Legal Pages Every Hosting Business Needs: Terms, AUP, Privacy and Refund Policy Explained
Most hosting businesses need four core legal pages: Terms of Service, an Acceptable Use Policy, a Privacy Policy, and a Refund and Cancellation Policy. Terms define the customer agreement, the AUP defines prohibited conduct, the privacy policy explains how personal data is handled, and the refund policy sets out billing and cancellation conditions. Many providers add a service level agreement and policies for cookies, domains, and data processing.
These pages work as a set. Each one answers a different question a customer or a dispute will eventually ask. When they agree with each other and with how you actually run the business, disputes get much easier to handle.
A caution first. Legal requirements differ by country, business model, and customer location. This guide explains what each page does and what it usually covers, but it is general information, not legal advice. A template is a starting point, and a lawyer who knows your jurisdiction should review the final version.
Which Legal Pages Should Every Web Hosting Business Have?
Every hosting business should publish Terms of Service, an Acceptable Use Policy, a Privacy Policy, and a Refund and Cancellation Policy before taking a payment. Add a service level agreement if you promise uptime or response times, and extra policies if you use cookies, sell domains, or process customer data on their behalf.
Terms of Service for Defining the Customer Agreement
The Terms of Service are the main contract between you and the customer. They describe what you sell, what the customer must do, how billing works, and what happens when something goes wrong.
Think of the terms as the parent document. The AUP, privacy policy, and refund policy often sit underneath it, and the terms should say that they all apply.
If you resell hosting, your terms cannot promise more than your upstream provider allows. A reseller hosting business should read its own provider’s terms and make sure the two documents do not conflict.
Keep the language plain where you can. A contract the customer understood is easier to rely on than one they never read.
Acceptable Use Policy for Prohibited Activities
The Acceptable Use Policy, or AUP, lists what customers may not do with your service. It covers spam, malware, illegal content, and anything that harms other customers or your servers.
The AUP protects the other people on your platform. One abusive account can damage the reputation of a shared IP address and slow down hundreds of neighbors.
It also gives you a clear basis for action. When you suspend an account, you can point to a rule the customer agreed to.
Write the rules so they match what you will actually enforce. Rules you never apply invite arguments about fairness.
Privacy Policy for Explaining Personal Data Handling
A privacy policy tells people what personal data you collect, why, who you share it with, how long you keep it, and what rights they have. Hosting businesses collect names, emails, billing details, and IP addresses as a normal part of work.
In many places, publishing one is a legal requirement and not just good practice. The exact rules depend on where you operate and where your customers live.
The policy must describe what you really do. Copying another company’s text while collecting different data creates risk, not protection.
Review it whenever you add a tool that touches customer data, such as a new analytics service or payment provider.
Refund and Cancellation Policy for Billing Expectations
This page sets expectations about money. It explains whether refunds exist, how long customers have to ask, what is excluded, and how to cancel.
A clear policy prevents many disputes. A customer who knows the rules in advance is less likely to dispute a charge with a bank later.
It should agree with your terms and your checkout page. If the three say different things, the customer will rely on the most favorable one.
Consumer protection law may give some customers rights that no policy can remove. Check the rules that apply to your customers.
Service-Level Agreement for Availability and Support Commitments
A service level agreement, or SLA, sets out the availability and support you commit to, and what happens if you miss it. Typical items include an uptime target, support response times, and any credits.
Only promise what you can deliver. A claim of 99.9 percent uptime or 24/7 support must be backed by the infrastructure and staff to match.
Resellers should be careful here. If your own commitment is stronger than your provider’s, you carry the gap. Check what support such as end user support covers before you write your numbers, and confirm the scope for your plan.
Many small providers publish a simple statement of intent instead of a formal SLA. That can be fine, if it is honest and accurate.
Additional Policies for Cookies, Domains and Data Processing
Depending on your business, you may need more pages. A cookie policy explains tracking on your website. A domain registration policy covers rules from registries and registrars. A data processing agreement may apply if you host customer data that includes personal information about their own users.
If you sell SSL certificates through a program such as the SSL reseller program, check whether the certificate authority’s terms need to be passed on to your customers.
Each extra policy adds maintenance work, so add only what your situation calls for. A lawyer can tell you which ones are required where you operate.
Link every policy from your footer and from checkout, so customers can find the full set.
What Should a Web Hosting Terms of Service Document Include?
A hosting Terms of Service should cover service scope, billing and renewals, resource limits, suspension and termination, backups and data loss, and liability limits with a way to resolve disputes. Each section should say what you do, what the customer must do, and what happens when either side fails.
Service Scope and Customer Responsibilities
Start by describing what you sell and what you do not. Name the services, such as hosting accounts, email, and domains, and say what support covers.
