By platform

Terms & Conditions Generator for WooCommerce

Written for Woo order data, gateway plugins, extension sprawl and self-hosted retention.

Generate your terms and conditions Read the terms and conditions guide

Woo shows a terms acceptance checkbox at checkout, which is the mechanism that turns your terms into an actual contract. That makes clause quality matter more than on a site where the terms are only linked in a footer.

WooCommerce inherits every WordPress consideration and adds a full commerce stack on top. Orders, customer accounts, addresses, tax records and payment tokens live in your own database rather than a platform’s - which means retention, encryption, backup handling and breach exposure are genuinely yours.

The extension model multiplies recipients quickly. Subscriptions, bookings, memberships, shipping calculators, tax services, review platforms and marketing integrations each add their own processing, and several transmit order data to their own cloud services.

Woo does provide account-erasure tooling and personal data export hooks that integrate with the WordPress privacy tools, plus settings controlling how long it keeps inactive accounts and order data. Those settings default to keeping everything indefinitely.

What a terms and conditions for a WooCommerce store has to cover

Contract formation at the checkout checkbox, and what the customer is agreeing to
Pricing, taxes and duties, particularly for cross-border sales
Delivery, risk transfer and out-of-stock handling
Subscription terms where WooCommerce Subscriptions is in use
Liability and warranty within consumer-law limits for your markets

How a WooCommerce store actually moves personal data

Order and customer records in your database

Billing and shipping addresses, phone, email, order history and notes, held until you configure otherwise.

Payment tokens and gateway hand-off

Hosted fields keep card data out of your server; direct integrations do not. The policy has to reflect which model you actually use.

Subscriptions and stored payment methods

Recurring billing stores a token tied to a customer, which is a longer-lived relationship with its own disclosure and cancellation duties.

Shipping and tax integrations

Address data sent to carriers for rates and labels, and to tax services for calculation - each an independent recipient.

Abandoned cart and marketing extensions

Capturing a partially completed checkout and emailing about it is direct marketing based on data collected for a different purpose.

Backups containing the full order table

Every backup replicates customer records. Erasure has to reach the backup policy or it is not erasure.

Third parties the draft will ask you about

Stripe · PayPal · Klarna · Automattic (WooCommerce.com) · Royal Mail, DPD or your carrier · Avalara or TaxJar · Mailchimp for WooCommerce · your hosting provider

The rules that apply

WooCommerce data retention settings

Settings → Accounts & Privacy controls retention for inactive accounts, pending, failed and cancelled orders. Defaults keep everything.

Payment gateway plugins

Stripe, PayPal, Klarna and others handle card data. Which fields your server sees depends on whether the gateway is hosted, embedded or direct.

Tax and compliance services

Automated tax calculation transmits order and address data to a third-party service for every quote.

Self-hosted breach exposure

You hold the order database, so a compromise is your notifiable breach, not a platform’s.

Guest checkout and account creation

Different retention and different lawful bases apply depending on whether an account is created.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Publishing and enforcing on WooCommerce

Set the policy pages in WooCommerce settings
Settings → Accounts & Privacy lets you link the privacy policy on the checkout and account registration pages.
Configure retention for orders and inactive accounts
Choose real periods and let Woo enforce them, rather than describing periods nobody applies.
Add the terms checkbox at checkout
Woo supports a mandatory terms acceptance checkbox, which is what makes your terms part of the contract.
List your extensions
Every extension that transmits order data is a recipient for the policy.
Test personal data export and erasure
Woo hooks into the WordPress tools; confirm what they return and what they leave behind.
Document the backup and restore path
Including how an erasure request is honoured against backups.

Where this usually goes wrong

Never configuring retention

Settings → Accounts & Privacy exists and is nearly always left at the defaults, which retain orders and inactive accounts forever.

Abandoned cart emails with no basis

The email was collected to complete an order. Using it for recovery marketing needs consent or a correctly-applied soft opt-in.

Extensions transmitting order data undisclosed

Review requests, loyalty programmes and analytics extensions each send order and customer data to a vendor.

No breach plan for a self-hosted database

You are the one who has to notify within 72 hours in the UK and EU. Platform-hosted merchants can lean on the platform; you cannot.

Card data touching the server unnecessarily

Direct integrations widen PCI scope considerably compared with hosted fields, and the policy should describe the model you actually run.

Frequently asked questions

Does WooCommerce store credit card details?

Not usually. With hosted or embedded gateway fields the card data goes straight to the provider and you store a token. Direct integrations are different, and they expand your PCI scope substantially.

How long should I keep WooCommerce orders?

Long enough for tax and contractual purposes - commonly six years in the UK - and no longer for the personal data that is not needed. Woo can enforce this automatically once configured.

Are abandoned cart emails legal?

They are direct marketing. In the UK and EU they need consent or the soft opt-in, which requires the address to have been collected in the course of a sale of similar goods with an opt-out offered at the time.

Who is responsible if my WooCommerce database is breached?

You are. Self-hosting means the controller and the operator are the same party, and the 72-hour notification obligation lands on you.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.