TL;DR: do you need terms of service and a privacy policy, and can you use a template?
If your website or app collects any personal data, and almost every one does, the GDPR requires a privacy notice with a fixed list of information. Terms of service aren't required by one single law, but if you sell online, EU consumer law, the E-Commerce Directive and, for platforms, the Digital Services Act decide much of what they must say. A template is a fine starting point for a bootstrapped startup, as long as it was written for EU law and for your business model, and you rewrite it to match what you actually do. Copy-pasting someone else's policy is the mistake that gets founders into trouble.
💡 Starting your legal setup from zero? Read our ultimate guide to legal and compliance basics for startups first.
Two documents sit in the footer of almost every startup website: the terms of service (also called terms and conditions, terms of use or T&Cs) and the privacy policy. Most founders write them in an afternoon, often by copying a competitor or pasting a generator's output. Most users never read them. But regulators, courts, payment providers, app stores and the procurement teams of B2B customers do.
This guide is for bootstrapped European founders launching a SaaS, an app, an online shop or a marketplace. It explains what EU law says each document must contain, which free and paid templates exist and what they cost, how to adapt one in five steps, and how to make your terms actually binding. It isn't legal advice: use it to get most of the way yourself and to know when to hire a lawyer instead of doing it yourself.
The first two numbers come from a 2020 study by Jonathan Obar and Anne Oeldorf-Hirsch: 543 people joined a fictitious social network, 74% skipped the privacy policy entirely, and 98% missed the "gotcha" clauses hidden in the terms, including handing over their first-born child as payment.
What's the difference between terms of service and a privacy policy?
The terms of service are a contract: the rules for using your product and what each side owes the other. The privacy policy is a notice: it tells people what you do with their personal data. You can't make someone "agree" to a privacy policy in the GDPR sense, and EU regulators say privacy information should be kept clearly separate from contractual terms. So keep two documents, not one.
Two related documents often sit next to them. A cookie policy, or the cookie section of your privacy policy, explains trackers; see our guide to cookie consent and website compliance. And if you process data on behalf of business customers, they will ask you to sign a data processing agreement (DPA), which is a separate contract, not part of your privacy policy.
What must a privacy policy contain under the GDPR?
The GDPR doesn't use the words "privacy policy", but Articles 13 and 14 list exactly what you must tell people, and Article 12 says how: in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Getting Articles 12 to 22 wrong falls into the higher fine tier: up to €20 million or 4% of worldwide annual turnover, whichever is higher.
Data you collect yourself vs data you get from others
Article 13 covers data people give you directly, through a signup form, a checkout or your app. You must give the information at the moment you collect the data. Article 14 covers data you get elsewhere: a bought or enriched lead list, scraped profiles, data from a partner. There you must also say which categories of data you hold and where they came from, and tell the person within a reasonable period, at the latest within one month, or at the first contact if you use the data to reach them. Founders running cold outreach often forget this second duty.
How to write it so it passes
The EU regulators' transparency guidelines are surprisingly practical. Their main points:
- Use layers. A short summary first, with links to the detail, works better than one long wall of text.
- Avoid vague words. The guidelines name "may", "might", "some", "often" and "possible" as warning signs. "We may use your personal data to develop new services" is their example of poor practice.
- Make it easy to find. A clearly visible link on every page, under a common name such as "Privacy" or "Privacy Policy". In an app, it should be in the app store listing before download and never more than two taps away inside the app.
- Name the purposes and legal bases together. For example: "to send invoices (contract)", "to send our newsletter (consent)", "to keep accounting records (legal obligation)".
- Give real retention periods. "Seven years for invoices" or "12 months after your account closes", not "as long as necessary".
Small companies get checked too. In 2025 the Spanish data protection authority formally reprimanded the owner of a small website after a complaint: the privacy policy didn't name the controller or contact details, said nothing about retention, didn't list all the rights and left out the right to complain to the authority. There was no fine that time, but the owner had to rewrite the policy. At the other end of the scale, the French CNIL fined Google €50 million in 2019 for unclear, scattered privacy information, and the Irish regulator fined WhatsApp €225 million in 2021 over transparency failures.
Children and the age of digital consent
If your product could appeal to teenagers and you rely on consent, Article 8 of the GDPR sets the age at which they can consent alone to online services: 16 by default, but each country can lower it to as little as 13. Below that age you need a parent's consent and must make reasonable efforts to verify it.
Sources: GDPR Article 8 and national data protection acts, checked October 2026.
What should your terms of service include?
Unlike the privacy policy, there's no single EU list for terms of service. What you need depends on whether you sell to consumers (B2C) or businesses (B2B), and on whether you host content other people upload. This is the core set for a small European startup:
Sources: Consumer Rights Directive 2011/83/EU, Unfair Contract Terms Directive 93/13/EEC, E-Commerce Directive 2000/31/EC, Digital Content Directive (EU) 2019/770, P2B Regulation (EU) 2019/1150, Data Act (EU) 2023/2854, German Civil Code (BGB).
