Building your own SaaS: what to put in place before your first paying customer

“Business customers only” is not the whole answer

Decide who may subscribe: companies only, or consumers too? The answer affects your terms, displayed prices, checkout, complaints and termination arrangements.

For sole traders, certain consumer protections may apply to business purchases outside their professional scope. The extent depends on the provision concerned. A Polish tax number on the invoice, or a “B2B” label, does not settle the issue. Not every purchase made with business details allows the same liability exclusions.

Which documents do you actually need?

Start with terms of service. Under Polish electronic services legislation, they should cover the service, technical requirements, rules of use, contract formation, termination and complaints, including the prohibition on supplying unlawful content. The plan and price can sit in an order or pricing schedule, provided the documents and checkout are consistent.

You also need information about personal data processing, usually provided in a privacy notice. Where you process personal data on a customer's behalf, you need data processing terms, commonly called a DPA. A privacy notice does not replace them. Do not postpone documentation and data protection until the first payment if you already provide a service or process data during the free trial.

A small SaaS does not necessarily need a separately signed contract and lengthy service level agreement, or SLA. Support arrangements can sit in the terms. A separate SLA becomes useful for distinct, measurable commitments. More documents do not necessarily mean better protection.

From a free trial to the next card payment

Establish whether customers choose a paid plan after the trial or subscribe at registration with payment deferred. Make the price, billing period, commitment length and renewal rules clear. Monthly billing does not necessarily allow cancellation after one month.

If automatic conversion is unnecessary, consider a trial without card details, followed by a separate order for the paid plan. This is an operationally simpler option, not a legal requirement. It still needs appropriate documents, customer information and lawful data processing.

For consumer sales, information required immediately before an order cannot be buried in the terms. The button must unambiguously indicate an obligation to pay. “Start trial” alone is insufficient if clicking it also concludes a paid contract.

Explain how and when to stop renewal, and when access ends. Address failed payments, further collection attempts, notification, suspension and termination. Changing the amount in your payment provider's dashboard does not establish a contractual right to increase prices or properly notify customers. Consumer law further limits unilateral changes.

Provide the terms before the contract is concluded in a form the customer can save and reproduce. Keep the version associated with the order and evidence of acceptance. Give consumers the required contract confirmation on a durable medium. An email with the terms attached avoids relying on a link whose contents keep changing.

Consumers generally have 14 days from concluding an online service contract to withdraw. This differs from stopping renewal; a trial ending does not automatically start a new withdrawal period. Activating an ongoing service is not full performance. Do not copy an e-book seller's withdrawal wording. Assess early performance, any proportionate payment and statutory rights when a digital service fails to conform to the contract separately.

Keep the subscription distinct from custom development

Describe the features included in the chosen plan, usage limits and required integrations. Separate existing functionality from development plans. A promise made during a sales conversation can affect what the customer is entitled to expect. A qualification hidden in the terms will not undo every promise in an offer.

Check where the code comes from

Check that you have rights to your own work and incorporated components. Code written during employment or covered by another contract is not necessarily available for your new business just because you wrote it.

Paying a freelance developer's invoice does not automatically transfer economic copyright. You need an appropriate assignment or a licence sufficient for your intended use. An assignment must specify its scope and when the rights transfer, and meet Polish law's written-form requirement to be valid. A qualified electronic signature can satisfy the equivalent electronic form. Exchanging scans or using a standard electronic signature is not the same thing.

Open-source components do not inherently prevent commercial SaaS use. Obligations depend on the particular licence and how the component is used. For AI-assisted code, consider the tool's terms, the origin of incorporated material and the human contribution. A paid account does not guarantee exclusive rights or the absence of third-party claims.

GDPR: map the data before writing the notice

Identify what personal data enters the app and where it goes. You will usually be controller for your account administration and billing, but may be processor for customers' operational data. Determine roles by processing activity, not through one label for the whole product.

The DPA should reflect the service: the processing involved, instructions, safeguards, assistance and further providers. Review hosting, support tools and external APIs, including AI services. Identify recipients, purposes and subprocessing arrangements. Selecting an EEA server does not itself rule out transfers outside the EEA, including through remote access.

Do not rely on a single “GDPR consent” for everything. Each purpose needs an appropriate legal basis, which is not always consent. Cookies and similar technologies have additional rules: non-essential analytics or advertising mechanisms require appropriate prior consent to storing or accessing information on a user's device.

A privacy notice cannot replace access controls, retention arrangements or preparation for an incident. Having only a few customers is not a general exemption from the GDPR.

Promise support you can actually provide

If you work alone, do not commit to round-the-clock support you have not arranged. Specify your support channel and hours. Distinguish response time, meaning starting to handle a request, from restoration of service and correction of the underlying fault. These are different commitments.

Creating backups does not demonstrate that you can restore the service within a promised time. Test restoration, check what the backups cover and assess how much recent work might be lost. Dependencies on hosting or external APIs must also inform your customer commitments.

B2B liability can be allocated and limited, but not eliminated without restriction. An exclusion for intentionally caused loss is invalid under Polish law. Limitations also need separate assessment where consumer protections apply. A general “use at your own risk” statement is no substitute.

What can customers take with them when they leave?

Determine which data can be exported, in what format and when access closes. Deletion timing should accommodate data retrieval, legal obligations and the backup retention cycle. Your terms and DPA must be consistent.

Assess whether your SaaS is a data processing service covered by the Data Act's switching rules, applicable since 12 September 2025. Duties may include removing switching obstacles and providing suitable exports, not building every requested integration. Covered switching charges will be prohibited from 12 January 2027; before then, they are limited to direct costs. Assess the service before the first customer leaves.