Terms of Service and Privacy Policies Should Be Reviewed Every Time Your Business Changes
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
In startup legal work, terms of service and privacy policies are typical documents that tend to be put off. It is not unusual to see them drafted once at incorporation or at service launch and then left with their original wording intact, even though the business has changed substantially. Services are updated day by day, with pricing revisions, the addition of corporate plans, the introduction of user posting features, and the use of external generative AI or overseas cloud services. As a result, an inconsistency tends to arise in which sales materials describe the latest features while only the terms and policy are left untouched, still premised on the early-stage business of the past.
This is not merely a problem of old text formally remaining in place. Terms of service are a contractual document that settles between the business operator and its users what is provided, what is prohibited, and the scope of responsibility, including damages. A privacy policy is a public document that tells users for what purposes personal information is collected, to what extent it is used, and how third-party provision and outsourcing are handled. Neither can perform its intended function if it diverges from the current reality of the business.
How Terms of Service Drift as the Business Changes
Terms of service are the document that sets out the conditions on which a service is provided. For example, when moving a service originally released as a free beta to a paid SaaS, the immediate issues are how to set out the timing of fee payments, payment methods, and refunds upon mid-term cancellation. When adding a corporate plan, permission settings through administrator accounts within the organization, management of employee use, and responses to requests to disclose audit logs also become issues in the terms.
The Impact of New Features and Plan Changes
If a service lets users post text or images, you need to clarify in advance to whom copyright in the posted data belongs and the criteria for removing inappropriate posts that violate the terms of service. When incorporating an external generative AI tool, the terms must also reflect how prompts entered by users and the resulting outputs are handled, and whether the data is used to train AI models.
In this way, when the shape of the business or service changes, the conditions to be included in the terms naturally change too. At the stage of planning new features or changes to pricing plans, check the contract provisions that will be affected.
The Civil Code Rules on Standard Terms and the Amendment Procedure
Simply posting new terms of service on your website does not necessarily mean they automatically apply to all existing users. A change to standard terms under Article 548-4 of the Civil Code (Japanese) is permitted only where the change conforms to the general interests of the counterparties, or where the change does not conflict with the purpose of the contract and is reasonable in light of the necessity of the change, the appropriateness of the content after the change, whether there is a provision allowing changes and what it says, and other circumstances.
When making a change, you must set the effective date in advance and give notice, by an appropriate method, that the terms will be changed, of the content of the changed terms, and of the effective date. For the change route based on reasonableness, the law provides that the change has no legal effect unless notice has been completed before the effective date arrives. Where the transaction does not fall within the requirements for standard terms, or where these change requirements cannot be met, you will need another legal basis, such as obtaining individual renewed consent. When raising fees, strengthening limitations of liability, or adding restrictions on cancellation, carefully decide on the means of obtaining consent and giving advance notice, in light of the previous contract terms and the reasons for the change.
This judgment of legality cannot be made by looking only at the wording of the statute. The amendment procedure should be designed after understanding the reality: what kind of service it is, what kind of users use it, and why the change is necessary for the business to survive or grow. To prevent frontline sales staff or the product team from changing service conditions without a check of the terms, it is important for the legal side to verify not only the amended provisions but also the notice text to users, the sales materials, and the actual flow of the account deletion and cancellation screens.
Rules Under the Consumer Contract Act and the Act on Specified Commercial Transactions
For B2C services aimed at general consumers, the latitude a business has to draft its terms of service freely narrows considerably. The Consumer Contract Act grants a right to rescind contracts induced by improper solicitation, and also provides that clauses limiting consumers' rights and unfairly exempting the business from liability are void. Clauses that uniformly exempt the business from liability for damages, or provisions imposing excessive penalties on consumers, may be denied effect even if they are written into the terms.
For e-commerce sites and subscription services, the display obligations and the design of the final confirmation screen under the Act on Specified Commercial Transactions also come directly into play. Whether the screen design allows users to clearly recognize the amount and timing of recurring charges, whether there is automatic renewal, and the cancellation procedure immediately before they press the final order button is something to check separately from what the body of the terms says.
Even if you tidy up the wording of the terms of service, legal trouble cannot be fully prevented if it contradicts the actual application flow, advertising expressions, or the wording on the payment screen. In a legal review, it is essential not to stop at checking the provisions of the terms, but to check the entire sequence of screens through which users actually enter into the contract, on a real device or in a preview.
Privacy Policies and the Flow of Data Within the Company
In a privacy policy, the purposes of use should be specified and described as concretely as possible, in line with the General Rules Guidelines of the Personal Information Protection Commission (Japanese). When personal information is obtained directly from the individual through a document or an input form, the purpose of use must, as a rule, be clearly indicated in advance. Accurately distinguishing between third-party provision of personal data and outsourcing is also fundamental.
According to the Commission's announcement (Japanese), the act amending the Act on the Protection of Personal Information (APPI) and related laws was enacted on July 10, 2026 and promulgated on July 17. Except for some provisions, it is to take effect on a date specified by Cabinet Order within two years of the date of promulgation. Because there is a time lag between enactment and promulgation and the effective dates of the individual provisions, in practice as of September 13, 2026, work should proceed by separating compliance with the provisions of current law that are already in force from preparation for the amended provisions that will take effect in the future.
As the business grows, the flow of data exchanged within the company becomes more complex. What started as a simple inquiry contact point expands to the introduction of CRM tools, integration with web analytics tools, and further to the use of generative AI. There are also more situations in which applicant information from recruiting and the contact details of client contacts are consolidated into internal systems. Therefore, when reviewing the policy, an effective approach is to create and check a data map visualizing the company's internal data flows before revising the wording of the provisions.
