Terms of Service

Overview

When to Use

• Launching a new SaaS product, web app, or mobile app that requires user-facing legal agreements
• Updating outdated ToS to reflect new features, business models, or regulatory requirements (GDPR, CCPA, COPPA)
• Drafting a standalone Privacy Policy for a product that collects any user data
• Creating a EULA for downloadable software or a mobile application
• Developing an Acceptable Use Policy (AUP) for a platform with user-generated content
• Building a legal agreements page that consolidates ToS, Privacy Policy, and Cookie Policy

When NOT to Use

• As a final, legally reviewed document without attorney review for any production product
• For highly regulated industries (healthcare/HIPAA, financial services/FINRA, children's products/COPPA) without specialized legal counsel
• When you need jurisdiction-specific compliance advice (e.g., EU GDPR Data Processing Agreements, CCPA service provider addenda)
• To document agreements between businesses (B2B contracts) — use a services agreement or MSA instead
• For open-source software licenses (use established SPDX licenses instead)

Quick Reference

Instructions

1. Gather product context before drafting — Collect: product name, company name and jurisdiction, product type (SaaS, mobile app, marketplace, API), data collected from users, subscription/payment model (free, freemium, paid tiers), target audience (consumers, businesses, children?), and key features that may have specific legal implications (AI/ML, UGC, payments, health data).
2. Draft the Terms of Service using this standard structure:
   • Acceptance of Terms — How users agree (clickwrap, browsewrap); age/eligibility requirements
   • Description of Service — What the product does; scope of service
   • Account Registration and Security — Account creation, credential responsibility, account suspension
   • Acceptable Use Policy — Prohibited conduct, prohibited content, enforcement rights
   • Intellectual Property — Company IP ownership; license grant to users; user-generated content license back to company
   • Payment and Subscription Terms — Pricing, billing cycles, auto-renewal, refund policy, price changes
   • Privacy — Reference to Privacy Policy; GDPR/CCPA compliance statement if applicable
   • Disclaimers of Warranties — "As-is" disclaimer; no guarantee of uptime or results
   • Limitation of Liability — Liability cap (typically fees paid in last 12 months); exclusion of consequential damages
   • Indemnification — User indemnifies company for user's misuse or content
   • Termination — Grounds for termination; effect of termination; data export window
   • Dispute Resolution — Arbitration clause, class-action waiver, governing law, jurisdiction
   • Changes to Terms — How changes are communicated; continued use = acceptance
   • Contact Information — Legal contact email/address
3. Draft the Privacy Policy using this standard structure:
   • Information Collected — Categories: account data, usage data, device data, cookies, third-party data
   • Legal Basis for Processing (required for GDPR) — Consent, contract performance, legitimate interest
   • How Information Is Used — Service delivery, analytics, marketing, legal compliance
   • Information Sharing — Service providers, analytics vendors, payment processors; no selling of personal data (or disclose if sold per CCPA)
   • Data Retention — How long data is kept; deletion policy
   • Security — Reasonable security measures; breach notification commitment
   • User Rights — Access, correction, deletion (right to be forgotten), portability, objection, opt-out of sale
   • Children's Privacy — COPPA compliance; no knowing collection from users under 13
   • International Transfers — Standard contractual clauses or other mechanisms for cross-border transfers
   • Contact / DPO Information — How to exercise rights; Data Protection Officer if applicable
4. Draft the EULA (if applicable) covering:
   • License grant (personal, non-exclusive, non-transferable, revocable)
   • License restrictions (no reverse engineering, no sublicensing, no commercial use if free tier)
   • IP ownership (all rights reserved to licensor)
   • Updates and support terms
   • Warranty disclaimer and limitation of liability
   • Termination on breach
5. Tailor for jurisdiction and audience — Add GDPR-specific sections (legal basis, DPO, data subject rights) for EU users; add CCPA-specific sections (right to know, opt-out of sale, non-discrimination) for California users; add COPPA language if any users may be under 13.
6. Apply plain-language principles — Use short sentences. Avoid Latin phrases. Define jargon on first use. Use "you" for the user and "we" or "[Company Name]" for the company. Use active voice.
7. Add version control and effective dates — Every legal document must include a version number and effective date at the top. Include a changelog or "last updated" date. Explain how users will be notified of changes.
8. Review for completeness against a checklist — Confirm the ToS includes all 14 sections listed in step 2; the Privacy Policy includes all 10 sections in step 3; the EULA includes all 7 items in step 4.
9. Add a prominent disclaimer at the top of the draft — Note that the document is a template draft requiring attorney review before publication.
10. Recommend legal review triggers — Flag specific circumstances that require mandatory attorney review: collecting health data (HIPAA), financial data (GLBA), operating in the EU (GDPR DPA), serving children under 13 (COPPA), processing payments (PCI DSS), or operating in highly regulated industries.

Examples

Example 1: Terms of Service for a B2C SaaS Project Management App

⚠️ Draft Template — This document requires review by a licensed attorney before publication.

Example 2: Privacy Policy for a Mobile App (Consumer, Ad-Supported)

⚠️ Draft Template — Review by a licensed attorney is required before publication, particularly given CCPA, COPPA, and GDPR implications.

Best Practices

• Always include an effective date and version number — users and regulators need to know which version applies to them
• Use a clickwrap acceptance mechanism (explicit checkbox + "I agree") rather than browsewrap (passive "by using the site you agree") — clickwrap is far more legally defensible
• Keep the Privacy Policy and ToS as separate documents — bundling them makes each less readable and can cause compliance issues
• For GDPR compliance, document your legal basis for each category of data processing — consent is not always the right basis
• Review and update legal documents whenever you: add a major new feature, change your data sharing practices, change your pricing model, or enter a new jurisdiction
• Store records of when users accepted each version of your Terms — this is critical evidence if a dispute arises

Common Mistakes

• Using a generic template without customizing for your actual data practices — a Privacy Policy that doesn't match reality creates liability
• Omitting the arbitration clause or making it non-mutual — courts are increasingly scrutinizing unfair arbitration provisions
• Failing to address user-generated content rights — if users can post content, you need a license to display and store it
• Not including a data retention / deletion section — required under GDPR and CCPA and important for user trust
• Setting the liability cap too low (e.g., $5) — courts sometimes void unconscionably low caps, undermining the entire clause
• Publishing a Privacy Policy that mentions GDPR or CCPA compliance without actually implementing the required operational practices

Tips & Tricks

• Link to your Privacy Policy and ToS in your app store listing, registration page, footer, and any marketing emails — this creates a clear acceptance record
• Use a "summary table" at the top of your Privacy Policy (e.g., "What we collect | Why | How long") to improve readability and demonstrate good faith to regulators
• For cookie consent (GDPR), use a consent management platform (CMP) rather than trying to hand-code the consent flow — the technical requirements are complex
• Version your legal documents with semantic versioning (1.0.0, 1.1.0) and maintain an archive — you may need to prove what a user agreed to at a specific point in time
• Add a "plain-language summary" section at the top of your ToS — it doesn't replace the legal text but significantly improves user trust and reduces disputes

Related Skills

• contract-reviewer
• legal-summarizer