A scanning tool’s privacy section said the scanned address was not stored or tied to anyone. A second, older policy page that nothing linked to still described accounts and billing, and quoted retention periods (30 days in one place, 90 days in another).
⚡ Quick Fix (TL;DR)
The Culprit: The policy was written for an early version. The product then grew accounts, saved reports, billing, notification emails and its own cookie banner, and nobody re-read the policy against the code. The retention numbers were never backed by anything that deleted data, and a stale duplicate page stayed live because it was simply never linked.
The Fix: Audit the policy against the product with concrete questions: what is stored for signed-in and anonymous visitors, who receives emails and with what in them, which cookies and third-party scripts load, what is deleted and when, and is the policy linked where people sign up. Rewrite the policy to describe what actually happens, and only promise retention periods something enforces. Remove stale duplicate pages with permanent redirects to the one real page, add a test that the redirects stay in place, and trim data you do not need (here, visitor IP addresses in internal emails). Recheck the live site after publishing.
Was this helpful? Thanks for the feedback!
Tagged in :