Legal

From the system, not from a template. Every one was written from what the software actually does — the region, the sub-processors, what is collected, what is retained, what leaves the EEA — because all of that is knowable from the code. A privacy notice assembled from a generator describes a hypothetical company; these describe this one, which is why they can be checked against the security page and against the product itself.

Beside every substantive clause there is a sentence in plain language saying what it means for you. The clause is the agreement; the sentence is not, and where they seem to disagree the clause wins and we would like to know, because it means the clause is badly written.

Clauses are numbered and each one is its own anchor, so a link to clause 7 opens at clause 7. Clicking the mark beside a heading copies that link. Every document prints to a clean black-on-white A4 with the version and effective date on it, which is the form procurement will want to attach to a file.

No, and adding one would make this worse. A master services agreement earns its place when there are several engagements to sit under it — a statement of work, a support schedule, a professional services rate card, an order form per renewal. There is one product here, one commercial motion, and no professional services. The terms of service plus the data processing agreement are the agreement, and they contain everything an MSA would: the parties, the licence, liability, indemnity, confidentiality, termination, governing law.

Producing one now would mean maintaining a second set of terms that has to be kept consistent with the first. Two documents that disagree is a worse position for both sides to negotiate from than one that is short.

What actually happens when an enterprise asks for one: they want their own paper, not ours. That is a conversation and not a problem — an order form referencing these terms usually resolves it, and where it does not, we will sign an amended version rather than pretend the published document is untouchable. When there is a second commercial motion worth a schedule of its own, that is when a master agreement gets written, and not before.

• A cookie policy. There are no cookies. The complete list of what is kept on your device is a six-row table in clause 4 of the privacy notice, and every row is either your session or a preference you set. That is why there is no consent banner, and being able to say it in one sentence is worth more than a separate document.
• An acceptable use policy. It is clause 11 of the terms. Splitting seven bullet points into their own document would only create another place for them to go stale.
• A service level agreement. Uptime commitments are agreed with the customers who need one, in writing, rather than published as a target with no number behind it.
• Any claim that the product "is GDPR compliant". Compliance is a property of how you use a tool, not a badge a vendor can hand you. What the system does is described precisely; the conclusion is yours to draw, and the security page answers around forty assessment questions to help you draw it.