ThomasMoreAI End-User License Agreement (EULA)
Drafts an enforceable EULA protecting licensor IP, limiting liability, and satisfying consumer protection standards across jurisdictions.
Intake Checklist
Gather before drafting:
- Software — product name, version, deployment model (desktop / mobile / SaaS / cloud / embedded)
- License model — perpetual, subscription, usage-based, freemium, or trial
- User population — B2C, B2B, or mixed; users under 13 (COPPA trigger)
- Geography — US-only, EU, or global (drives GDPR, CCPA applicability)
- Data collected — personal data categories; PHI (HIPAA), financial (GLBA), student (FERPA), payment (PCI-DSS)
- Third-party components — open-source (copyleft vs. permissive) or proprietary
- App store — Apple App Store, Google Play, or direct distribution
- Risk posture — arbitration/class-action waiver? IP indemnification? Benchmark restrictions?
Drafting Workflow
1. Header & Acceptance
- Title: "END-USER LICENSE AGREEMENT" prominently displayed
- Specify triggering act: install / account creation / first use
- Click-wrap required: scrollable full text, accept button active only after scroll opportunity (ProCD v. Zeidenberg; avoid browse-wrap per Specht v. Netscape)
- Mobile: present in app-store listing + first launch; must not contradict platform terms
- Version date + 30-day advance notice for material amendments; affirmative re-acceptance for paid-tier changes reducing rights
2. Definitions
| Term | Scope |
|---|---|
| Software | Product name, version, included modules |
| Updates | Bug fixes / security patches (included) |
| Upgrades | Major versions (may require separate fee) |
| Authorized Users | Named / concurrent / site license scope |
| Documentation | Manuals, API docs, specs |
| Confidential Information | Source code, algorithms, benchmarks, designated materials |
3. License Grant
- Non-exclusive, non-transferable, revocable for breach, [perpetual / subscription-term]
- Specify device count or concurrent user cap
- Permitted use: internal business / personal; per Documentation
- One archival backup copy; proprietary notices intact
- SaaS: frame as access right, not installation right
- Trial: evaluation-only, non-production, time-limited with end date; auto-terminates at expiry
4. Restrictions
| Category | Prohibited Conduct |
|---|---|
| Reverse engineering | Decompile, disassemble, derive source — except as required by law for interoperability (EU Directive 2009/24/EC) |
| Derivative works | Modify, translate, adapt, or create based on Software |
| Distribution | Sublicense, rent, lease, lend, transfer, service-bureau use |
| Circumvention | Bypass license enforcement, DRM, or security features (17 U.S.C. § 1201 [VERIFY]) |
| Notices | Remove/alter copyright, trademark, or proprietary legends |
| Competitive use | Benchmark for competitive analysis; publish results without consent |
| Safety-critical | Aircraft nav, nuclear, life support, weapons |
| Export | Export/re-export violating EAR, ITAR, or OFAC sanctions |
5. IP Ownership
- Licensor retains all rights — copyright, patents, trademarks, trade secrets
- License, not a sale; first-sale doctrine inapplicable
- User data: user owns; licensor gets limited processing license for service delivery
- Aggregated/anonymized data: licensor owns derived insights
- Feedback: user assigns all rights; moral rights waived to extent permitted
- Third-party components: designated as intended third-party beneficiaries; confirm no GPL copyleft contamination
- Trademarks: no right to use licensor marks except to identify Software
6. Payment & Renewals
- State fees in specific currency (not by reference to pricing page)
- Auto-renewal: conspicuous pre-purchase disclosure per Cal. Bus. & Prof. Code § 17600 et seq. [VERIFY]; easy cancellation; advance renewal reminder
- Non-payment: notice + 5–10 day cure → suspension; 10–15 day cure → termination
- Refunds: state terms explicitly; app-store refunds per platform policy
- Taxes: exclusive of taxes; user bears sales/use/VAT; EU VAT reverse charge for B2B
7. Term & Termination
- For cause: immediate upon material breach (IP violation, non-payment, export violation, insolvency)
- Without cause: free licenses — 30 days notice; paid perpetual — generally not permitted
- User termination: cancel per stated procedure; cease use; destroy all copies
- Post-termination: uninstall all devices; destroy copies (including backup/cached); written certification on request; SaaS — 30-day data export window then deletion
- Survival: IP ownership, restrictions, confidentiality (3–5 years / indefinite for trade secrets), disclaimers, liability caps, indemnification, dispute resolution
8. Warranty Disclaimer
MUST BE ALL-CAPS OR BOLD (conspicuousness requirement)
- Limited warranty (if offered): Software substantially conforms to Documentation for [30/60/90] days; excludes modified software, misuse, unauthorized combinations
- Exclusive remedy: patch → replacement → pro-rata refund + termination
- Disclaimer: SOFTWARE PROVIDED "AS IS" AND "AS AVAILABLE." LICENSOR DISCLAIMS ALL WARRANTIES — EXPRESS, IMPLIED, STATUTORY — INCLUDING MERCHANTABILITY, FITNESS FOR PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, QUIET ENJOYMENT, ACCURACY. NO WARRANTY OF UNINTERRUPTED OR ERROR-FREE OPERATION.
