Why SaaS ToS differ from standard website terms
A standard website terms of service governs how visitors use your site. A SaaS terms of service governs an ongoing contractual relationship — subscription billing, access to a software product, user data, uptime expectations, and support obligations. The stakes are higher and the terms need to be more detailed.
1. Grant of license and subscription terms
Clearly state what the user is getting: a limited, non-exclusive, non-transferable license to use the software during their subscription period. Specify:
- What tier or plan they're on and what it includes
- Number of seats or users permitted
- Geographic restrictions (if any)
- Whether the license is for personal or commercial use
2. Subscription billing, auto-renewal, and refunds
This is one of the most legally fraught sections. FTC regulations and state consumer protection laws (particularly in California under APC §17601) require clear disclosure of:
- The price of the subscription and billing frequency
- That the subscription will auto-renew unless cancelled
- How to cancel, and the cancellation deadline
- Your refund policy (even if it's 'no refunds after 7 days' — just say so clearly)
- What happens to data on cancellation or non-payment
3. Acceptable Use Policy (AUP)
Your AUP defines what users can and cannot do with your software. At minimum, prohibit:
- Reverse engineering, decompiling, or scraping your software
- Using the service to transmit spam, malware, or illegal content
- Attempting to gain unauthorized access to other users' accounts or your infrastructure
- Sharing login credentials or exceeding seat limits
- Using the service in ways that violate applicable law
4. Data ownership, processing, and privacy
For SaaS, your ToS must address who owns the data users put into your system. The answer is almost always: the user owns their data; you have a license to process it to provide the service. Also specify:
- That you will handle their data per your Privacy Policy (link to it)
- How long you retain data after account deletion
- Whether you use aggregated or anonymized data for analytics or product improvement
- If you process personal data of EU residents, note that you have a DPA (Data Processing Agreement) available
5. Limitation of liability and warranty disclaimer
This is your most important protective clause. In plain English, it says: 'if our software has a bug and causes you losses, we aren't liable beyond the amount you paid us in the last 12 months.'
6. Termination rights
Specify clearly: who can terminate, on what grounds, with how much notice, and what happens to the user's data on termination. Include your right to suspend or terminate immediately for AUP violations.
7. DMCA compliance
If your platform allows any user-generated content (even file uploads or form data), you should include a DMCA safe harbor clause. To qualify for safe harbor protection under the Digital Millennium Copyright Act:
- Register a DMCA agent with the US Copyright Office
- Publish a DMCA takedown contact email in your ToS
- Implement a repeat infringer policy
- Describe the takedown process for copyright holders