Then list what customers must do. They are usually responsible for their content, their passwords, the software they install, and keeping their contact details current.
Be specific about boundaries. If you do not fix custom code, say so. This saves arguments later.
Link to the Acceptable Use Policy and say it forms part of the agreement.
Billing Cycles, Renewals and Payment Obligations
Explain how billing works in plain words. State the price, the billing period, when invoices are issued, and what payment methods you accept.
Spell out automatic renewal. Say when it happens, at what price, and how to turn it off. Hidden renewal terms are one of the most common causes of disputes and complaints.
Cover late payment too. State the grace period, the fees if any, and what happens to the service when payment fails.
Make sure the numbers match what customers see at checkout and on invoices.
Resource Limits and Fair-Use Conditions
Every hosting plan has limits, even when the marketing says unlimited. Your terms should name them or point to where they are listed, such as CPU, memory, storage, file counts, and processes.
Explain what happens when a customer passes them. Do you warn, slow the account, suspend it, or ask for an upgrade?
Plans such as shared web hosting share resources between many accounts, so a fair use clause protects everyone. Define it clearly rather than leaving it vague.
Vague limits are hard to enforce and easy to dispute. Clear ones give you a fair basis for action.
Service Suspension and Account Termination
State when you can suspend or terminate an account and what notice you will give. Typical reasons include non payment, AUP breaches, legal orders, and threats to server stability.
Distinguish between suspension, which is temporary, and termination, which ends the agreement. Explain how customers can get a suspended account restored.
Say what happens to data after termination, and for how long you keep it. Customers worry about this more than most owners realize.
Where possible, give warning before action. It is fairer, and it reduces complaints.
Backups, Data Loss and Customer Responsibilities
Be honest about backups. State whether you take them, how often, how long you keep them, and whether restoring one is guaranteed or best effort.
Make clear that customers should keep their own copies. No provider can promise that data will never be lost, and the terms should say so plainly.
Explain any fees for restores and any limits on what you will restore.
A customer who understands this in advance is far less likely to feel betrayed after an incident.
Liability Limitations and Dispute Resolution
Terms usually limit how much the business is liable for, and exclude certain kinds of loss. They also explain how disputes are handled, such as which law applies and where claims are heard.
These clauses are where jurisdiction matters most. Some limits are not enforceable against consumers in certain places, and wording that works in one country can fail in another.
This is the section to have a lawyer review. Do not copy it from another company’s website.
Add a contact route for complaints. A fair way to raise a problem often prevents a formal dispute.
What Should You Include in a Hosting Acceptable Use Policy?
A hosting AUP should cover spam and phishing, malware and unauthorized access, copyright infringement and illegal content, resource abuse, how abuse is reported and investigated, and the steps you take from warning to suspension. Write each rule so it matches what you will actually enforce.
Spam, Phishing and Unsolicited Email Restrictions
Spam is one of the fastest ways to damage a hosting platform. It can get server IP addresses blocked and harm every customer who sends email from them.
Prohibit unsolicited bulk email, phishing pages, and fake sender details. Say that you may filter or block outgoing mail that looks abusive.
Good tooling helps, and our MailChannels corporate email is designed to keep outgoing mail from landing in spam. Confirm what your own setup provides.
Include your process for complaints. Receiving and acting on spam reports promptly protects your reputation.
Malware, Unauthorized Access and Abusive Activities
Ban malicious software, hacking attempts, and tools used to attack others. That covers hosting malware, running port scans against other networks, and trying to access systems without permission.
Include denial of service activity, botnets, and fraudulent sites.
Say what you may do in response, such as removing content or suspending the account straight away when the risk is serious.
Compromised accounts are a special case. A customer may be a victim, not an offender, so describe how you handle cleanup and restoration.
Copyright Infringement and Illegal Content
Prohibit content that infringes copyright or breaks the law where you operate. Explain how rights holders can send you a complaint and how you will respond.
In the United States, providers that want protection under the DMCA safe harbor must designate an agent with the Copyright Office and renew that designation, at least every three years. Check whether this applies to you.
Describe your notice and counter notice process in your policy, and follow it in practice.
Laws on illegal content differ by country. Ask a lawyer which rules apply to you and your servers.
Resource Abuse and Activities Affecting Server Stability
Some activities are legal but still harmful on shared servers. Examples include heavy cron jobs, runaway scripts, large public file hosting, and cryptocurrency mining.
List what you consider excessive and what actions follow, such as a warning, throttling, or a request to upgrade.
Tools like CloudFlare CDN can reduce load from busy sites, and you can suggest them as a fix before taking harsher steps.
