Website terms of use: what you must publish before your first visitor arrives

Website terms of use versus online store terms and conditions

The two documents are often confused, and telling them apart is your first decision. The website terms of use D-01 are written for the informational or corporate website that does not sell directly: a company site presenting its services, a blog, a content site. A store that sells needs the online store terms and conditions D-02 instead, the contract that governs the store's relationship with every customer: how the sale happens, payment methods, the return and exchange policy, and the limits of the store's liability.

The practical rule: if your site starts selling anything, switch to D-02, which adds the contracting, pricing, and withdrawal mechanics. The full checklist of a store's obligations, from identity disclosure to VAT-inclusive pricing and the right of return, is covered by the online store compliance guide among the related guides below.

• An informational or corporate site or a blog with no direct selling: website terms of use D-01.
• A store or platform selling products or services: online store terms and conditions D-02.
• Both in one business? Each front gets the document that matches what it actually does.

The essential clauses: liability limits, intellectual property, and accounts

The terms open with the operator identity: the domain, legal name, commercial registration number, national address, email, and phone, a block that is a statutory disclosure for commercial sites and must not be left incomplete. Using the site counts as accepting the terms; whoever does not accept them should not use the site. The permitted use clause then sets the prohibitions: breaching security or attempting unauthorized access, scraping or mass-copying content, uploading unlawful or infringing material, impersonating others, and using the site to send unsolicited communications.

• Accounts: where accounts exist, the user provides accurate information, keeps credentials confidential, is responsible for activity under the account, and must report any unauthorized use immediately.
• Content and IP: the site and its content, texts, designs, logos, and software, are owned by or licensed to the operator and protected by IP laws; no use beyond personal viewing is allowed without written permission, and trademarks remain their owners' property.
• Information, not advice: the content is general information provided as is, without warranty of completeness or fitness; it is not professional advice, and third-party links are outside the operator's control and their content is not attributed to it.
• Liability: to the extent the law permits, the operator is not liable for indirect losses arising from use or unavailability of the site; nothing excludes liability for fraud or gross fault, and aggregate liability is capped at a riyal amount you set for free use of the site.
• Changes, law, and forum: the terms may be amended with notice on the site, continued use counting as acceptance; Saudi law governs, the competent courts of the Kingdom have jurisdiction, the Arabic text prevails, and a visible last-updated date is kept.

The smart-fill in template D-01 asks for the operator identity in Arabic and English, the site domain, the commercial registration, the national address and contact channels, the liability cap in riyals, and the last-updated date. The clauses on intellectual property, acceptable use, and third-party links are fixed prose in the template and need no input; review them against the actual site features before publishing.

When you need a privacy policy and a cookie notice alongside the terms

The terms of use handle personal data only by reference: the template states that personal data is processed per the privacy policy D-03 and cookies per the cookie notice D-04, both forming part of the terms. So if your site collects any personal data, through a contact form, account registration, or analytics and tracking tools, you need both documents alongside the terms, not instead of them.

The framework here is the Personal Data Protection Law, issued by Royal Decree No. M/19 as amended, which governs the collection, processing, and storage of individuals' data in the Kingdom, supervised by SDAIA, the Saudi Data and Artificial Intelligence Authority. A compliant privacy policy must state what data is collected, the purposes of processing, who it is shared with, and the data subject's rights, and the privacy policy guide among the related guides below details it element by element.

Common mistakes before publishing

• Copying terms from another site or a different legal environment, importing obligations you did not intend or pointing to another country's law.
• Leaving the operator identity block incomplete, a statutory disclosure for commercial sites that must be complete.
• Keeping informational terms of use after the site has started selling, instead of moving to the D-02 store terms.
• Publishing terms that describe features the site does not offer or miss features it does, instead of reviewing the clauses against the actual site before publishing.
• Amending the terms without notice on the site and without updating the last-updated date, making it hard to prove which version applied.

Frequently asked questions