- Savings clause for jurisdictions prohibiting full warranty exclusions
- Magnuson-Moss Warranty Act compliance for consumer products [VERIFY applicability]
9. Limitation of Liability
MUST BE ALL-CAPS OR BOLD
- Consequential damages exclusion: NO LIABILITY FOR INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES INCLUDING LOST PROFITS, LOST DATA, BUSINESS INTERRUPTION, REGARDLESS OF CAUSE OR FORESEEABILITY.
- Aggregate cap: fees paid in prior 12 months; free software — $[50–100] or max permitted by law
- Cap is collective across all claims; does not reset per claim
- Carve-outs (narrow): gross negligence / willful misconduct; death/personal injury; fraud; mandatory statutory rights
- Claims must be brought within 1 year of accrual
- Savings clause for jurisdictions limiting damage exclusions
10. Indemnification
Licensor → User (IP, if offered):
- Defend/indemnify for claims that unmodified Software infringes registered patents, copyrights, or trademarks
- Conditions: prompt notice (≤10 days); licensor controls defense; user cooperates
- Exclusions: user modifications; unauthorized combinations; non-current version; out-of-scope use
- Remedies: procure license → modify → replace → pro-rata refund + terminate (exclusive remedy)
User → Licensor:
- Defend/indemnify for: breach of agreement; law/third-party rights violations; user content/data; user negligence/misconduct
- Not subject to aggregate liability cap
11. Governing Law & Disputes
- [State] internal law; exclude conflict-of-law principles and CISG
- Exclusive jurisdiction: [County, State] state and federal courts
- Arbitration (if included): AAA Commercial Rules; [city]; 1 arbitrator (<$100K) / 3 (≥$100K); licensor pays costs for consumer claims
- Class action waiver: individual capacity only [enforceability limited in CA consumer contexts — confirm]
- Carve-out: equitable/injunctive relief for IP or confidentiality violations
- Consumer savings clause: unenforceable forum selection defaults to user's jurisdiction
12. Data Protection
Include provisions for each applicable regime:
| Regime | Trigger | Key Obligations |
|---|---|---|
| GDPR | EU/EEA users | Lawful basis, data subject rights, 72-hr breach notice, SCCs, DPO if required |
| CCPA/CPRA | CA users | Category disclosure, opt-out of sale/sharing, deletion/correction rights |
| COPPA | Users under 13 | Verifiable parental consent before collection |
| HIPAA | PHI for covered entities | BAA required; Privacy & Security Rule compliance |
| GLBA | Financial data | Safeguards Rule compliance |
| FERPA | Student records | Institutional consent; no unauthorized disclosure |
- Disclose: data collected, purpose, retention, third-party sharing, security measures
- No absolute security guarantees; user responsible for credential security
- If software not designed for sensitive data: explicit prohibition + liability disclaimer
13. Export Controls
- Software subject to EAR (15 C.F.R. Parts 730–774 [VERIFY]); ITAR if defense application
- User represents: not in embargoed country (Cuba, Iran, North Korea, Syria, Crimea/Donetsk/Luhansk — verify current OFAC/BIS lists); not on SDN, Denied Persons, or Entity List
- No export/re-export without required licenses
- Violation = material breach → immediate termination; user indemnifies
14. General Provisions
| Provision | Key Points |
|---|---|
| Entire Agreement | Supersedes all prior; no extra-contractual reliance |
| Amendment | Post + 30-day notice; material paid-license changes require re-acceptance |
| Severability | Reform to minimum extent; per-jurisdiction independence |
| Waiver | Written and signed; no implied waiver |
| Assignment | User cannot assign; licensor assigns freely (including M&A) |
| Force Majeure | Acts of God, war, pandemic, infrastructure failure; termination right if >60–90 days |
| No Partnership | Independent contractors; no agency/JV/franchise |
| Third-Party Beneficiaries | None except third-party component licensors (IP) |
| Notices | Email (confirmed) or certified mail; in-software posting for general notices |
| Counterparts | Electronic signatures valid |
Pitfalls & Checks
- Conspicuousness: warranty disclaimers and liability caps MUST be ALL CAPS or bold — never buried in body text
- Click-wrap over browse-wrap: require affirmative acceptance; no pre-checked boxes
- EU consumer contracts: Unfair Contract Terms Directive prohibits significant-imbalance provisions; user's habitual-residence law applies (Rome I) — disclaim only what is permissible
- Class action waiver: may be unenforceable in CA consumer contexts — confirm before including
- Open-source audit: confirm no GPL/AGPL copyleft that would require disclosing proprietary code
- App store overlay: Apple/Google impose payment, refund, and content terms — EULA must complement, not contradict
- Do not include: specific hypothetical damages amounts; representations about unlicensed third-party products; absolute security guarantees