cannot be published until the required details are saved. See Setting Up Your Business Details.

Where to Find the Generator

1. In the WordPress menu, go to SureCookie → Compliance.
2. In SureCookie, click the Compliance tab at the top.
3. Open Legal Pages and click Privacy Policy.

The WordPress menu item drops you on the Compliance Check screen, so the second and third steps matter. Compliance is a tab across the top of SureCookie, not a heading in the left column.

The screen is titled Privacy Policy Page and has two tabs: Auto Generate and Shortcodes.

Note: generating is the only way in. Unlike the Cookie Policy screen, this one has no page picker, so you cannot point it at a privacy policy you already wrote. If you have one, either keep using it and place the shortcodes below into it by hand, or generate a draft and move your wording across.

Step 1: Generate the Draft

1. On the Auto Generate tab, click Generate Privacy Policy Draft.
2. Wait for the confirmation that the draft was created.

SureCookie creates the page as a draft, never as a published page. This page is a draft. Nothing is visible to visitors until you publish it.

To start again, move the page to the trash in WordPress. The screen then reports that the linked page is gone and offers Generate Privacy Policy Draft again.

The new page takes the /privacy-policy/ address when nothing else holds it. If another page already uses that address, the draft waits at /privacy-policy-new/ until you decide to swap them, which Step 4 covers.

Step 2: Review the Draft

The generated page mixes three kinds of content, and only one needs your attention:

• Sections built from your settings. Your cookie categories, what a consent record holds, how long records are kept, the third-party services found by the last scan. These stay current on their own.
• General prose. Standard wording that applies to any website, safe to edit freely.
• Blocks marked “Replace this block”. Prompts for the facts only you know, such as what your own contact forms collect.

After the draft exists, the screen shows a What’s Next checklist:

• Replace the blocks marked “Replace this block” with your own wording, then delete the markers. The bullet shows how many are left.
• Fill in the parts only you know: What your own forms collect, how long you keep it, and why you are allowed to.
• Leave the shortcodes in place. Those sections rewrite themselves when your cookie and consent settings change.
• Finally have it reviewed by a qualified professional in your jurisdiction before publishing.

The count updates as you work, and reads No “Replace this block” sections are left in the draft. once you have cleared them all.

Click Edit Page to open the draft in the WordPress editor, or View Page to preview it.

Important: leave the shortcodes in place. Deleting one removes a section that keeps itself accurate, and replacing it with typed text means the wording stops matching your settings the next time you change them.

Step 3: Publish

When the draft reads the way you want and has been reviewed, click Mark as Publish.

If the button is unavailable, the screen tells you why: Publishing is unavailable until your business details are complete. Go back to Business Details, fill in the missing fields, and return.

Note: publishing is held back for the generated page while details are missing, but this is a safeguard rather than a lock. If you rewrite the page by hand and remove SureCookie’s identity shortcode, the page becomes yours and the check no longer applies. It also never un-publishes a page that is already live.

Important: because the check stops at publication, a live page can drift. Select another privacy regime after publishing and leave its extra detail blank, and that section immediately shows “A section for this privacy law is switched on but is not finished yet.” to visitors. Selecting COPPA does the same, since it asks for no detail at all and adds a children’s privacy section only you can write. Review the live page after changing your regimes.

Step 4: Set It as Your WordPress Privacy Policy Page

WordPress has its own setting for which page is the site privacy policy. It controls the link on the login screen, and themes and other plugins read it too. With SureCookie Pro, it is also where the data request form is placed automatically.

Under Set this as your Privacy Policy page, click the action shown:

• Use now appears when nothing is currently set. This tells WordPress, your theme and other plugins which page is your privacy policy.
• Replace now appears when another page is already set, or when your draft is still waiting at /privacy-policy-new/. SureCookie names the page being replaced before you confirm.

