Legal register

The contract between the company and whoever uses the product.

Without it there is no agreed limit of liability, no stated governing law, and no basis for suspending an account.

What personal data is collected, why, on what legal basis, and who it is shared with.

Required almost everywhere the site claims to operate, and it has to name the sub-processors rather than gesture at them.

What is stored on the visitor's device, and a real choice about the non-essential parts.

Consent has to be collected before the cookie is set, not after — a banner that only informs is not consent.

What customers may not do with the platform.

This is what makes it possible to terminate an abusive account without breaching the contract.

How to cancel, what is refundable, and over what period.

The company takes payments; consumer law in most markets requires this to be stated up front.

Registered name, registration number, registered address, and a contact route.

Several jurisdictions require a trading website to identify the legal entity behind it. It also has to match the entity named in the Terms.

The terms under which the company handles data on a customer's behalf.

Business customers will ask for it during procurement, and GDPR requires a written agreement between controller and processor.

Every third party that touches customer data, kept current.

AWS, Google Cloud and the Meta platforms are all sub-processors. Customers are usually entitled to notice before the list changes.

How someone asks for their data, corrects it, or has it deleted — and how fast that is answered.

The right exists whether or not there is a process; without one the deadlines get missed.

Who gets told, and within how long, if data is exposed.

Regulator deadlines are measured in hours. The decision tree has to exist before the incident, not during it.

The mechanism relied on when data leaves the region it was collected in.

Cloud regions and support access both move data across borders, often without anyone deciding to.

How long each category is kept, and what happens at the end.

“Until we feel like deleting it” is not a retention period, and it is the first thing an audit asks for.

Evidence that cardholder data is handled to the card networks' standard.

Mastercard and the banks enforce this through the acquirer. The required level depends on volume and on whether card data ever touches your systems.

The developer terms for WhatsApp Business, Facebook, Instagram, AWS and Google Cloud.

Each flows down its own privacy and data-use requirements, and the Meta platforms audit against them.

A note that third-party names and marks belong to their owners, and that listing them is not a claim of endorsement.

The credentials belt (NU-32) displays other companies' marks. See the warnings in claims.ts and public/media/logos/LICENCE.txt.

Proof for each certification named on the site, and wording matching what each programme actually grants.

“Certified by” is looser than most partner programmes permit, and the programmes police it themselves.

Licences and notices for the third-party code and assets shipped in the product.

This site alone carries Next.js, GSAP, Three.js, Lenis, simple-icons and two Google Fonts, several of which require notice.

The evidence behind each marketing claim, held before the claim goes live.

“Fastest growing SaaS in Iraq”, “most secure servers” and “trusted by companies worldwide” are all superlatives. See claims.ts.

The uptime actually committed to, and what happens when it is missed.

The site implies reliability. An SLA turns that from a mood into a number with a remedy.

How data is encrypted, who can reach it internally, and how that is reviewed.

It is what a security questionnaire asks for, and it is the evidence behind the security claims on the site.

The standard targeted, known gaps, and how to report a barrier.

Public-sector and enterprise buyers ask for it, and in several markets it is a procurement requirement.

Contracts, IP assignment, and confidentiality.

Without written IP assignment, work produced by contractors may not belong to the company.

Controls on who the company may transact with.

Cross-border payments and public-sector customers both raise screening obligations.

Professional indemnity and cyber cover.

Enterprise contracts frequently require minimum cover as a condition of signing.

Which country's law applies and where a dispute is heard.

It belongs in the Terms, but it is a commercial decision rather than a drafting one.