Terms of Service vs Privacy Policy

The short answer

The terms of service are the deal between you and the vendor: rights, rules, fees and risk. The privacy policy is a notice about personal data: what is collected, why, who gets it and for how long.

You need to read both. The terms decide what you owe and what you can claim. The privacy policy tells you what happens to data about you and your team.

Terms of service

• What it is: the contract for using the product. For SaaS it may be called a customer agreement, subscription agreement or terms of use.
• Who it binds: you and the vendor. You often accept it by clicking a box or by using the product. The Atlassian Customer Agreement, for example, says "by using or accessing the Products, you confirm you are bound by this Agreement."
• Typical content: what you may and may not do, fees and renewals, how the vendor may change the terms, limitation of liability, indemnities, termination, and where disputes are settled.
• Links to other documents: it often pulls in the acceptable use policy, the DPA and product terms by reference.

Privacy policy

• What it is: a public notice to the people whose personal data the company collects.
• Who it speaks to: individuals, such as users, website visitors and sales leads. Privacy laws require it. GDPR Article 13 lists what a controller must tell people, including purposes, legal basis, recipients, retention period and rights.
• Typical content: categories of data, uses, sharing with partners and advertisers, cookies, international transfers, retention and how to make a request.
• How often it changes: the CCPA (section 1798.130(a)(5)) requires businesses to update their online privacy policy disclosures at least once every 12 months.

Which one applies to you

Both apply, to different things. A quick way to sort a question is to ask whether it is about money and duties, or about personal data.

• For money and risk: read the terms. Price increases, auto-renewal, usage limits and liability caps live there.
• For data the vendor collects for itself: read the privacy policy. That covers your staff's accounts, usage analytics and marketing data.
• For your customers' data inside the product: read the DPA, which is often a third document. Many SaaS privacy policies say they do not cover data the vendor handles as your processor (the Atlassian privacy policy is one example).

When you review a new vendor, start with the terms to see what you are agreeing to pay and risk. Then read the privacy policy to see what the vendor learns about your team and how it uses that.

The two documents can also send you to each other. A promise you expect in one may sit in the other, so search both before you conclude a vendor is silent on a topic.

A change to either one matters. Whether a changed term binds you depends on your contract and on state law. The FTC said in a February 2024 staff blog post (guidance, not a rule) that quietly or retroactively loosening data practices in terms or privacy policies could be unfair or deceptive.

Example

A terms change Venpo caught: using Grafana's website now binds you to arbitration. That is a contract rule about how disputes are settled, so it lives in the terms.

A privacy policy change Venpo caught: Stripe introduced communication transcription in its privacy policy. That is about what data is collected and how it is used, so it lives in the privacy policy.

How Venpo helps

Venpo monitors your vendors' terms of service and privacy policies, along with their DPAs and other legal pages. When one changes, you get an email in plain English with what changed and why it matters, and each vendor keeps a change history.