fix(legal): give consumers their statutory right of withdrawal #258

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/terms-withdrawal-right in i main

2026-09-24 22:37:19 +00:00

supernaut kommenterad

2026-09-24 13:45:29 +00:00

Ägare

Closes #254

What changed

Terms, section 9 (both languages). The blanket "no refunds for a pre-paid period" clause is replaced. Consumers now get a 14-day right of withdrawal, counted from the day the contract is concluded. They can withdraw by email, with the model form, or with a withdrawal function on the account page. If they asked for the service to start during the period, they pay a proportional share. The refund goes out within 14 days, by the original payment method. Business customers are excluded. After the withdrawal period, paid periods are still not refunded, except where the law requires it.
Terms, new appendix (both languages). The model withdrawal form, with Bitborg's details filled in. Section 9 links to it.
Privacy Policy (both languages). New "Payments (paid plans)" paragraph under recipients. It names Mollie B.V. (Netherlands), says what data Mollie receives and returns, says Mollie is an independent controller and not a sub-processor, gives the legal basis (contract, Art. 6(1)(b)) and links Mollie's privacy statement.
"Last updated" set to 2026-09-24 on both documents. package.json 1.7.1 → 1.8.0.

There was no renewal-cancellation clause to keep. See follow-ups.

Statutory basis

Lagen (2005:59) om distansavtal och avtal utanför affärslokaler, 2 kap. Checked against the current consolidated text on riksdagen.se (amended up to Lag 2026:246).

Rule	Section
Duty to inform about the right of withdrawal before the contract	2 kap. 2 § första stycket 10
Duty to say whether a proportional payment applies	2 kap. 2 § första stycket 12
Duty to provide the standard withdrawal form	2 kap. 2 a §
14-day right of withdrawal, by clear statement, the form or the withdrawal function; receipt confirmed without delay	2 kap. 10 §
Withdrawal function required in the online interface for the whole period (new, in force 19 June 2026)	2 kap. 10 a §
For a service the period starts the day the contract is concluded. It is extended by up to 12 months if the information was not given	2 kap. 12 §
Consumer stops using a digital service after withdrawal	2 kap. 13 a §
Refund within 14 days of receiving the notice, same payment method, no cost to the consumer	2 kap. 14 §
Consumer content made available on request, free, machine-readable	2 kap. 14 a §
Proportional payment only if the consumer expressly asked for the service to start during the period, and was informed	2 kap. 15 § första stycket 3
Exemption for a fully performed service does not fit a running subscription	2 kap. 11 § 1

Form text follows Directive 2011/83/EU Annex I(B) and Konsumentverket's ångerblankett.

Corrections to the brief: the form duty is 2 a §, not 2 §. The refund rule is 14 §, not 13 §. 13 § is about returning goods. The proportional charge is 15 § första stycket 3, not "14-15 §".

Needs legal review

Judgement calls in this text:

Withdrawal function (10 a §). The Terms mention a withdrawal function on the account page "if you subscribed on our website". It does not exist yet. The paid checkout must not launch without it. Without it the Terms become untrue and the trader breaches 10 a § (10 b § treats that as unfair marketing).
Express request to start. The proportional charge needs an express request at checkout plus prior information (15 § 3). The checkout must capture that request. If a consumer does not ask, the service may not start during the period, or else no charge can be made on withdrawal.
Form "To" line. It gives "Bitborg" and info@bitborg.se only. The model form expects the trader's name and geographic address. They are still unset (the TODO(legal) fields in src/lib/legal-entity.ts), so the trader details block is hidden in production. Fill them in before paid checkout.
Form wording. Pre-filled for a service only: "goods" and "received on" are removed and a username line is added. This is ordinary "delete as appropriate" use, but it departs from the model text.
"The paid plan then ends". What the account falls back to after withdrawal (for example a participant account) is not stated. Confirm what should happen.
Kept clause. No refund after termination for breach is kept, qualified by "except where the law requires it". Check it against lagen (1994:1512) om avtalsvillkor i konsumentförhållanden.
Mollie's role. It is described as an independent controller, which is how Mollie's own privacy statement describes itself. Mollie's statement also says it is only a processor for its Invoicing product. If that product is used, Mollie must also be added to the sub-processor list.
Data sent to Mollie. The policy lists name, email address, an internal customer reference, and plan and amount. Card brand, last four digits and expiry come back. Confirm this matches the integration at launch.
Transfers. Mollie's privacy statement allows processing outside the EEA under standard contractual clauses. The policy's opening promise and its "International transfers" section say account data stays in the EU/EEA and is not shared with companies under foreign extraterritorial law. Decide whether Mollie belongs under "Known exceptions" on the security page, and whether those sentences need a qualification.

