Your privacy policy is a promise. Does your product keep it?
The risk almost never lives in the wording. It lives in the gap between what the policy promises and what your system actually does.
- 1
Your privacy policy was copied from a company you admired in 2023. The product has shipped forty times since then.
- 2
An EU enterprise customer sent a DPA with Article 28 terms and a transfer-mechanism question. It's due back Thursday.
- 3
A user asked for their data, and the honest answer to "what do we hold on this person?" is a Slack thread.
The accuracy audit
We read your policy, then we read your product: the data map, the vendor list, what retention actually looks like in the database. Then we close the gap in whichever direction honesty requires, sometimes by editing the policy, sometimes by changing the product. A privacy policy is a promise to your users and a representation to regulators at the same time, so your exposure lives in the distance between the two.
The DPA stack
Customer DPAs on one side, vendor DPAs on the other, and the flow-down that has to connect them. Your no-training and retention promises only hold if the same terms bind every vendor downstream, so we check that they do, keep the subprocessor list true, and read the order form for the line that quietly overrides the master agreement.
The operating obligations
This is the unglamorous machinery that fails loudest when it fails: records of processing, data-subject requests answered inside the deadline, DPIAs where they're triggered, a retention schedule someone actually follows, and an incident playbook written before the incident rather than during it.
How much Europe do you actually need?
Most US startups either over-build here or under-build here, and both cost you. A short list of GDPR obligations genuinely reaches a US company selling into Europe: lawful basis, processor terms, a transfer mechanism, request handling, breach timing. Much of the rest is noise at your size, and we'll say so. We build the architecture once, so state law and GDPR share one set of answers instead of two.
What we don't do
We don't run your security program and we don't certify anything. Our job is to make the legal layer true, negotiable, and consistent, and to work beside whoever runs the controls.
Fifteen minutes. No pitch.
You talk, we diagnose. You leave with the two or three exposures worth addressing first, along with a straight answer on whether you need counsel now, including "not yet."