Website Terms & Conditions Review

Over the last year, I have reviewed between ten and twenty-five Terms and Conditions and related website policies for Canadian businesses. Most submissions come from SaaS founders. Across those engagements, one pattern dominates: the document looks polished, but it does not actually match how the business operates.

Here are three composite examples that illustrate the kinds of issues I see most often (details changed for confidentiality):

Example 1: Wrong jurisdiction baked in from the start

The submission: An early-stage Ontario SaaS founder sent over a 12-page Terms of Service generated by ChatGPT.

What I caught: The governing-law clause specified California. The dispute-resolution clause sent disputes to San Francisco arbitration under JAMS rules. The choice-of-law in the privacy section referenced CCPA.

Why it mattered: The founder was an Ontario corporation about to sign their first enterprise customer — also Ontario. If a dispute had arisen, they would either have had to litigate in California (expensive, slow, no real connection to either party) or face a Canadian court refusing to enforce the U.S. forum-selection clause and applying Ontario law anyway. Either outcome wastes money and creates uncertainty in a deal that should have been straightforward.

What we changed: Ontario governing law. Toronto as the venue. Ontario’s Arbitration Act referenced for any arbitration. CCPA references stripped and replaced with PIPEDA disclosures.

Example 2: A limitation of liability that would not have held up

The submission: A Canadian e-commerce client copied limitation-of-liability language from a U.S. SaaS template they admired.

What I caught: The cap was “$100 or fees paid in the prior 12 months, whichever is less.” For a customer paying $20/month, that capped the vendor’s exposure at $100 — including for indemnification claims, gross negligence, and willful misconduct.

Why it mattered: Under the Tercon framework, Canadian courts will not enforce exclusion clauses that are unconscionable or contrary to public policy. A $100 cap on willful misconduct is exactly the kind of provision a court will strike. The client thought they had a strong cap. They actually had no enforceable protection.

What we changed: Tiered cap — fees paid in the prior 12 months for ordinary breach, no cap for indemnity obligations, fraud, or willful misconduct. The new clause is more likely to survive judicial scrutiny and defensible commercially.

Example 3: Defined terms that had nothing to do with the business

The submission: A SaaS founder sent over a Terms of Service generated by an AI tool. It opened with eight pages of defined terms.

What I caught: The defined terms section referenced “Affiliates,” “Authorized Sub-Processors,” “Service Level Agreements,” and “Customer Hardware” — none of which existed in the client’s actual business. The client was a solo founder with no affiliates, no sub-processors beyond AWS, no SLAs, and a pure-software product. Half of the operative clauses then referenced these phantom defined terms.

Why it mattered: A Terms of Service that references defined terms that do not match the business is worse than no Terms of Service at all. It creates ambiguity. Customers can argue the definitions apply (and impose obligations the founder did not intend). Courts struggle to interpret terms that describe a business that does not exist.

What we changed: Stripped every defined term that did not correspond to actual business operations. Rewrote the operative clauses in plain English referencing the real product. Final document was 40% shorter and substantially more enforceable.

The lesson across all three: AI tools produce generic drafts. They do not produce drafts that match your business. A 12-page Terms of Service that does not reference your actual subscription tiers, your actual integrations, or your actual data flows is not protecting you — even if every word is grammatically correct.