Follow-ups (not changed here)

Other clauses that may not hold against consumers:

Section 7 "as is, without warranty". Konsumentköplagen (2022:260) gives mandatory remedies for a digital service that does not conform. The disclaimer is void against consumers as written.
Section 8 liability, including for loss of data. It may be unfair or void against consumers where we are at fault (konsumentköplagen, avtalsvillkorslagen). Section 6, "we do not guarantee against data loss", has the same problem.
Section 12 "We may update these terms". A one-sided change right for a running consumer subscription needs a valid reason, reasonable notice, and a right to terminate without cost.
Section 10. Deleting accounts inactive for 12 months "without prior notice" should exclude paid accounts, or at least give notice.
Missing pre-contract information (2 kap. 2 §): telephone number (p. 1), contract duration and how to cancel an auto-renewing subscription (p. 16 and 18), and out-of-court dispute resolution through Allmänna reklamationsnämnden, ARN (p. 21).
Section 11. EU consumers outside Sweden may also sue in their home country (Brussels I bis, Art. 18). The existing "mandatory consumer rights are unaffected" line covers this only loosely.
Section 1, minimum age 13. Paid subscriptions by minors need a rule (föräldrabalken 9 kap.).
Privacy Policy. "What we process" and "Retention" do not yet cover billing data or the statutory retention period for accounting records.

Checks

pnpm check, pnpm lint, pnpm test (374 passed), pnpm build, pnpm lang-check and markdownlint are all clean. The heading anchors #appendix-model-withdrawal-form and #bilaga-ångerblankett resolve in the build.

Do not merge until the operator has reviewed the legal text.