If you sell to consumers
B2C terms carry the most rules. Under the Consumer Rights Directive, a consumer who buys online can withdraw within 14 days without giving a reason, and if you fail to tell them about that right, the period is extended by 12 months. For paid digital content that starts straight away, the consumer only loses the withdrawal right if they expressly consented to the early start, acknowledged they'd lose the right, and you confirmed it. The order button must say "order with obligation to pay" or something just as clear; the EU Court of Justice ruled in 2022 that only the words on the button itself count.
Since 19 June 2026, every online distance contract also needs a withdrawal function: a clearly labelled "withdraw from contract here" button, available for the whole withdrawal period, leading to a short form and a "confirm withdrawal" button, followed by an acknowledgement by email or another durable medium. Germany has also required a cancellation button for online subscriptions since July 2022, labelled "Verträge hier kündigen"; without it, customers can cancel at any time without notice.
Any term a consumer couldn't negotiate is tested for fairness. A term that creates a significant imbalance against the consumer is not binding, unclear wording is read in the consumer's favour, and the Unfair Contract Terms Directive's annex lists suspicious clauses, such as changing the terms without a valid reason stated in the contract. Under the Digital Content Directive, consumer protection also applies when people "pay" with their personal data instead of money: a free app is not exempt. And the Omnibus Directive gave regulators teeth: for widespread cross-border infringements, the maximum fine must be at least 4% of your annual turnover in the countries concerned.
If you sell to businesses
B2B SaaS terms are mostly freedom of contract at EU level: the consumer directives don't apply. Two exceptions catch European founders. First, German law still tests standard terms used against businesses for unreasonableness, so a sweeping liability exclusion can fail there. Second, the EU Data Act has applied to cloud and SaaS providers since 12 September 2025: your contract must let customers switch away with a notice period of at most two months, give them at least 30 days to retrieve their data and delete it fully afterwards, and from 12 January 2027 you can't charge switching fees. Our guide to bootstrapping a SaaS startup covers the product side.
If users post content or you run a marketplace
If you store content that users upload, such as reviews, profiles, listings, files or comments, you're a hosting service under the Digital Services Act. Article 14 applies to every intermediary service, with no exemption for small companies: your terms must say what content you restrict, how you moderate it (including any automated tools and human review) and how users can complain, in clear and plain language, and you must tell users about significant changes. Micro and small companies are exempt from several other DSA duties, but not this one. If businesses sell through your platform, the P2B Regulation adds plain-language terms for those business users and at least 15 days' notice of changes; terms that break those rules are void.
If your product uses AI
Since 2 August 2026, Article 50 of the EU AI Act requires that people are told when they're talking to an AI system, unless it's obvious. Generative AI outputs must also be marked in a machine-readable way; systems already on the market before August 2026 have until 2 December 2026. These duties live mainly in your product's interface, but your terms and privacy policy should match: say which features use AI, which providers process the data and whether user inputs are used for training. Our guide on how European startups use AI without breaking GDPR goes deeper.
Imprint and company details
The E-Commerce Directive requires every online business to show its name, geographic address, email, trade register number and VAT number where they're easy and permanent to reach. Germany enforces this strictly through the Impressum, set out since May 2024 in section 5 of the German Digital Services Act (Digitale-Dienste-Gesetz, DDG), and competitors there send warning letters for missing details. One more update: the EU's online dispute resolution (ODR) platform closed on 20 July 2025, so remove the old ODR link from your terms and footer. If you use, or must use, a consumer dispute resolution body, you still have to name it.
Where to get terms of service and privacy policy templates
You have three options: free open templates you adapt yourself, paid generators that build and update documents from a questionnaire, and a lawyer. For most bootstrapped startups, the first two cover launch, and a lawyer reviews the result once revenue or risk grows.
Sources: the providers' own pricing and licence pages, checked 18 October 2026. Prices change often, so check before you buy. The UK ICO also has a free privacy notice generator for small businesses, but it's written for UK GDPR, so use it only as a reference.
Two warnings. Open licences come with conditions: CC BY means you credit the source, and CC BY-SA means your adapted terms must carry the same licence. And copying a competitor's terms without a licence can infringe their copyright, besides giving you promises that don't fit your product. To protect your own documents, product and brand, see our IP strategy guide to patents, trademarks and copyright.
How to adapt a template in five steps
- Map your data first. List every form, tool and integration: analytics, email platform, payment provider, CRM, hosting, AI APIs, support desk. For each, note what data goes in, why, where it's stored and for how long. Your privacy policy is only as accurate as this list, and it doubles as the start of your GDPR compliance work.
- Pick a base that fits your model. B2B SaaS can start from Common Paper or Bonterms. B2C needs a template written for EU consumer law. A platform with user content needs moderation and complaint clauses.
- Fill in your facts and cut the rest. Company name, address, register and VAT numbers, contact email, the countries you sell in. Then delete every clause about features, data, payment methods or countries you don't have. A policy that describes things you don't do is inaccurate, and that's a transparency problem too.