On which screen is whose information obtained, which internal department handles it, and to which external SaaS or overseas servers is it transmitted? Is it used for ad delivery or profiling, is it entrusted in connection with outsourcing, or could it amount to third-party provision? If you revise only the policy without grasping this reality, you end up with a document that diverges from actual handling. A change in the purpose of use is permitted only within the scope reasonably recognized as related to the previous purpose. Use beyond that scope requires the individual's consent to that use, except where the law provides an exception. If consent has already been obtained, check the scope it covers. Take sufficient care to note that merely rewriting the policy and posting it on the site does not mean you have obtained valid consent for use beyond the purpose or for third-party provision.
Stating How Data Is Handled When Introducing Generative AI
In recent years, efforts to build generative AI features into existing services have become widespread. What needs to be checked here is to which servers the prompts and internal materials entered by users are sent, how they are stored, and whether they are used for machine learning of the models. What should be described in the terms of service and privacy policy differs depending on whether the company operates the model itself, whether it passes data to an external API provider, and whether the provider's terms allow it to use the input data for its own training purposes.
If users may enter confidential business information or personal information into the service, clearly set out in the terms or on the screen the scope of data that must not be entered, the content of security control measures, and the contact details of the inquiry desk.
In addition, providing personal data to a contractor located in a foreign country may be subject to regulation under Article 28 of the APPI. Even for outsourcing to a foreign country, confirm the basis for provision: whether a statutory exclusion applies, whether there is a system to continuously take the equivalent measures required by law, or whether the individual's consent has been obtained after providing the required information. Even where the cloud provider's specifications mean it does not itself handle the personal data, make the judgment after checking the contract terms and the reality of access.
On the screen, an AI feature looks like a single added feature, but behind it the legal relationships of multiple fields, such as personal information protection, copyright, and limitation of liability, intersect. When adding features, it is important to review the related rules as a single set.
Consistency With Sales Materials and Change Management
One problem that is easy to overlook is a discrepancy between the terms of service and sales materials. Examples include cases where the terms provide that "the Company may change the content of the service without prior notice" while a sales proposal explains that "this feature will be available permanently"; where the policy does not mention advertising use but frontline staff propose advertising integrations; or where the terms treat support as a best-efforts target but an individual proposal states "response within 24 hours." Such discrepancies cause trouble in negotiations and lead to liability claims in disputes.
What legal should check is not limited to the provisions of the terms of service and privacy policy. It also includes customer proposals, help pages on the website, and the text of automatically sent emails. Especially during the period of organizational expansion around a Series A, sales materials and memoranda for individual arrangements increase rapidly. Ensuring consistency between the terms and what the sales team is telling customers at this stage is important.
Practical Checklist
When proceeding with amendments to the terms of service and privacy policy, start by checking the following items.
- Whether the service content, pricing structure, contract term, and cancellation procedure match actual operations
- Organization of administrators, users, subcontractors, and the scope of support for corporate use
- Reflection of whether there are user posts, file storage, and generative AI features
- The effectiveness of prohibited conduct, suspension of use, data deletion, and conditions for specification changes
- Consistency of disclaimer and damages clauses in consumer contracts with the Consumer Contract Act
- Consistency with the displays required under the Act on Specified Commercial Transactions and the final confirmation screen for mail-order sales and subscriptions
- Whether the purposes of use of personal information match how it is actually obtained and used within the company
- Organization of the status of outsourcing, joint use, third-party provision, and provision to foreign businesses
- Arrangements for reporting, notifying individuals, and the internal structure when an incident such as a data leak occurs
- Consistency with sales materials, FAQs, landing pages, application screens, and cancellation screens
This check should not be completed by the legal department alone; information held by development, sales, and information systems should be gathered and reflected in the documents.
In LegalAgent's legal outsourcing, we review terms of service and privacy policies in step with changes in the business. What matters is the accumulation of judgments such as checking the impact on the terms before releasing a new feature, checking the method of applying a price revision to existing users and the notice text before the revision, and examining the flow of input data before introducing an AI feature.
When outside attorneys provide ongoing support from a position close to in-house legal, these legal judgments can be made as part of daily operations. Even after a one-off amendment of the terms, set out in advance the procedure for who in the company will consult legal when a change occurs in the business. I believe that a structure in which the terms of service, privacy policy, user interface, and sales materials are updated together as the business progresses is what leads to a sound legal function at a startup.
Consultations on Reviewing Terms of Service and Privacy Policies
If you would like to carry out periodic reviews of your terms of service and privacy policy together with outside attorneys, please see the following pages.
Frequently asked questions
Why should terms of service and privacy policies be reviewed when a business or service changes?
Because if the business reality and the content of the documents diverge, the documents can no longer serve their intended functions. Terms of service are a contractual document that establishes what is provided, prohibited conduct and the scope of liability, while a privacy policy is a public document that states the purposes of use of personal information and any third-party provision. Failing to update them to match reality, such as price changes, new features or the use of external AI, could lead to unexpected legal trouble.
If we post new terms of service on our website, do they automatically apply to existing users?
They do not necessarily apply automatically. Under the Civil Code, a change to standard terms is permitted only where the change conforms to the general interests of the counterparties, or where it does not contradict the purpose of the contract and can be said to be reasonable, and in either case the changed content and its effective date must be made known by an appropriate method. It is understood that where these requirements cannot be met, or for transactions that do not fall under standard terms, a different legal basis, such as obtaining individual renewed consent, needs to be prepared.
If we revise our privacy policy and post it on our site, can we use personal information in new ways?
Merely posting it does not enable new uses. A change in the purpose of use is permitted only within a scope reasonably recognized as relevant to the previous purpose, and use beyond that requires the individual's consent except under statutory exceptions. It is understood that rewriting and publishing the text of the policy does not amount to obtaining valid consent for use beyond the purpose or for third-party provision.
Services connected to this topic