Docat0209 Legal Guard SOP
Disclaimer: This is a starting framework, not legal advice. Consult a qualified lawyer for your specific jurisdiction and business. Laws change — verify requirements against current regulations before relying on this checklist.
1. Required Documents Checklist
Every SaaS product needs these before accepting users (source: TOS Lawyer, SaaS Law Firm Andrew S. Bosin LLC):
- Terms of Service (ToS) — governs the user-product relationship
- Privacy Policy — required by law if you collect any personal data
- Cookie Policy — required in EU/UK; recommended everywhere
- Data Processing Addendum (DPA) — required if handling EU customer data or selling to enterprise
- Acceptable Use Policy (AUP) — can be embedded in ToS or standalone
- SLA (Service Level Agreement) — expected by B2B/enterprise customers
- Refund/Cancellation Policy — can be embedded in ToS
2. Privacy Policy Essentials
Must clearly disclose (source: SecurePrivacy, Pandectes, Cookie-Script):
- What data is collected — list specific categories (name, email, usage data, payment info, device info)
- Why it's collected — state the legal basis for each category (consent, legitimate interest, contractual necessity)
- How it's stored — encryption, hosting location, retention periods
- How it's deleted — process for user-requested deletion and automatic purging
- Third parties — name every sub-processor (Stripe, analytics, email provider) and their purpose
- GDPR rights (for EU users) — access, rectification, deletion, portability, restriction, objection
- CCPA/CPRA rights (for California users) — right to know, delete, opt-out of sale/sharing, non-discrimination
- Children's data — state minimum age; if under 13, COPPA applies (US)
- Contact information — data protection officer or contact email for privacy requests
3. Terms of Service Essentials
Must include (source: TOS Lawyer, NJ Business Attorney SaaS Contracts Guide 2026):
- Service description — what the product does and doesn't do
- Acceptable use — prohibited activities (abuse, scraping, illegal use, reselling)
- Account responsibilities — user must secure credentials, accurate info
- Payment terms — pricing, billing cycle, currency, tax responsibility
- Refund policy — conditions, timeframe, process (be specific)
- Intellectual property — who owns what (your IP, user-generated content, data)
- Liability limitations — cap liability, disclaim warranties (to extent permitted by law)
- Termination — how either party can end the agreement, what happens to data
- Governing law & dispute resolution — jurisdiction, arbitration vs. courts
- Modification clause — how you'll notify users of ToS changes
4. GDPR Compliance Checklist
Required if you have any EU/UK users (source: Feroot Security, SecurePrivacy):
- Consent mechanism — opt-in before collecting non-essential data
- Records of Processing Activities (ROPA) — document what data, why, how long
- DPA signed with every sub-processor (hosting, analytics, email, payments)
- Right to deletion implemented — user can request and you execute within 30 days
- Right to data portability — export user data in machine-readable format (JSON/CSV)
- Data Subject Access Request (DSAR) process — documented, tested, under 30-day response
- Breach notification process — notify supervisory authority within 72 hours, affected users without undue delay
- Privacy by design — data minimization, pseudonymization where possible
- Lawful basis documented for each processing activity
- International data transfers — use Standard Contractual Clauses (SCCs) if transferring outside EU
5. Cookie Consent
Requirements by region (source: UserCentrics, CookieChimp, SecurePrivacy):
Cookie categories:
- Necessary — session, security, load balancing (no consent needed)
- Analytics — usage tracking, heatmaps (consent required in EU)
- Marketing — ad targeting, retargeting pixels (consent required everywhere)
- Functional — preferences, language settings (consent varies by jurisdiction)
EU/UK (GDPR + ePrivacy Directive):
- Opt-in required BEFORE setting non-essential cookies
- Accept All and Reject All buttons must have equal visual prominence
- Granular control — users must be able to accept/reject by category
- Consent valid for 6 months, then re-prompt
- No cookie walls (blocking content until consent) — regulators penalize this
US (CCPA/CPRA + state laws):
- Opt-out model — can set cookies but must provide "Do Not Sell/Share" link
- As of Jan 2026, opt-out confirmation must be visible (no silent acceptance)
- Honor Global Privacy Control (GPC) browser signals
Implementation: Use a Consent Management Platform (CMP) — Cookiebot, CookieYes, or similar. Never roll your own.
6. Business Entity
When and where to incorporate (source: SaaS Law Firm, general startup practice):
- When: Before accepting payments or signing contracts. An LLC protects personal assets from business liability.
- Where (US founders): Delaware LLC or C-Corp is standard for startups (investor-friendly, well-established case law). File in your home state too if you operate there.
- Where (non-US founders): Incorporate in your home country first. Consider a US entity (Delaware/Wyoming) only when US revenue justifies it.
- Sole proprietor risk: Without an entity, YOUR personal assets are on the line for any lawsuit, data breach, or debt.
- Cost: LLC formation is $100-500 depending on state. Far cheaper than a single lawsuit.
Next Steps
Report to user: "Legal docs created: [list]. Compliance status: [summary]"
Suggested next steps (user decides):
- Launch ready → "Run copy-craft for launch page"
- Payment involved → "Run finance-ops"
- EU users → "Run infra-ops for GDPR tech requirements"