- Add the EU must-haves. For B2C: the withdrawal right and button, the order button wording, a cancellation path for subscriptions. For SaaS: Data Act exit terms. For platforms: DSA content rules. For AI features: what's automated and which providers you use.
- Publish, date and version. Put a "last changed" date at the top, keep every old version, and log which version each user accepted. Tell users before significant changes take effect.
Write in the language of your customers. Many EU countries expect consumer terms in their own language, and a policy nobody can understand fails the GDPR's plain-language test anyway. For everything else to sort out before you go live, our GDPR compliance checklist for early-stage startups and product launch checklist help.
How to make your terms binding
A link in the footer is not enough for a contract. In practice, terms hold up when the user saw them before agreeing, actively accepted them, and could save them:
- Use clickwrap. An unticked checkbox or a clear statement next to the signup or order button ("By creating an account you accept the Terms") with a link. The EU Court of Justice accepted in 2015 that click-wrapping can create a durable record of a jurisdiction clause, as long as the terms could be printed and saved before the contract was made.
- Let people store the terms. The E-Commerce Directive requires terms to be available in a way the user can store and reproduce, so offer a printable page or a PDF and send a copy in the confirmation email.
- Keep proof. Store the version number, timestamp and account for every acceptance. In a dispute with a consumer, you have to prove you gave them the required information.
- Don't bury them. The European Commission's study on consumers and terms and conditions found that 77.9% of people read at least part of the terms when they had to scroll through them, against 9.4% when the terms sat behind a link. Very short, simple terms were read in full more than twice as often as long, complex ones.
If a customer still disputes the terms, our guide to handling legal disputes and mediation explains the cheaper routes before court.
Are you getting customers from ChatGPT yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
Common mistakes with terms and privacy policies
- Copying a US template. US terms often exclude all liability, skip the withdrawal right and never mention legal bases or regulators. In the EU, much of that is unenforceable or simply missing.
- Describing tools you don't use. A generator's default list of analytics and ad tools makes your policy inaccurate. List what you actually run.
- "We may change these terms at any time." Against consumers, a change needs a valid reason stated in the contract, and users must be told in advance.
- Merging privacy into the terms. Asking users to "agree to the privacy policy" mixes up information, consent and contract.
- Forgetting updates. No withdrawal button, an old ODR link, no mention of the AI features you launched last quarter.
- No company details. A missing address, register or VAT number breaks the e-commerce rules and, in Germany, invites warning letters.
Your legal documents are part of a bigger checklist; for company setup by country, see the startup legal checklist by country.
Conclusion: a template is a start, not the finish
Terms of service and a privacy policy don't have to cost a bootstrapped startup thousands. Start from a template written for EU law and your business model, map your data honestly, cut everything that doesn't apply, and add the EU-specific pieces most templates miss: the withdrawal button, Data Act exit terms, DSA content rules and AI disclosure. Then keep them alive: date them, version them and update them whenever your product changes. Once you have paying customers in several countries, or you handle sensitive data, an hour of a lawyer's review is cheap insurance.
FAQ: terms of service and privacy policy templates
Is a privacy policy legally required for a small startup website?
Yes, if the site collects any personal data, for example through a contact form, newsletter signup, account, checkout or analytics that identify visitors. GDPR Articles 13 and 14 require you to give people specific information, whatever the size of your company.
Are terms of service legally required in the EU?
No single law says you must publish terms of service. But if you sell online, consumer and e-commerce law require much of the information they usually contain, such as your company details, prices, the withdrawal right and how the contract is concluded, and you need terms to set liability, payment and acceptable use.
Can I copy another company's terms and conditions?
Not without a licence: terms are usually protected by copyright, and someone else's terms describe their product, not yours. Use openly licensed templates such as Common Paper, Bonterms or the Basecamp policies, credit them as the licence requires, and rewrite them for your business.
Are free privacy policy generators good enough?
They're a reasonable start for a simple site, if they're built for EU law. Check that the output names your company, the tools you actually use, real retention periods, the legal basis for each purpose and the right to complain to a regulator. Generators often list tools you don't use, which makes the policy inaccurate.
What is the EU withdrawal button?
Since 19 June 2026, online sellers to consumers in the EU must offer a clearly labelled function, such as "withdraw from contract here", that lets consumers withdraw during the 14-day period, confirm it with a "confirm withdrawal" button and get an acknowledgement by email or another durable medium.
Do B2B SaaS startups need consumer clauses?
No, EU consumer law protects consumers only. But B2B SaaS terms must meet the Data Act's switching rules, German courts still test standard terms for reasonableness, and you need a DPA when you process personal data for business customers.
How often should I update my terms and privacy policy?
Whenever your product, tools or data use change, and at least once a year. Date every version, keep the old ones, and tell users before significant changes take effect; the Digital Services Act requires this for services that host user content.
Should my privacy policy mention AI tools?
Yes, if you send personal data to AI providers or use AI features. Name the purpose, the type of provider, any transfers outside the EEA and whether inputs are used for training. The AI Act also requires telling people when they're talking to a chatbot. For the GDPR side, read our GDPR compliance guide for early-stage startups.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
