Why it matters
A privacy policy has to say who receives people's data. If your site sends data to a session-recording tool or an ad network your policy never mentions, the policy is inaccurate, and an inaccurate policy is not much better than none. Generated templates are the usual cause: the site grew, the policy didn't.
How Patch checks
We record every outside service your site contacts, then read your privacy policy (a small AI model pulls out the services it names, with a keyword search as a backup) and list the ones that are missing.
How to fix it
- Add the trackers Patch found to your privacy policy: what each one does, what data it gets and where it is based.
- Say which ones only run after consent.
- Update the "last updated" date, and set a reminder to check the policy whenever you add a new tool.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
GDPR and UK GDPR require you to name the recipients or categories of recipients. California requires the categories of third parties.