If the addresses need to swap, SureCookie says so plainly first: the page currently using /privacy-policy/ moves to /privacy-policy-old/, and your page takes /privacy-policy/. Both pages keep their titles. Only the addresses change, and nothing happens until you confirm.

Important: this changes a public address. Any external link to the old /privacy-policy/ page will now reach your new page instead.

On a multisite network this action needs network-level permission, so a single-site administrator can generate and publish the page but cannot set it as WordPress’s privacy policy.

How the Page Stays Current

Each section of the generated page is its own shortcode, so you can delete or reorder them, or drop them into a page you wrote yourself. They always render your current settings.

That is why there is no “regenerate” button. Change your cookie categories, adjust how long consent records are kept, or run a new scan, and the published page reflects it on the next page load. Your edits are never overwritten.

Open the Shortcodes tab to see the full list with a copy button for each.

Always Relevant

• When you choose which cookies to allow, this site stores that choice in two cookies in your browser. surecookie_user_consent holds the choice itself and lasts 365 days. surecookie_session_id holds a randomly generated identifier and lasts 365 days regardless of that setting; it is created the first time you load a page, before you have chosen anything, so that a choice you make later can be matched to the same browser.

  We also keep a record of the choice on this site, so that we can show, if we are ever asked, that you were given a choice and what you chose. Each record holds the date and time, which categories you allowed and which you refused, the random identifier from the cookie above, a shortened form of your IP address, and the country your visit appeared to come from. If you were signed in, it also holds your user account ID.

  The IP address in the record is shortened before it is stored: for a normal IPv4 address the last part is replaced with a zero. We do not store your full IP address in these records, and there is no setting that would make us.

  To work out which country your visit came from, this site sends your full IP address to a geolocation service operated by Brainstorm Force, the maker of the consent tool used on this site, at library.surecookie.com. The address is sent as part of the web address of that request, only the country comes back, and only the shortened address is stored here. That service is hosted in Germany. Requests reach it through a content delivery network run by a company based in the United States, so that step can involve a transfer outside the European Economic Area. The result is cached for 24 hours, so a repeat visit within that time does not send it again.

  These records are stored on this website and are deleted automatically once they are 365 days old.

  Separately from how long that record is kept, the choice saved in your browser lasts 365 days. After that it expires and you will be asked again. If we ever need to ask everyone again sooner, for example because the categories on this site have changed, the banner will reappear and your previous choice stops applying.

  These consent records are not covered by the personal-data erasure tool built into this site. Erasing your other data leaves the consent record in place, because it is the evidence that you were given a choice. If you want the record itself removed, ask us and we will remove it by hand.

  Your choice is also passed to Google's tags on this site as a consent signal, so that they can adjust what they do before any of them run.

  You can change or withdraw your choice at any time using the cookie preferences control on this site. Withdrawing does not undo anything that happened while your permission was in place.

  – What is stored when a visitor answers the cookie banner, how long it is kept, and the country lookup that happens on server.
• • Essential Cookies Required for basic website functionality.
  • Functional Cookies Enable features like saved preferences and personalized content.
  • Analytics Cookies Help us understand how visitors use our site so we can improve it.
  • Marketing Cookies Used to show you relevant ads based on your interests.

  Non-essential cookies are only set after you allow them through the cookie banner.

  See the full list of cookies used on this site

  – Your cookie categories, plus a link to the Cookie Policy page or the full table when there is no such page.

• The organisation responsible for this website has not been named yet.

  – Legal entity name and registered address from Business Details.

• A contact address for privacy questions has not been set yet.

  – Privacy contact address, rendered as a link.

• Policy last updated: September 9, 2026
  Cookie and service list last updated: September 30, 2026

  – Two dates: when the policy was last edited, and when the cookie list was last refreshed.

