What Must the Subscription Terms of Your App or Cloud Platform Include to Protect Your Recurring Revenue?

How subscription terms differ from online store terms and website terms of use

Many startups publish a single page titled terms and conditions and assume it covers everything. But each of these documents governs a different relationship. Website terms of use govern your relationship with every visitor who browses your site even if they buy nothing, and online store terms govern the sale of a product or service in a single purchase, with the delivery, exchange and returns that come with it. Subscription terms for cloud software services govern an ongoing relationship: a customer who pays periodically for the right to use software they do not own, and data they upload to your platform that stays with you for the whole subscription.

• Website terms of use: addressed to the visitor, covering browsing rules, content and the site's intellectual property, with a separate Sighaty guide and template D-01.
• Online store terms: addressed to the buyer, covering the order, payment, delivery and returns, with a separate guide and template D-02.
• Subscription terms: addressed to the subscribing customer, covering plans, renewal, recurring fees, service availability, data, the licence to use and termination, and they are the subject of this guide and template D-06.
• The privacy policy and the data processing agreement: two companion documents, not substitutes. The first addresses the individuals whose data it is, and the second governs your processing of your customers' data on their behalf.

What the subscription terms state: the checklist section by section

Arrange the subscription terms in clear sections the customer can find easily before paying. These ten sections are the minimum to review in any subscription platform selling to businesses, in the order in which a customer usually reads the contract.

1. Plans and scope of service: name each plan and state the features, number of users or usage limits it includes and what it excludes, where the customer finds the current service description, and how upgrades or downgrades between plans are handled.
2. Trial and renewal: state whether there is a trial and its length as your platform sets it, what happens when it ends, whether the subscription renews automatically, and how the customer is notified before renewal and how they cancel.
3. Fees: make clear that the fees are those published on the pricing page or in the order form at the time of subscribing, when they fall due, how they may change in later renewal terms, and how the customer is told of a change before it takes effect.
4. VAT and payment method: state whether the published prices include value added tax or whether it is added on top, which payment methods are accepted, how the tax invoice is issued, and what happens if a payment cannot be collected.
5. Service availability and support: state the availability level you commit to, if any, scheduled maintenance and how it is announced, support channels and hours, and what the customer is entitled to if the published level is not met.
6. Customer data: state that the data the customer uploads remains theirs and that you process it only to provide the service, refer to the attached data processing agreement, and explain how the customer exports their data and what happens to it after the subscription ends.
7. Intellectual property and licence to use: make clear that the software and its updates belong to your platform, that the customer receives a non-exclusive, non-transferable licence to use it for the subscription term, and list prohibited uses such as resale or reverse engineering.
8. Suspension and termination: set out when the account may be suspended, such as non-payment or a breach of the usage policy, the notice that comes before suspension, each party's right to end the subscription, and the effects of termination on fees and data.
9. Limitation of liability: state which damages you exclude and your overall liability cap, taking into account what the law does not allow you to exclude, as set out in a separate section below.
10. Governing law and dispute resolution: state that the laws of the Kingdom of Saudi Arabia govern the contract, name the forum for resolving disputes, whether the competent court or arbitration, and that the Arabic text prevails in case of any difference.

The sensitive subscription clauses: renewal, cancellation, refunds and account suspension

Most disputes on subscription platforms do not start with a technical fault but with a renewal invoice the customer did not expect, an account suspended without notice, or a refund request the terms do not answer. So write these clauses in plain language, put them where the customer sees them before paying, and keep a record proving that they accepted them and the version of the terms they accepted.

• Automatic renewal: disclose it clearly at sign-up, send a reminder before renewal, and make cancellation available from the account dashboard without friction.
• Cancellation: state when cancellation takes effect and whether the customer keeps access to the service until the end of the paid term.
• Refunds: set a clear policy for amounts paid in advance, especially on annual plans, and do not leave it to the support team's discretion.
• Account suspension: separate temporary suspension from termination, state the prior notice and how the account is reactivated, and do not delete the customer's data merely because of a suspension.

This guide does not set any specific notice period or refund window, because these are commercial decisions your platform makes, and they are best reviewed by a licensed lawyer so that they are fair and provable in a dispute.

Your customers' data on the platform: the data processing agreement as the companion to the subscription terms

When a business uploads its employees' or customers' data to your platform, it is usually the controller of that data, and your platform is a processor handling it on its behalf. The Personal Data Protection Law, issued by Royal Decree M/19 and its amendments, requires the controller to choose a processor that provides the guarantees needed to implement the Law and its regulations and to verify the processor's compliance, with the regulations setting the necessary rules, including those on any onward contracts the processor enters into. In practice, this means your customer will ask you for a written document proving these guarantees, and that is the role of the data processing agreement.

The Law also applies to processing personal data relating to individuals resident in the Kingdom even when carried out by an entity outside it, and it regulates the transfer of personal data outside the Kingdom under conditions and controls set by its provisions and regulations. If your servers or hosting providers are outside the Kingdom, this is a matter the agreement must address expressly after the current requirements are reviewed.

• Have the subscription terms refer to the data processing agreement and treat it as part of the contract, rather than repeating its provisions in short form inside the terms.
• Set out in the agreement the purposes of processing, the categories of data, the security measures, incident notification, and deletion or return of the data at the end.
• List your sub-processors, such as hosting, email and payment services, and how the customer is told when they change.
• Do not confuse the processing agreement with the privacy policy: the policy addresses the individuals whose data it is, and the agreement is a contract between you and the business customer.

Template I-04, the Data Processing Agreement, is designed to accompany the subscription terms, and we have a separate guide that explains its clauses in detail for anyone who wants to go deeper into the relationship between controller and processor.

Limitation of liability and governing law

The limitation of liability clause is what protects your startup from a claim many times the value of the subscription. The Civil Transactions Law allows the parties to agree to exempt the debtor from compensation for damage arising from failure to perform, or delay in performing, a contractual obligation, except where it results from the debtor's fraud or gross fault, and it does not allow an agreement exempting liability arising from a harmful act. So draft the clause to carve out these cases expressly, because a clause that tries to exclude everything risks being disregarded to the extent it conflicts with the Law.

As for governing law, make it the laws of the Kingdom of Saudi Arabia, name the dispute forum clearly, and consider whether arbitration or the competent court suits the size of your contracts. If some of your customers are outside the Kingdom, do not change the governing law before reviewing the effect on your local obligations, including your personal data protection obligations.

The final checklist before publishing your subscription terms

Before publishing, remember that the E-Commerce Law defines the consumer as the person who deals in e-commerce wishing to obtain products or services, and defines a person as a natural or legal person. So do not assume that selling to businesses takes you outside its scope, and ask for a legal review of how far its provisions apply to your platform before adopting the terms.

• Each of the ten sections is present and written in language a manager with no legal background can understand.
• Prices are clear, with an express statement of whether they include value added tax, noting that the VAT Law imposes it at a standard rate of 15 percent of the value of the supply unless an exemption or a zero rate applies to that supply.
• The acceptance mechanism is documented: the customer's express consent, its date, and the version of the terms they accepted.
• The data processing agreement is attached to the terms, and the privacy policy is published for anyone visiting your platform.
• The Arabic version prevails, and the English version matches it paragraph by paragraph.

If your platform also sells products, receives visitors before they subscribe, or collects individuals' data, read our guides in the E-commerce and online stores section on online store terms, website terms of use, the PDPL-compliant privacy policy, and the data processing agreement. Each covers a different document that complements the subscription terms and does not replace them.

Frequently asked questions