Terms of Service & Privacy Policy for Websites/Apps

What are Terms of Service & a Privacy Policy?

Terms of Service (ToS) is the legally binding agreement between the operator of a website, app or platform and its users, setting the rules of use, user obligations, liability limits, disclaimers, and the operator's rights to suspend, terminate or modify the service. The Privacy Policy discloses what personal data the platform collects, how it is used, stored, shared and deleted, and the rights users have over their own data.

In India, these documents draw their force from the Indian Contract Act, 1872 (for the terms' enforceability as a clickwrap agreement), the Information Technology Act, 2000 and, critically, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 which impose duties on intermediaries such as platforms, apps and social media services. Most importantly, privacy obligations are now governed by the Digital Personal Data Protection Act, 2023 (DPDPA), which will reshape how consent, purpose limitation and user rights work in India. Keeping ToS and privacy documents aligned with this fast-moving framework is essential for compliance and for avoiding regulator actions and consumer claims.

Key Clauses & What's Included

• Acceptance of Terms — a clearly worded clause establishing that using the site or app constitutes acceptance of the terms, enforceable as a clickwrap or browsewrap agreement.
• User Obligations and Acceptable Use — age and eligibility requirements, permitted and prohibited uses, and the consequences of misuse, aligned with the IT Rules.
• Accounts, Registration and Passwords — the rules for creating accounts, safeguarding credentials, and the operator's right to suspend accounts for breach.
• Orders, Payments and Refunds (for e-commerce) — product or service descriptions, pricing, cancellation and refund policies, and the handling of failed or fraudulent payments, compliant with consumer-protection and e-commerce norms.
• Intellectual Property and User-Generated Content — the licence users grant the platform for content they post, and the operator's right to remove infringing or unlawful content under the IT Rules' due-diligence requirements.
• Disclaimer and Limitation of Liability — exclusion of warranties for third-party content, service-level disclaimers and a negotiated cap on the operator's liability, subject to mandatory law and consumer protections.
• Modification, Suspension and Termination — the operator's right to change the terms or suspend the service, with notice periods that do not otherwise breach rights.
• Governing Law and Jurisdiction — Indian courts and applicable law, and the process for resolving disputes including consumer disputes where relevant.
• Privacy Policy Elements — what data the platform collects, the lawful basis for processing (consent or a legitimate interest recognised under the DPDPA), the purpose, storage, sharing with third parties, retention and deletion, cookies and analytics, grievance redressal and users' data rights.
• Grievance Officer and Contact Details — the contact details and redressal channels required by the IT Rules for significant intermediaries.

Who Needs This & When to Use

Virtually every website and app in India that collects any user data should have both documents. This includes e-commerce stores, SAAS platforms, mobile apps, content and community platforms, lead-generation sites, and businesses selling to consumers online. Even a simple site with a contact form or analytics collects personal data, so a basic privacy policy is prudent from day one.

Both documents should be reviewed whenever the platform materially changes — a new feature, a new third-party integration, new marketing channels or entering a new geography. They are also the first documents checked in commercial due diligence when a company is acquired, and non-compliance with data-protection law can expose a business to regulatory penalties under the DPDPA.

How We Draft It & Process

We begin by mapping your platform: what it does, what data it collects, where the data flows, what third-party tools you use (analytics, payments, CRMs), and your business model. This mapping is essential because a privacy policy that does not match reality is both misleading and risky.

Our lawyers then draft the ToS and Privacy Policy together, with a fixed-fee quote up front, ensuring the two documents are consistent and compliant with the IT Act, the IT Rules 2021 and the DPDPA framework. We explain the key disclosures and consent points in plain English, and deliver editable documents with a short checklist for integrating them into your site or app and for keeping them current.

FAQ

Q1. Do I really need a Privacy Policy if I use Google Analytics?
Yes. Even basic analytics or a contact form means you process personal data (such as IP addresses and contact details). Under Indian law and the notice-and-consent framework, users must be told what is collected and why. A compliant privacy policy is a small cost compared with the regulatory and reputational risk of processing data without proper disclosure.

Q2. Can I copy terms and a privacy policy from a competitor or a free template?
You can, but it is risky. Terms copied from an unrelated business will not reflect your features, business model or legal structure, and under the DPDPA your consent notice must be specific to your actual processing. A template that does not match your platform is at best ineffective and at worst creates a misleading disclosure that exposes you to liability. Custom drafting is safer and usually no more expensive.

Q3. What is a grievance officer and do I need one?
Under the IT Rules 2021, intermediaries — including many apps and platforms — must appoint a Grievance Officer and publish their details so users can raise complaints about content or services. The requirements depend on the type of intermediary and user volume, so we help you determine which obligations apply and set up the required details in your documents.