Case study · Contract Drafting · United States
SaaS Legal Compliance Audit: Identifying Critical Gaps in Privacy, AI Data Processing and Contractual Documentation
A SaaS provider's legal documents didn't accurately reflect its AI data processing, billing practices, cookies and international operations. We identified inconsistencies across six legal documents and recommended corrective changes.
At a glance
The situation
A SaaS technology provider offering a digital parenting-schedule platform required a review of its legal documentation to assess whether its contractual terms and privacy disclosures accurately reflected the product's actual operations.
The review covered its Terms of Service, Privacy Policy, Subscription and Customer Agreement, Data Processing Agreement, Acceptable Use Policy and Cookie Policy.
The product incorporated AI functionality, subscription billing and international availability, making consistency between the legal documents and the actual product architecture particularly important.
The issue
The review identified several material inconsistencies:
1. Undisclosed AI data processing: The product transmitted personal data to Anthropic for AI functionality, although multiple legal documents suggested otherwise.
2. Additional AI functionality: An in-app help chat also used Anthropic but wasn't adequately addressed in the documentation.
3. Billing inconsistencies: The subscription agreement did not accurately reflect the product's actual billing model and website representations.
4. Missing contractual acceptance: The product lacked an adequate acceptance mechanism, including checkbox acceptance, age attestation, document versioning and links to applicable policies.
5. Cookie disclosure: The Cookie Policy claimed that no cookies were used, despite the presence of a beta-gate cookie.
6. International compliance: The product contemplated Canadian provincial jurisdictions and worldwide distribution through Lemon Squeezy, while the legal documents were drafted primarily around US requirements.
7. Subprocessor disclosures: The subprocessor disclosures were inconsistent and omitted relevant service providers, including Vercel and Upstash, with GitHub also requiring consideration.
What we did
We conducted a cross-document and product-functionality consistency review.
Our work included:
- Compared the six legal documents to identify contradictory statements and disclosure gaps.
- Examined the AI processing arrangements and identified the need to disclose Anthropic's role in the relevant processing activities.
- Identified the additional AI-powered support functionality that required appropriate disclosure.
- Reviewed subscription and billing provisions against the actual commercial model.
- Identified missing contractual acceptance and record-keeping mechanisms.
- Examined cookie disclosures against the product's actual cookie behaviour.
- Evaluated the international scope of the product and identified jurisdictional gaps.
- Identified inconsistencies in the subprocessor disclosures and recommended a coordinated approach across the documentation.
The result
The review produced a consolidated set of material legal and operational gaps requiring attention before the documentation could accurately represent the product.
It established a clearer basis for aligning the contractual framework, privacy disclosures, AI processing arrangements, billing provisions and product acceptance mechanisms.
The lesson
SaaS legal compliance isn't achieved simply by having a Privacy Policy, Terms of Service and DPA. These documents must reflect what the software actually does, including its AI integrations, third-party services, billing architecture and international operations.
Related services
Have a similar question? Tell us about it and we will reply with the scope and a fixed fee.
Talk to a lawyerDetails are anonymised or shared with the client's permission. Every matter turns on its own facts, so a past result does not predict a future one. This page is general information, not legal advice.