Treat resource abuse differently from malicious abuse. Often the customer simply outgrew the plan.
Abuse Reporting and Investigation Procedures
Tell people how to report abuse. Give a dedicated email address or form, and say what information you need, such as links, headers, and timestamps.
Explain how you investigate. State who reviews reports, how fast you aim to respond, and what the customer is told.
Be careful with fairness. A report is an allegation, so describe how you check it before acting.
Keep records of each report and your decision. They protect you if a customer or a complainant disputes the outcome.
Warnings, Restrictions and Account Suspension
Describe the steps you may take, from warning to restriction to suspension to termination. Say which breaches get a warning and which lead straight to suspension.
Serious threats, such as active malware or illegal content, may justify immediate action. Minor breaches usually deserve a chance to fix the issue.
State how customers can respond or appeal, and whether any fees or refunds are affected.
A graded approach is easier to defend as fair, and it keeps good customers who made a mistake.
How Should a Hosting Privacy Policy Explain Customer Data Handling?
A hosting privacy policy should describe what personal data you collect, why you process it, which outside services receive it, how you use cookies and analytics, how long you keep and protect data, and how people can use their privacy rights. Say what you actually do, in plain language.
Categories of Personal Information Collected
List the types of data you collect. For hosting, that usually includes names, email addresses, phone numbers, billing addresses, payment details handled by processors, IP addresses, and support messages.
Mention data generated by use of the service, such as login records and usage logs.
If customers upload personal data about their own visitors, explain that in your terms or a data processing agreement. That data raises separate questions.
Group items into clear categories. A long unstructured list is hard for people to read.
Purposes and Legal Bases for Processing Personal Data
Say why you use each type of data. Typical purposes are providing the service, billing, security, support, and meeting legal duties.
Some laws, such as the GDPR, require you to state a legal basis for each purpose, such as contract, legal obligation, or consent. Check which privacy laws apply to your customers.
Do not claim a purpose you do not have, and do not use data for something you did not disclose.
Match this section to your real processes. An accurate short list beats a long generic one.
Payment Providers and Other Third-Party Services
Name the kinds of outside services that handle customer data. These typically include payment processors, email delivery tools, support software, and analytics.
If you take payments through a free merchant account or another provider, explain who processes card details. Many businesses never see the full card number.
Link to the privacy policies of major providers where it helps.
Update the list when you add or remove a service. An outdated list is a common gap in small business policies.
Cookies, Analytics and Tracking Technologies
Explain what cookies and trackers your website and client area use, and why. Separate essential cookies from analytics or marketing ones.
Some places require consent before non essential cookies are set. If that applies to you, a banner or settings tool may be needed, and the policy should match how it behaves.
Check your site for trackers you forgot. Plugins and embedded widgets often add more than owners expect.
Keep the cookie details accurate. A policy that says no tracking while a script tracks visitors causes real trouble.
Data Retention, Security and Deletion Practices
State how long you keep different kinds of data and why. For example, billing records may need to be kept for tax reasons, while support messages might be kept for a shorter time.
Describe your security measures in general terms, such as encryption, access controls, and backups. Avoid promises of perfect security.
Explain what happens to data when an account ends, and how customers can ask for deletion.
Then follow your own schedule. A retention rule you never apply is worse than none.
Customer Privacy Rights and Contact Procedures
Tell people what rights they have and how to use them. Depending on the law, these can include access, correction, deletion, and objecting to certain uses of data.
Give a clear contact method, such as an email address or form, and say how long you aim to take to respond.
Describe how you will verify identity before sharing or deleting data. That protects customers from impostors.
Name a person or role responsible for privacy questions, so requests do not get lost.
What Should a Web Hosting Refund and Cancellation Policy Explain?
A refund and cancellation policy should explain who can get a refund and within what time, which services and fees are excluded, how automatic renewals work, how and when cancellation takes effect, how domains and outside costs are treated, and how refunds are processed and disputes handled.
Refund Eligibility and Applicable Time Limits
State clearly who can ask for a refund and for how long. Many hosts offer a money back window on new hosting plans. If you do, give the number of days and the starting point.
Say what the customer must do, such as submit a request through a ticket or the client area.
Consumer law can add rights on top of your policy. In the EU, for example, consumers generally have 14 days to withdraw from online service contracts, and that right can only be lost under strict conditions. For an ongoing service like hosting, those conditions may not be met, so get advice.
Write the policy to fit the law, not the other way around.
Services and Fees That Are Excluded From Refunds
List what is not refundable. Common examples are domain registrations, setup fees, SSL certificates already issued, and third party licenses.
Explain why where it helps. Customers accept limits better when they see the reason, such as a registry fee you cannot recover.
