# Specialist reference: SaaS terms of service and customer agreements

Load this reference when the requested document is terms of service or a customer agreement for a SaaS or platform product. It supplements, and does not replace, the base contract-drafter method — run the base classification, commercial-term extraction, definitions, drafting-notes and open-points output as normal, and apply the steps below in addition when drafting the license grant, risk allocation, and exit provisions.

## Additional required inputs

**The commercial model.** The subscription structure, pricing basis, and a description of what the SaaS product actually does. Blocking — access and license terms cannot be drafted without knowing what is being licensed.

**Whether this is B2B or B2C.** Consumer-facing terms carry protections — cooling-off rights, specific dispute resolution requirements, restrictions on unfair terms — that business-to-business terms do not, in many jurisdictions. Ask; do not assume B2B by default, since getting this wrong misses real, mandatory content. Flag this explicitly if the customer base could plausibly include consumers even where the primary market is business.

Not blocking, ask once and proceed on what is confirmed: whether a separate data processing agreement is needed, or should be incorporated into these terms. SaaS products routinely process customer data, and this is a common, consequential gap if left unaddressed.

## Additional method

1. Draft the licence or access grant precisely tied to the product actually described — scope of use, permitted users, and restrictions such as no reverse engineering or no reselling.
2. Draft service level commitments only as actually instructed. Do not invent an uptime percentage, a support response time, or a service credit mechanism. If none has been given, either ask or state plainly that the agreement is silent on SLA and flag this as a gap the user should decide on.
3. Address data processing. At minimum, flag that if personal data is processed, a data processing agreement or equivalent terms covering controller and processor roles, security, and data protection obligations are likely required — and note that whether this is actually required, and what it must contain, depends on the applicable data protection law, which needs to be confirmed rather than assumed satisfied. For a full standalone DPA, hand off to data-processing-agreement-reviewer.
4. Draft IP ownership provisions precisely — the provider retains IP in the platform, the customer retains IP in their own data and content — and draft any feedback or improvement clause narrowly enough that it does not inadvertently claim rights over customer data beyond what was actually intended.
5. Draft limitation of liability and indemnity provisions consistent with what is actually agreed, and flag the enforceability of any liability cap or exclusion under the governing law rather than asserting it. Many jurisdictions restrict excluding liability for gross negligence, data breaches, or in consumer contracts specifically — this needs verification, not assumption.
6. Draft termination and data-return provisions — what happens to customer data on termination, export rights, and the deletion timeline.
7. Draft payment terms and renewal mechanics, flagging that auto-renewal clauses are specifically regulated in some jurisdictions, particularly for consumer contracts, rather than drafting one without noting this.

## Additional output

In the drafting-parameters section, state B2B or B2C alongside the other parameters. In the draft itself, ensure licence grant, SLA (or explicitly flagged as absent), data processing position, IP ownership, limitation of liability, termination/data-return, and payment/renewal are all present as identifiable sections. In points requiring verification, include data protection law applicability, consumer protection requirements if B2C, liability-cap enforceability, and auto-renewal regulation.

## Additional guardrails

- Do not invent a specific SLA commitment — uptime percentage, response time — that was not instructed.
- Do not assume B2B when the customer base could include consumers, without confirming.
- Do not assert that a data processing agreement is unnecessary. Flag data protection applicability as a verification point whenever personal data is processed.
- Do not assert that a liability cap or exclusion is enforceable under the governing law.
- Do not draft an auto-renewal clause without flagging that such clauses are specifically regulated in some jurisdictions.