Closes #254 ## What changed - **Terms, section 9** (both languages). The blanket "no refunds for a pre-paid period" clause is replaced. Consumers now get a 14-day right of withdrawal, counted from the day the contract is concluded. They can withdraw by email, with the model form, or with a withdrawal function on the account page. If they asked for the service to start during the period, they pay a proportional share. The refund goes out within 14 days, by the original payment method. Business customers are excluded. After the withdrawal period, paid periods are still not refunded, except where the law requires it. - **Terms, new appendix** (both languages). The model withdrawal form, with Bitborg's details filled in. Section 9 links to it. - **Privacy Policy** (both languages). New "Payments (paid plans)" paragraph under recipients. It names Mollie B.V. (Netherlands), says what data Mollie receives and returns, says Mollie is an independent controller and not a sub-processor, gives the legal basis (contract, Art. 6(1)(b)) and links Mollie's privacy statement. - "Last updated" set to 2026-09-24 on both documents. `package.json` 1.7.1 → 1.8.0. There was no renewal-cancellation clause to keep. See follow-ups. ## Statutory basis Lagen (2005:59) om distansavtal och avtal utanför affärslokaler, 2 kap. Checked against the current consolidated text on riksdagen.se (amended up to Lag 2026:246). | Rule | Section | | --- | --- | | Duty to inform about the right of withdrawal before the contract | 2 kap. 2 § första stycket 10 | | Duty to say whether a proportional payment applies | 2 kap. 2 § första stycket 12 | | Duty to provide the standard withdrawal form | 2 kap. 2 a § | | 14-day right of withdrawal, by clear statement, the form or the withdrawal function; receipt confirmed without delay | 2 kap. 10 § | | **Withdrawal function** required in the online interface for the whole period (new, in force 19 June 2026) | 2 kap. 10 a § | | For a service the period starts the day the contract is concluded. It is extended by up to 12 months if the information was not given | 2 kap. 12 § | | Consumer stops using a digital service after withdrawal | 2 kap. 13 a § | | Refund within 14 days of receiving the notice, same payment method, no cost to the consumer | 2 kap. 14 § | | Consumer content made available on request, free, machine-readable | 2 kap. 14 a § | | Proportional payment only if the consumer expressly asked for the service to start during the period, and was informed | 2 kap. 15 § första stycket 3 | | Exemption for a fully performed service does not fit a running subscription | 2 kap. 11 § 1 | Form text follows Directive 2011/83/EU Annex I(B) and Konsumentverket's ångerblankett. Corrections to the brief: the form duty is **2 a §**, not 2 §. The refund rule is **14 §**, not 13 §. 13 § is about returning goods. The proportional charge is **15 § första stycket 3**, not "14-15 §". ## Needs legal review Judgement calls in this text: 1. **Withdrawal function (10 a §).** The Terms mention a withdrawal function on the account page "if you subscribed on our website". It does not exist yet. The paid checkout must not launch without it. Without it the Terms become untrue and the trader breaches 10 a § (10 b § treats that as unfair marketing). 2. **Express request to start.** The proportional charge needs an express request at checkout plus prior information (15 § 3). The checkout must capture that request. If a consumer does not ask, the service may not start during the period, or else no charge can be made on withdrawal. 3. **Form "To" line.** It gives "Bitborg" and info@bitborg.se only. The model form expects the trader's name and geographic address. They are still unset (the `TODO(legal)` fields in `src/lib/legal-entity.ts`), so the trader details block is hidden in production. Fill them in before paid checkout. 4. **Form wording.** Pre-filled for a service only: "goods" and "received on" are removed and a username line is added. This is ordinary "delete as appropriate" use, but it departs from the model text. 5. **"The paid plan then ends".** What the account falls back to after withdrawal (for example a participant account) is not stated. Confirm what should happen. 6. **Kept clause.** No refund after termination for breach is kept, qualified by "except where the law requires it". Check it against lagen (1994:1512) om avtalsvillkor i konsumentförhållanden. 7. **Mollie's role.** It is described as an independent controller, which is how Mollie's own privacy statement describes itself. Mollie's statement also says it is only a processor for its Invoicing product. If that product is used, Mollie must also be added to the sub-processor list. 8. **Data sent to Mollie.** The policy lists name, email address, an internal customer reference, and plan and amount. Card brand, last four digits and expiry come back. Confirm this matches the integration at launch. 9. **Transfers.** Mollie's privacy statement allows processing outside the EEA under standard contractual clauses. The policy's opening promise and its "International transfers" section say account data stays in the EU/EEA and is not shared with companies under foreign extraterritorial law. Decide whether Mollie belongs under "Known exceptions" on the security page, and whether those sentences need a qualification. ## Follow-ups (not changed here) Other clauses that may not hold against consumers: - **Section 7 "as is, without warranty".** Konsumentköplagen (2022:260) gives mandatory remedies for a digital service that does not conform. The disclaimer is void against consumers as written. - **Section 8 liability, including for loss of data.** It may be unfair or void against consumers where we are at fault (konsumentköplagen, avtalsvillkorslagen). Section 6, "we do not guarantee against data loss", has the same problem. - **Section 12 "We may update these terms".** A one-sided change right for a running consumer subscription needs a valid reason, reasonable notice, and a right to terminate without cost. - **Section 10.** Deleting accounts inactive for 12 months "without prior notice" should exclude paid accounts, or at least give notice. - **Missing pre-contract information (2 kap. 2 §):** telephone number (p. 1), contract duration and how to cancel an auto-renewing subscription (p. 16 and 18), and out-of-court dispute resolution through Allmänna reklamationsnämnden, ARN (p. 21). - **Section 11.** EU consumers outside Sweden may also sue in their home country (Brussels I bis, Art. 18). The existing "mandatory consumer rights are unaffected" line covers this only loosely. - **Section 1, minimum age 13.** Paid subscriptions by minors need a rule (föräldrabalken 9 kap.). - **Privacy Policy.** "What we process" and "Retention" do not yet cover billing data or the statutory retention period for accounting records. ## Checks `pnpm check`, `pnpm lint`, `pnpm test` (374 passed), `pnpm build`, `pnpm lang-check` and markdownlint are all clean. The heading anchors `#appendix-model-withdrawal-form` and `#bilaga-ångerblankett` resolve in the build. Do not merge until the operator has reviewed the legal text.

supernaut lade till 1 incheckning

2026-09-24 13:45:29 +00:00

fix(legal): give consumers their statutory right of withdrawal

ci / ci (pull_request) Successful in 1m25s

Detaljer

65c028c098

Replace the blanket no-refund clause with the 14-day right of withdrawal
under lagen (2005:59) om distansavtal och avtal utanför affärslokaler,
add the model withdrawal form to the Terms, and name Mollie as payment
provider in the Privacy Policy.

supernaut sammanfogade incheckning 466fd210f5 till main

2026-09-24 22:37:19 +00:00

supernaut tog bort grenen fix/terms-withdrawal-right

2026-09-24 22:37:19 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-09-24 22:37:20 +00:00

fix(legal): give consumers their statutory right of withdrawal (#258)

supernaut refererade till denna ändringsförfrågan

2026-09-29 17:18:05 +00:00

legal: consumer-law review of the Terms and Privacy Policy before paid checkout #266

supernaut refererade denna ändringsförfrågan från en incheckning

2026-10-02 17:56:59 +00:00