How to Prepare SaaS Terms of Use and a Privacy Policy Before Launch

Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.

When launching a new SaaS product, preparing the terms of use and the privacy policy tends to be put off. Busy with feature development, creating sales materials, and introducing a payment system, companies sometimes prepare the legal documents just before launch.

The terms of use and the privacy policy reflect the actual content of the service. They set out the commitments and policies for running the business, such as the allocation of responsibility with customers, authority to manage the data entrusted to the service, and the rules for billing fees. In B2B SaaS in particular, the legal departments of customer companies will check them in detail, so it is necessary to prepare terms that reflect the actual service from the outset.

Designing Terms of Use That Fit the Business Model

What to be careful about when drafting terms is reusing the text of another company's service or a generic template as is. A standard clause structure is a useful reference, but check clause by clause whether it fits your own delivery model.

What needs to be provided for differs fundamentally depending on whether pricing is a flat monthly fee or usage-based, whether there is a free trial period, whether contracting parties are limited to corporations or include individual use, whether users store or send files, and whether AI features or integrations with other companies' services are built in. Especially in SaaS for corporate customers, provisions such as advance notice of planned outages, data deletion procedures after the contract ends, and management of administrator account permissions become practical focal points.

A Privacy Policy That Reflects How Data Is Actually Handled

The privacy policy specifically discloses what personal information is acquired, for what purposes, and how it is handled. Lining up abstract boilerplate is not enough; check it against the types of data your product actually acquires, the purposes of use, and the actual outsourcing contractors.

In SaaS, personal information may be included not only in information about customer companies' contact persons, access logs, and payment information, but also in data that customers upload to the system.

In doing so, distinguish between information handled for your own business purposes and information processed on behalf of customers. Even when acting on behalf of customers, you are not exempt from the statutory obligations of a business handling personal information. Because the Act on the Protection of Personal Information and the various guidelines are reviewed periodically, confirm the laws that apply at the time the service is launched.

Matters to Consider When Adding AI Features

When building generative AI features into a product, set conditions in the terms of use and the privacy policy that correspond to the AI features. Sort out how input data is used for AI processing, whether it is sent to an external AI provider, whether it is repurposed as training data for machine learning, and how rights and responsibilities for the output are allocated.

Also agree on the scope of the disclaimer regarding the accuracy and completeness of the answers AI generates. Where users apply the AI's results directly to their core business operations, set out how far the service provider is responsible.

In addition, if you use an external AI API, check consistency with the conditions of use and data protection rules set by that provider. If there is a discrepancy between the terms presented to users and the terms of the external vendor, it may lead to trouble later.

Designing Clauses with Enterprise Transactions in View

In B2B SaaS, there are situations in which a company aims from the outset to be adopted by large companies or listed companies. Such enterprise customers will ask for detailed explanations of the security structure and the security control measures for personal data.

It is effective to design a response that combines security checklists and individual memoranda, rather than trying to cover everything in the terms of use on the website. There is no need to make the terms overly complex from the early stage, but anticipating future individual contracts, consider leaving room to accept changes to clauses and special terms.

Checklist Before Launching the Service

Before launching the service, check the consistency of the following items.

• Consistency between the pricing structure and the billing clauses in the terms of use
• Clear conditions for the free trial and cancellation procedures
• Express statement of the scope of handling of data input by users and ownership of rights
• Consistency between the items of personal information acquired and the purposes of use
• Adequacy of disclosures regarding external APIs and AI service integrations
• Limitation of liability for damages commensurate with the risks of the features provided
• Ownership of intellectual property related to the product
• Materials and a person in charge for answering questions from enterprise customers

The terms of use and the privacy policy put the business's commitments in writing. If you start drafting them at the stage of considering features and sales policy, it becomes easier to adjust the conditions before launch.

Support for Drafting Terms of Use and Policies

We accept requests for newly drafting or reviewing SaaS terms of use and privacy policies through the following service.

• Legal Outsourcing

Frequently asked questions

Is there any problem with launching SaaS by reusing another company's terms of use template as is?

It is likely best avoided, because there is a risk that it will not fit your company's service model. What needs to be provided differs fundamentally depending on whether pricing is a monthly flat fee or usage-based, whether contracting parties are limited to businesses or include individuals, and whether there are AI features or integrations with other companies' services. Particularly for business-facing SaaS, matters such as advance notice of planned outages and procedures for deleting data after the contract ends need to be set out in line with actual practice.

Do we bear statutory obligations even when processing personal data on behalf of customers?

You are not exempt from the statutory obligations of a business handling personal information. Even if you are in the position of being entrusted by customers, the obligations under the Act on the Protection of Personal Information are not waived. In the privacy policy, distinguish between information handled for your own business purposes and information processed on behalf of customers, and check this against the types of data acquired, the purposes of use and the actual outsourcing contractors.

When incorporating generative AI features into SaaS, what clauses are needed in the terms of use?

You need to set out matters such as the conditions for handling input data and the scope of disclaimers regarding AI output. This is because you need to sort out whether input data is sent to external AI providers or repurposed as training data, and how rights and responsibility for outputs are allocated. You also set out the scope of disclaimers regarding the accuracy and completeness of generated answers, after checking consistency with the terms of use of the external AI providers.