SaaS legal docs (Terms of Service + Privacy Policy)

SaaS legal docs (Terms of Service + Privacy Policy)

Draft protective, industry-standard ToS + Privacy pages. You are not a lawyer — produce a strong draft template and tell the user plainly it needs an attorney's review before they rely on it (liability caps, entity/jurisdiction specifics, and GDPR/CCPA obligations are where a real lawyer matters). Never claim certifications (SOC2, ISO, HIPAA) the company doesn't hold.

Pin down the facts first

Before writing, get these — guessing wrong here is the costly part:

• Operating legal entity (the company that legally owns the product) and its registration numbers/type. This is often NOT the product name — a product can be a DBA of a foundation/LLC.
• Registered address, contact email(s) (a general support@ and a privacy@ for data requests — reuse addresses that actually receive mail; don't invent).
• Governing law + venue (the entity's jurisdiction, e.g. "British Columbia and the federal laws of Canada; venue Vancouver").
• Product shape — what it does, what third-party platforms/APIs it touches, whether it has paid plans / credits / free trials, whether it uses AI generation, whether it sends SMS.
• Processors actually in use (Cloudflare, Stripe, email/SMS providers, the platforms it publishes to) — describe by category; don't over-commit to an exact vendor list that goes stale.

Research competitor structure — coverage only, never wording

WebFetch a few comparable SaaS legal pages for SECTION COVERAGE and standard-clause patterns (e.g. Buffer buffer.com/legal/terms + /privacy, Later, Typefully, the incumbent in your space). Copyright: synthesize ORIGINAL prose covering the same ground in your own words — never paste their text. Some competitors 404 their legal URLs; that's fine, two good references are enough to confirm you're not missing a standard section.

Terms of Service — section checklist

1. Acceptance & eligibility (18+, authority to bind an org). 2. Description of service. 3. Accounts & security. 4. Acceptable Use Policy (no spam/illegal/infringing/hateful content, no violating third-party platform terms, no scraping/reselling/abuse). 5. User content & license — user keeps ownership; grants a limited license to process/transmit their content to deliver the service; user is solely responsible for their content and for each platform's rules. 6. Third-party platforms & APIs — not affiliated; features may break when platform APIs change; platform suspensions aren't your responsibility. 7. AI-generated content — output may be inaccurate; user must review before relying on/publishing it; user owns the responsibility for what they publish. 8. Fees, billing & credits, refunds, plan changes (omit a free-trial clause if there are no trials). 9. SMS/Text messaging terms (if applicable — see below). 10. Intellectual property (you own the platform). 11. Disclaimer of warranties — "AS IS" and "AS AVAILABLE", no warranties, to the fullest extent permitted by law. 12. Limitation of liability — cap total liability at the greater of trailing-12-month fees or a small fixed sum (e.g. USD $100); exclude indirect/incidental/consequential/special damages, lost profits, lost data, and damages from third-party platform actions — with a carve-out noting consumer-protection law may not permit full limitation in some jurisdictions. 13. Indemnification — user indemnifies the company for their content and misuse. 14. Termination & suspension (either party; you may suspend for AUP breach).
2. Changes to service and terms. 16. Governing law & dispute resolution. 17. Miscellaneous (severability, entire agreement, assignment, no waiver, force majeure). 18. Contact.

Privacy Policy — section checklist

Data controller (the legal entity + address); a plain-language summary line; data collected (account, content, third-party OAuth tokens, usage/analytics, device/log, SMS if applicable); how used + legal bases; processors/subprocessors (by category); "we do not sell personal information"; international transfers; retention; security; user rights — a GDPR list for EU users AND a CCPA/CPRA subsection for California, with how to exercise them; children (not for under-16/18); cookies; changes; contact + a privacy-request address. Give each page a visible "Last updated: " and keep both pages' dates in sync when you materially change either.

SMS / A2P consent language (if the product texts users)

Carriers reviewing a toll-free/A2P registration open the linked Terms + Privacy. They must contain: consent to receive texts, message frequency, "message & data rates may apply", reply HELP for help / STOP to opt out, "consent is not a condition of purchase", and in Privacy the exact carve-out "mobile information / SMS consent is never shared with or sold to third parties or affiliates for marketing." See the twilio-number-provisioning skill for the registration side.

Marketing-page gotchas (Next.js / JSX content pages)

• Legal pages usually live in the marketing app (e.g. apps/marketing/src/app/(legal)/{terms, privacy}/content.tsx) — grep the visible page text to find the source. Match the existing heading/prose/Link structure; expand, don't restructure.
• Preserve existing sections verbatim (a prior SMS-consent section, a specific carve-out) when expanding a page.
• Watch react/no-unescaped-entities — escape apostrophes/quotes in JSX ('/’) as the file already does. Run bun run lint && bun run typecheck (or the repo's equivalent); pre-commit fails on lint ERROR level.
• Standard PR discipline: branch off latest main, git fetch before push (review councils auto-commit), no AI/co-author trailer, PR body carries a one-line "DRAFT — not legal advice, recommend attorney review."

Judgment calls to surface to the user

Always list these back for confirmation: the contact email(s) chosen, the liability cap amount, the named processors (esp. if you changed one, like an email vendor), the governing-law jurisdiction, and any clause you included/omitted based on product facts (free trials, AI, SMS).