A privacy policy is the public-facing document that tells users how you handle their data; a privacy program is the internal system that actually makes those promises true. A policy without a supporting program can be considered deceptive. We draft privacy and security policies and build the underlying program so what you say and what you do match.