Make exclusions visible before checkout, not only on a policy page. Surprises at the refund stage cause disputes.
Check that your exclusions are allowed where your customers live. Some places limit what you can exclude.
Recurring Billing and Automatic Renewals
Explain that services renew automatically if that is true. Give the renewal period, the price, and when the customer will be charged.
State whether you send reminders and how far ahead. Reminders reduce complaints and are required in some places.
Say how to turn off renewal and by when. A clear method and date keep disputes down.
Consider showing renewal terms at checkout as well as on the page. People rarely read policy pages before paying.
Cancellation Requests and Service Termination Dates
Explain how to cancel, such as through the client area or a ticket, and what counts as a valid request. Say who confirms it and how.
Describe when cancellation takes effect. Does service stop immediately or at the end of the paid period? Is there any refund for the unused time?
State how much notice is needed before renewal. A deadline of a few days is common, and customers must know it.
Confirm cancellations in writing. A confirmation email avoids later arguments about what was requested.
Domain Registration and Third-Party Service Costs
Domains work differently from hosting. Registrars and registries have their own rules, and fees are often not refundable once a domain is registered.
If you sell domains, for example through a free domain reseller account, check your registrar’s terms and reflect them in your policy. Confirm current terms for your own account.
Treat other outside costs the same way, including licenses and certificates you purchased on the customer’s behalf.
Say clearly which items follow the hosting refund window and which do not.
Refund Processing and Dispute Resolution
Explain how refunds are paid, such as to the original payment method, and how long they usually take. Be careful with timing promises, since banks control part of the delay.
Describe what to do if a customer disagrees with a decision. A simple escalation path, such as a request for review by a manager, resolves many cases.
Mention what happens if a customer files a chargeback. Say that you may suspend services and respond with your records.
A fair, quick refund is usually cheaper than a dispute. Write the policy with that in mind.
How Can You Publish and Maintain Hosting Legal Pages Correctly?
Keep every policy consistent with how your services really work, show them before checkout, record who accepted which version, keep a history of changes, review them for each jurisdiction you serve, and check that every link in WHMCS and on your website points to the right document.
Keeping Policies Consistent With Actual Services
A policy that does not match reality is a liability. If your terms promise daily backups and you take weekly ones, you have created a dispute in advance.
Read each page against your real operations. Check features, limits, support hours, and billing practices.
If you run a network of resellers, such as under a master reseller arrangement, make sure your policies flow down in a way that does not contradict the terms you accepted yourself.
Update the pages whenever the service changes, not months later.
Displaying Policies Before Checkout
Customers should see your terms before they pay. Link them near the order button, and use a checkbox that the customer must tick.
Make links easy to open and easy to read on a phone. A page that is hard to find carries little weight if challenged.
Also show the key points in plain words next to the link, such as the renewal price and the refund window.
Test the process as a new customer would, from a phone as well as a desktop.
Recording Customer Acceptance of Relevant Terms
Keep a record that each customer accepted your terms. Useful details include the date and time, the version, and the IP address or other proof of the action.
Electronic acceptance, such as a checkbox, is widely used. Whether it is enforceable depends on the law and how clearly the terms were presented.
Check what your billing system records by default. Recent versions of WHMCS include tools around terms acceptance and privacy, but confirm what your own version stores.
If it does not record enough, add a step or export the data regularly.
Maintaining Version History and Policy Update Records
Save a dated copy of every version of every policy. When a dispute arises, you need to show which version applied on the day the customer signed up.
Note what changed and why. A short change log is enough.
Tell customers about important changes, and say how long they have to object, if your terms allow it. Notice rules vary, so check them.
Put the date of the last update on each page.
Reviewing Policies for Each Operating Jurisdiction
Your obligations depend on where you are based and where your customers live. Privacy law, consumer rights, tax rules, and content laws can all differ.
List the places you operate in and sell to. Check the main rules for each, or ask a lawyer who covers them.
Do not assume that one global policy fits everyone. A policy that works in one country may fall short in another.
Review again when you enter a new market. Growth changes your legal position.
Auditing WHMCS and Website Links to Legal Documents
Broken or outdated links are an easy mistake. Check that your website footer, checkout, client area, and emails all point to the current version of each page.
In WHMCS, review the terms of service setting, the checkout acceptance checkbox, and any privacy policy links. Make sure they use the correct addresses.
Test them from a private browser window as a visitor would. Fix any that fail.
Put the audit on a calendar, every quarter, so it actually happens.
If you want checkout, billing records, and acceptance settings handled in one place, take a look at the free WHMCS license that comes with our reseller plans, and confirm the current plan details first.