Situational

• Service	Purpose	Category	Domain
  Google	Deploys and manages marketing tags.	Analytics Cookies	www.googletagmanager.com, googletagmanager.com
  SureCart Affiliate Tracking	SureCart affiliate referral tracking.	Marketing Cookies	js.surecart.com
  Sigmize	A/B testing, heatmaps, and session recording.	Analytics Cookies	api.sigmize.com
  Powerful Docs	Documentation and support widget.	Functional Cookies	app.powerfuldocs.com
  Google Fonts	Loads Google web fonts.	Functional Cookies	fonts.googleapis.com, fonts.gstatic.com
  WordPress.org Assets	Core asset WordPress.org	Essential Cookies	s.w.org
  Google		Analytics Cookies	region1.google-analytics.com
  iubenda Legal Documents	Displays iubenda-hosted privacy policy, cookie policy and terms. Sets no cookies. Does not cover iubenda's Cookie Solution banner.	Essential Cookies	cdn.iubenda.com, www.iubenda.com
  www.googletagmanager.com		Analytics Cookies	www.googletagmanager.com

  – Third-party services your pages load, from the most recent scan.

• Separately from the files your browser loads, this site sends a small amount of information to other services from its own server while handling your visit. Because this happens on our side, your browser settings cannot control it.

  • Your IP address is sent to library.surecookie.com to work out which country you are visiting from, so the right consent rules can be applied and recorded. Only the country comes back.
  • The addresses of pages on this site are sent to our cookie scanning service on a schedule, so the cookie list above stays current. This is information about the site, not about you.
  • Technical information about this site and its server is shared with the maker of the consent tool, because the site owner opted in to usage tracking. This is information about the site, not about you.
  – What this site sends from its own server, which browser settings cannot block.

• You can ask us what personal information we hold about you and ask for a copy of it. You can ask us to correct it if it is wrong, ask us to delete it, and object to us using it in a particular way. Where we rely on your permission, you can take that permission back at any time.

  To make any of these requests, use the contact details at the end of this policy. We will not charge you for a request and we will not treat you differently for making one.

  Some requests are limited by law. We may have to keep particular records to meet legal, accounting or security obligations, and where that applies to your request we will tell you which records and why.

  If you are not happy with how we handle your request, you can complain to the data protection authority for your country.

  – Data subject rights, and how to exercise them on this site.
• – Where information is processed. Renders nothing until you set a transfer safeguard.

• This site applies the same cookie and privacy practices to every visitor, wherever they are.

  – Region-specific consent rules. Needs SureCookie Pro to say anything beyond “the same everywhere”.
• – One privacy regime’s rights section. Accepts gdpr, uk_gdpr, cpra, dpdp or coppa.

Troubleshooting

• The third-party services section says the site has not been scanned. Run a scan under SureCookie → Tracking Manager → Scanning. That section lists what the most recent scan found, so it has nothing to report until one has run.
• A regime section says it is not finished. That law needs an extra detail in Business Details: transfer safeguards for GDPR and UK GDPR, the grievance officer for the DPDP Act, or the sale or sharing answer for CCPA / CPRA.
• A section I expected is missing. Some sections only appear when they apply. The data transfers section renders nothing until you set a transfer safeguard, and a regime section only appears when you select that regime.
• Mark as Publish is still greyed out after I saved my business details. This screen re-reads them for up to 30 seconds. Wait a moment and reload.
• The notice on Business Details cleared but publishing is still blocked. That count reflects what is on screen; publishing checks what is saved. Click Save on Business Details.
• The screen says the linked page is gone. It was deleted or moved to the trash. Generate a new one to replace it. SureCookie does not silently forget which page you chose, so generate a replacement when you are ready.
• My page still lists a cookie I removed. The cookie sections read your current cookie list, so check the cookie is gone from Tracking Manager → All Cookies rather than looking for a stale copy on the page.
• The page shows a marker naming a missing detail. Only logged-in administrators see that. Visitors see nothing in its place. Fill the detail in on Business Details to clear it.

Next Steps

Pair the privacy policy with a cookie policy: see How to Generate a Cookie Policy Page. To reuse your business details in pages you wrote yourself, see Setting Up Your Business Details.