What was already there
Page id 98022 already existed as a draft: WordPress’s stock default privacy policy text, generated at install and never touched. It talked about comment data, Gravatar hashes, and embedded-content cookies — none of which apply here, since comments are off and there’s no embed-heavy content. It sat unpublished, flagged as open work in the priorities checklist.
What got done
Talked through with Laurent what the site actually does with data before writing anything: analytics only, via Google Analytics (GA4), no contact form, no newsletter, no user accounts, comments off. Since the business is Quebec-based, Quebec’s Law 25 and the federal PIPEDA are the relevant frameworks, not just a generic GDPR template.
Two things needed a real answer rather than a guess: GA4’s actual data retention setting (checked in GA4 Admin → Data Settings → Data Retention — this property is on 2 months for event-level data, 14 months for user-level data), and a contact address for privacy questions, since no email address is published anywhere on the site yet. Rather than invent one or reuse an admin address, Laurent supplied a dedicated one (see the published page).
Rewrote the page from scratch — identity, what’s collected and why, cookies and retention, who the data goes to (Google and the host, nothing else), a standing promise to update the page before adding anything like a contact form, user rights under Law 25/PIPEDA, and a contact line — and published it live at /privacy-policy/. This English version is also the base text Laurent plans to use as a first test case for AI-assisted translation into French, so it’s written to be a clean, literal source rather than something idiomatic that would fight the translation step.
What went wrong
Fetching the live page afterward to double-check it, a plain request with default headers got a 406 from the host’s security layer — the same WAF behavior already known to affect the REST API also applies to normal page loads with a non-browser user agent. Spoofing a standard browser user agent got through fine; nothing on the actual page was broken, the check itself just needed the right headers.
Still open
- Mobile layout check and SEO/GEO prep are still open from before.
- The policy is English-only for now, by design — French translation is a separate, deliberate next step, not an oversight.
- If a contact form or newsletter ever gets added, the privacy policy needs a matching update before that feature goes live, not after.