legal: consumer-law review of the Terms and Privacy Policy before paid checkout

supernaut kommenterad

2026-09-29 17:18:05 +00:00

Ägare

#258 gave consumers the statutory right of withdrawal and named Mollie in the Privacy Policy. Its PR listed judgement calls and other clauses that may not hold against consumers. This issue tracks what is still open. The Terms have not changed since #258.

Already tracked elsewhere, so not repeated here:

The withdrawal function on the account page (2 kap. 10 a §) and the express request to start during the withdrawal period (2 kap. 15 § 3): #259.
The trader's registered name and geographic address, which the model form's "To" line also needs: the trader identification task on bitborg/bitborg-docs#106.

Decisions needed

Mollie and international transfers. Mollie's privacy statement allows processing outside the EEA under standard contractual clauses. The Privacy Policy's opening promise and its "International transfers" section say account data stays in the EU/EEA. Decide whether Mollie belongs under "Known exceptions" on the security page, and qualify those sentences if so.
Mollie's role. The policy calls Mollie an independent controller, as Mollie's own statement does. Mollie is a processor for its Invoicing product. If that product is used, add Mollie to the sub-processor list.
Data sent to Mollie. The policy lists name, email address, an internal customer reference, and plan and amount, with card brand, last four digits and expiry returned. Confirm this against the integration before launch.
After withdrawal. "The paid plan then ends" does not say what the account falls back to (for example a participant account). Decide and state it.
Model form wording. The form is pre-filled for a service: "goods" and "received on" are removed and a username line is added. Confirm this departure from the model text is acceptable.

Clauses to fix

Section 7, "as is", without warranty (terms.md:66). Konsumentköplagen (2022:260) gives mandatory remedies for a digital service that does not conform. The disclaimer is void against consumers as written.
Section 8 liability, including loss of data, and section 6 "we do not guarantee against data loss". May be unfair or void against consumers where we are at fault (konsumentköplagen, lagen (1994:1512) om avtalsvillkor i konsumentförhållanden).
Section 9, no refund after termination for breach. Kept in #258 with "except where the law requires it". Check it against lagen (1994:1512).
Section 10. Deleting accounts inactive for 12 months "without prior notice" should exclude paid accounts, or at least give notice.
Section 11. EU consumers outside Sweden may also sue in their home country (Brussels I bis, Art. 18). The "mandatory consumer rights are unaffected" line covers this only loosely.
Section 12, "We may update these terms". A one-sided change right for a running consumer subscription needs a valid reason, reasonable notice, and a right to terminate at no cost.
Section 1, minimum age 13. Paid subscriptions by minors need a rule (föräldrabalken 9 kap.).
Missing pre-contract information (lagen (2005:59) 2 kap. 2 §): telephone number (p. 1), contract duration and how to cancel an auto-renewing subscription (p. 16 and 18), and out-of-court dispute resolution through Allmänna reklamationsnämnden, ARN (p. 21).
Privacy Policy. "What we process" and "Retention" do not cover billing data or the statutory retention period for accounting records.

Done when

Each decision above is recorded in this issue.
The Terms and Privacy Policy are updated in both languages, with "Last updated" set and package.json bumped.
This lands before paid checkout goes live.

#258 gave consumers the statutory right of withdrawal and named Mollie in the Privacy Policy. Its PR listed judgement calls and other clauses that may not hold against consumers. This issue tracks what is still open. The Terms have not changed since #258. Already tracked elsewhere, so not repeated here: - The withdrawal function on the account page (2 kap. 10 a §) and the express request to start during the withdrawal period (2 kap. 15 § 3): #259. - The trader's registered name and geographic address, which the model form's "To" line also needs: the trader identification task on bitborg/bitborg-docs#106. ## Decisions needed 1. **Mollie and international transfers.** Mollie's privacy statement allows processing outside the EEA under standard contractual clauses. The Privacy Policy's opening promise and its "International transfers" section say account data stays in the EU/EEA. Decide whether Mollie belongs under "Known exceptions" on the security page, and qualify those sentences if so. 2. **Mollie's role.** The policy calls Mollie an independent controller, as Mollie's own statement does. Mollie is a processor for its Invoicing product. If that product is used, add Mollie to the sub-processor list. 3. **Data sent to Mollie.** The policy lists name, email address, an internal customer reference, and plan and amount, with card brand, last four digits and expiry returned. Confirm this against the integration before launch. 4. **After withdrawal.** "The paid plan then ends" does not say what the account falls back to (for example a participant account). Decide and state it. 5. **Model form wording.** The form is pre-filled for a service: "goods" and "received on" are removed and a username line is added. Confirm this departure from the model text is acceptable. ## Clauses to fix - **Section 7, "as is", without warranty** (`terms.md:66`). Konsumentköplagen (2022:260) gives mandatory remedies for a digital service that does not conform. The disclaimer is void against consumers as written. - **Section 8 liability, including loss of data, and section 6 "we do not guarantee against data loss".** May be unfair or void against consumers where we are at fault (konsumentköplagen, lagen (1994:1512) om avtalsvillkor i konsumentförhållanden). - **Section 9, no refund after termination for breach.** Kept in #258 with "except where the law requires it". Check it against lagen (1994:1512). - **Section 10.** Deleting accounts inactive for 12 months "without prior notice" should exclude paid accounts, or at least give notice. - **Section 11.** EU consumers outside Sweden may also sue in their home country (Brussels I bis, Art. 18). The "mandatory consumer rights are unaffected" line covers this only loosely. - **Section 12, "We may update these terms".** A one-sided change right for a running consumer subscription needs a valid reason, reasonable notice, and a right to terminate at no cost. - **Section 1, minimum age 13.** Paid subscriptions by minors need a rule (föräldrabalken 9 kap.). - **Missing pre-contract information (lagen (2005:59) 2 kap. 2 §):** telephone number (p. 1), contract duration and how to cancel an auto-renewing subscription (p. 16 and 18), and out-of-court dispute resolution through Allmänna reklamationsnämnden, ARN (p. 21). - **Privacy Policy.** "What we process" and "Retention" do not cover billing data or the statutory retention period for accounting records. ## Done when - Each decision above is recorded in this issue. - The Terms and Privacy Policy are updated in both languages, with "Last updated" set and `package.json` bumped. - This lands before paid checkout goes live.

