Controller vs processor — and why it matters
For most SaaS, your customer is the data controller and you are the processor. Your privacy policy should distinguish data about your customer (their contact, billing, login telemetry — you are the controller) from data they upload to your service (their end-users' data — you are the processor). This generator splits those into two clearly labelled sections so enterprise procurement reviewers can find what they need without filing a ticket.
Subprocessors page
Procurement teams will ask for a public list of subprocessors before signing. The generator outputs a separate, dated subprocessor table covering AWS / GCP / Azure, Stripe, Postmark or Resend, Datadog or New Relic, Intercom, and any custom subprocessors you add. Each row has the subprocessor name, purpose, region of processing, and a link to their security documentation.
Data Processing Agreement reference
Your privacy policy is not a DPA — but it should reference one. The generator includes a "Data Processing Agreements" section pointing customers to the URL where they can sign your DPA, with an optional Standard Contractual Clauses annex for EU-to-US transfers.