By business type

Terms & Conditions Generator for e-commerce

Written for checkout data, payment hand-offs, marketing consent and cross-border selling.

Generate your terms and conditions Read the terms and conditions guide

For a store, the terms are a sale contract. The clauses that get used in anger are the ones about pricing errors, stock availability after payment, and delivery failure - not the intellectual property boilerplate that usually takes up half the document.

An online store collects more categories of personal data than almost any other small business, and it collects them at the highest-stakes moment: checkout. Name, address, phone, email, order contents, payment token, device identifiers and behavioural history all arrive in one flow, feeding a dozen downstream systems.

The marketing layer is where most stores go wrong. Abandoned cart emails, review requests, loyalty programmes and retargeting all reuse data collected to fulfil an order. Each of those is a distinct purpose, and in the UK and EU each needs its own basis - which is usually consent or the narrowly-defined soft opt-in, not the contract basis that covers the order itself.

Selling across borders multiplies everything. Every market adds a consumer law, a cancellation regime and a set of disclosure duties, and shipping internationally means transmitting customer data to carriers and customs authorities in each destination.

What a terms and conditions for an online store has to cover

Contract formation: when your acceptance happens, which is usually dispatch rather than payment
Pricing errors and the right to cancel an order priced incorrectly
Stock availability after payment and the refund route if you cannot fulfil
Delivery timescales, risk transfer, and duties on international orders
Statutory cancellation rights per market, stated separately from your own returns policy

How an online store actually moves personal data

Checkout data

Collected under contract, but the fields you add beyond what fulfilment needs - date of birth, gender, marketing preferences - are on a different footing.

Payment tokens and fraud scoring

The gateway processes card data as its own controller for fraud prevention, which is a hand-off, not a straightforward sub-processing.

Abandoned cart capture

An email address entered but never used to complete an order. Using it is direct marketing, and whether the soft opt-in applies is genuinely debatable because no sale happened.

Retargeting and lookalike audiences

Uploading customer lists to ad platforms for matching or audience building is a disclosure to a third party and, in California, likely sharing.

Reviews and post-purchase requests

Review platforms receive customer name, email and order data, and typically publish part of it.

Cross-border shipping and customs

Address and contents data transmitted to carriers, customs brokers and destination authorities.

Third parties the draft will ask you about

Stripe · PayPal · Klarna · Klaviyo or Mailchimp · Trustpilot or Judge.me · Meta and Google Ads · DPD, Royal Mail or your carrier · Gorgias or Zendesk

The rules that apply

Distance selling and cancellation rules

Fourteen days in the UK and EU, seven in Brazil, none federally in the US - the same store faces different obligations per market.

Marketing consent and the soft opt-in

Post-purchase marketing is permitted only where the address was collected in a sale of similar goods with an opt-out offered at the time and in every message.

Cookie and tracking consent

Retargeting pixels, analytics and personalisation all require consent in the UK and EU before they fire.

Payment card handling

Using a hosted gateway keeps card data off your systems, but the policy has to describe the hand-off accurately rather than implying you store nothing at all.

Consumer information duties

Total price, delivery costs, return costs, complaint routes and trader identity, disclosed before the order is placed.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

The e-commerce document set

Map the checkout field by field
For each field: why it is collected, the basis, where it goes and how long it is kept.
Separate order processing from marketing
Different purposes, different bases, different retention. The consent record for marketing has to be independent.
Scan the storefront for pre-consent tags
Retargeting pixels are the usual finding.
Write the refund policy against every market you ship to
Statutory rights first, then your own terms.
Document the payment hand-off
Which provider, which fields they see, and what you retain.
Set retention for orders and for marketing profiles separately
Tax retention is not a reason to keep a behavioural profile.

Where this usually goes wrong

Abandoned cart emails without a basis

Where no purchase completed, the soft opt-in argument is weak. Consent captured at the point of email entry is the defensible route.

Pre-ticked marketing checkboxes

Invalid consent in the UK and EU, and it taints the whole list rather than just the individual record.

Customer list uploads to ad platforms undisclosed

It is a disclosure to a third party and in several US states a sale or share requiring an opt-out.

Retargeting pixels firing before consent

The most common UK and EU failure on e-commerce sites, and the one a cookie scan finds in seconds.

A returns policy that contradicts statutory rights

Final sale rules that override cancellation rights are unenforceable and, in several markets, independently actionable.

Order data retained forever

Tax records justify a period for the transaction data, not for marketing profiles and behavioural history attached to it.

Frequently asked questions

Do I need a privacy policy for a small online shop?

Yes. Taking an order always involves personal data, which triggers transparency obligations in every major market, and payment providers and marketplaces require a published policy as a condition of service.

Can I email customers after they buy?

In the UK and EU, only under the soft opt-in: your own similar products, to someone who bought from you, with an opt-out offered at collection and in every message. Otherwise you need consent.

Are abandoned cart emails allowed?

They are direct marketing, and where no purchase completed the soft opt-in is difficult to rely on. Capturing explicit consent at the point of email entry is the safer route.

Do I need a cookie banner for an online shop?

If you serve the UK or EU and run analytics, retargeting or personalisation - which nearly every store does - then yes, and it needs to block those tags until consent.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.