supernaut lade till etiketterna

2026-09-29 17:19:54 +00:00

supernaut lade till detta till projektet Bitborg Web

2026-09-29 17:19:55 +00:00

supernaut refererade till detta ärende från bitborg/bitborg-docs

2026-09-29 17:20:48 +00:00

Paid launch readiness: legal and operator prerequisites for the first sale #106

supernaut refererade till detta ärende

2026-09-29 19:39:59 +00:00

legal: publish an Acceptable Use Policy, required by the payment provider's merchant review #267

supernaut kommenterad

2026-09-30 09:27:39 +00:00

Upphovsperson

Ägare

Decisions recorded 2026-09-30:

Mollie and international transfers. Mollie B.V. is established in the Netherlands, but its privacy statement reserves the right to process personal data outside the EEA under standard contractual clauses, and card scheme processing (Visa, Mastercard) is not confined to the EEA in any case. Decision: keep the EU/EEA promise for account and repository data, add Mollie under "Known exceptions" on the security page, and qualify the Privacy Policy's opening promise and "International transfers" section so they cover payment data honestly.
Mollie's role. Invoices are generated by Bitborg, not by Mollie Invoicing. Mollie stays an independent controller. No change.
Data sent to Mollie. Noted. Confirm against the integration when the payment runtime lands.
After withdrawal. The account falls back to a participant account. Repositories stay, the quota reverts to the participant quota. State it in the Terms.
Model form wording. Accepted as adapted for a service.

Age rule for the clause list: 13 for free accounts, 18 for paid plans.

Open input still needed from the operator for the pre-contract information clause: a telephone number. Leave that line out until one exists, and note it here.

Decisions recorded 2026-09-30: 1. **Mollie and international transfers.** Mollie B.V. is established in the Netherlands, but its privacy statement reserves the right to process personal data outside the EEA under standard contractual clauses, and card scheme processing (Visa, Mastercard) is not confined to the EEA in any case. Decision: keep the EU/EEA promise for account and repository data, add Mollie under "Known exceptions" on the security page, and qualify the Privacy Policy's opening promise and "International transfers" section so they cover payment data honestly. 2. **Mollie's role.** Invoices are generated by Bitborg, not by Mollie Invoicing. Mollie stays an independent controller. No change. 3. **Data sent to Mollie.** Noted. Confirm against the integration when the payment runtime lands. 4. **After withdrawal.** The account falls back to a participant account. Repositories stay, the quota reverts to the participant quota. State it in the Terms. 5. **Model form wording.** Accepted as adapted for a service. Age rule for the clause list: 13 for free accounts, 18 for paid plans. Open input still needed from the operator for the pre-contract information clause: a telephone number. Leave that line out until one exists, and note it here.

supernaut refererade till detta ärende från en incheckning

2026-09-30 09:36:18 +00:00

fix(legal): align the terms and privacy policy with consumer law

supernaut refererade till detta ärende

2026-09-30 09:36:42 +00:00

feat(legal): expand section 4 into an acceptable use policy #269

supernaut hänvisade till detta ärende från en ändringsförfrågan som kommer att stänga det

2026-09-30 09:43:50 +00:00

fix(legal): align the terms and privacy policy with consumer law #270

supernaut hänvisade till detta ärende från en ändringsförfrågan som kommer att stänga det

2026-09-30 09:48:03 +00:00

fix(legal): align the terms and privacy policy with consumer law #271