Privacy and compliance programs sized for a company your size.
Terms of service, privacy policies, CCPA and GDPR, TCPA and telephony rules. Enough to pass an enterprise security review without hiring a compliance department.
How we approach it
Enterprise customers will ask about your privacy program before they sign. Regulators ask after something goes wrong. We prepare you for both.
Every software company that collects personal data is subject to privacy law, and the rules now reach well beyond California and the EU. The practical goal is a program that is accurate, defensible, and proportionate: public-facing terms and policies that match what the product actually does, internal procedures for data requests and incidents, and vendor contracts that pass the obligations down the chain.
We draft terms of service, privacy policies, cookie notices, and data processing agreements. We map data flows, assess which laws apply, and build the procedures for access and deletion requests. For companies that call, text, or record customers, we handle TCPA and call-recording consent, which carry some of the largest statutory penalties in the field.
When an enterprise prospect sends a security questionnaire or a vendor assessment, we help you answer it accurately and close the gaps it exposes.
What we handle
- Terms of Service & acceptable use policies
- Privacy policies & cookie noticesWritten to match the product, updated as it changes
- CCPA / CPRA complianceNotices, consumer requests, service-provider contracts
- GDPR & international transfersDPAs, standard contractual clauses, representative requirements
- TCPA & telephony complianceCalling, texting, consent language, recording disclosures
- Data mapping & applicability analysisWhich laws apply and what each one requires
- Vendor & sub-processor agreements
- Incident response planningWho does what in the first 72 hours
- Security questionnaire supportSOC 2, ISO, and customer-specific assessments
- Marketing & CAN-SPAM compliance
- Children’s data & COPPA
- AI and automated decision-making disclosures
What people ask us first
- Do we need a privacy policy if we only sell to businesses?
- Yes. You collect personal data about your customers’ employees and your own users, and enterprise customers will require a policy and a DPA before signing. A B2B policy is shorter, but it has to exist and be accurate.
- We text and call leads. What are we exposed to?
- The TCPA allows statutory damages per call or text, and class actions are common. The fix is consent language at the point of collection, honoring opt-outs, and records of both. We review your flows and scripts and fix the consent.
- How much of a program does a seed-stage company need?
- Accurate public terms, a DPA you can sign, a procedure for data requests, and a plan for an incident. That is a few weeks of work, not a department.
Often needed alongside this
Tell us what you’re working on.
A free first conversation. We’ll tell you what it involves, what it costs, and whether you need us at all.
Santa Monica, California