Privacy policy for Mailchimp apps

What Mailchimp does on a live site

Mailchimp is in the email category. On sites we scan, it shows up through list-manage.com, chimpstatic.com. Its role is to run an email newsletter or embedded signup form.

Data that may be processed: Subscriber email, campaign opens and clicks, and the Mailchimp landing-site cookie if the form script is embedded. The vendor describes the location as: United States (Intuit Mailchimp). Their public privacy or data-processing terms are at https://www.intuit.com/privacy/statement/.

A privacy policy for a Mailchimp app should name Mailchimp directly and say what your own product sends to it. A phrase like "third-party tools" is not enough once this service is on the page.

An embedded Mailchimp form loads chimpstatic.com or list-manage.com and can set mailchimp_landing_site. The subscriber's email is processed by Mailchimp. Say that on the privacy policy, not only inside the form's fine print.

What you still have to type

The scan cannot know your company name, the country you operate from, or the support email you want on the page. Those go in a short form after the scan. The legal clauses around them are fixed template text, marked as a draft until a lawyer reviews them.