Free SaaS Subscription Agreement Generator

A SaaS Subscription Agreement governs a paid customer’s ongoing use of a software-as-a-service product. It differs from Terms of Service in three ways: it addresses subscription mechanics (term, renewal, pricing, usage), it includes a Service Level Agreement with uptime commitments, and it handles the data-processing relationship explicitly (typically by incorporating a DPA). Enterprise SaaS uses an MSA + Order Form structure; SMB SaaS often uses a single combined agreement accepted at checkout.

On July 8, 2025, the Eighth Circuit vacated the FTC’s Negative Option Rule in Custom Communications, Inc. v. FTC, No. 24-3137, on procedural grounds. The rule did not take effect on its scheduled July 14, 2025 date. On January 30, 2026, the FTC submitted a draft ANPRM to OIRA to restart the rulemaking process. Meanwhile, ROSCA, the 1973 Negative Option Rule, and the FTC’s Section 5 authority remain fully in force, and states have filled the gap with their own laws.

Five categories of new obligation: scope expanded to cover free-to-pay conversions; express affirmative consent to the renewal specifically with 3-year retention; annual reminders regardless of term length; cancellation in the same medium as sign-up (with specific phone requirements); a click-to-cancel button adjacent to any save offer.

Clear-and-conspicuous disclosure of material terms before consent or billing; cancellation through every medium by which consent can be given. Novel: for price increases, affirmative consent in advance OR cancel-within-14-days with pro-rata refund. For free trials longer than one month, notice 3 to 21 days before first charge.

Effective September 2, 2025, the strictest state regulation for monthly subscriptions. For renewal terms longer than one month: reminder notice 5-30 days before the cancellation deadline. For monthly terms (31 days or less): either the same reminder OR a receipt after every renewal.

99.5% (3.6 hr downtime/month) for SMB or non-critical; 99.9% (43 min/month) for mid-market standard; 99.95% (22 min/month) for enterprise; 99.99% (4 min/month) for mission-critical with negotiated terms. Over-committing to 99.99% without the infrastructure is the most common drafting mistake.

If EU/UK/Swiss personal data is processed, GDPR Article 28(3) requires it with no de minimis exception. Market-standard structure: keep the DPA as a separate document incorporated by reference. Most US state privacy laws also require a service-provider contract. Build a GDPR-compliant DPA with the DPA Generator.

Three common structures: 12 months’ fees (market standard), 2x 12 months’ fees (customer-favorable), or tiered (2x for data/confidentiality, 1x for other). Uncapped carveouts: indemnification, gross negligence, wilful misconduct/fraud, amounts owed, and often breach of confidentiality. Consequential damages excluded with carveouts preserving the uncapped tier.