diff --git a/PrivacyPolicy.md b/PrivacyPolicy.md
new file mode 100644
index 0000000..08ac888
--- /dev/null
+++ b/PrivacyPolicy.md
@@ -0,0 +1,39 @@
+Effective Date: June 29, 2026
+Last Updated: June 29, 2026
+1. Information Collected
+ThreatLens collects and stores only the minimum data needed to function:
+
+Guild Configuration — Digest channel ID and optional notification role.
+Researcher Notes — Optional notes added by users when viewing CVEs (stored per guild).
+API Cache — Temporary on-disk cache of NVD/KEV responses to respect rate limits.
+
+No personal user activity outside of commands is tracked.
+
+2. Data Storage
+
+All data is stored locally in an SQLite database (data/ folder) on the server/machine where the Bot is hosted.
+The Bot does not send data to any external servers except the official NVD and CISA public APIs.
+
+3. Data Sharing
+We do not sell, share, or transmit your data. Data never leaves your self-hosted instance.
+4. Third-Party APIs
+The Bot uses:
+
+NVD CVE API (NIST)
+CISA KEV Catalog
+
+Usage is subject to their respective terms and privacy policies.
+5. Data Retention & Deletion
+
+Data persists as long as the Bot is running and the data/ volume exists.
+Server administrators can delete the database or remove the Bot to erase all stored data.
+
+6. Security
+Security depends on your hosting setup. We recommend Docker with a non-root user and restricting access to the host machine.
+7. Children’s Privacy
+The Bot is not intended for users under 13.
+8. Changes to This Policy
+We may update this Privacy Policy. Check the repository for the latest version.
+Contact
+For privacy inquiries, contact the maintainer via the repository:
+https://git.churchofmalware.org/SubINaclS/ThreatLens
\ No newline at end of file