Jump to a document
Non-Disclosure Agreement (NDA)
Protects your ideas before you share them.
An NDA is a legal contract that prevents someone from disclosing confidential information you share with them. For founders, that means you can have a real conversation with a potential co-founder, investor, or contractor without worrying about your idea walking out the door.
NDAs are typically mutual (both parties agree not to disclose the other's confidential information) or one-way (only the receiving party is bound). For early-stage startup conversations — sharing your product idea, business model, or technical architecture — a mutual NDA is the standard starting point. It sets a professional tone and makes the other party take the relationship seriously.
You need an NDA before sharing anything sensitive: your pitch deck with an investor, your source code with a freelancer, or your business model with a potential co-founder. The common mistake is thinking NDAs only matter later. They matter most early, when your idea hasn't been validated by the market yet.
- Using a blank template that doesn't specify what counts as "confidential information"
- Forgetting to include a term — NDAs with no expiry date are harder to enforce
- Asking sophisticated investors to sign NDAs before a first call (they won't, and it signals inexperience)
- Not keeping a signed copy — verbal NDA agreements are worthless
Founders Agreement
Settles the hard questions before they become hard conversations.
A Founders Agreement defines the relationship between co-founders before the company makes money. It covers equity splits, roles and responsibilities, decision-making authority, and — critically — what happens if a founder leaves. Without one, you're operating on trust. Trust is fine until the first major disagreement, and then it isn't.
The most important clause in any Founders Agreement is the vesting schedule. Standard founder vesting is four years with a one-year cliff: if a co-founder leaves in the first year, they get nothing. After the cliff, equity vests monthly over the remaining three years. This protects the remaining founders from a co-founder who leaves early but keeps a large equity stake. Investors will expect to see vesting — if you don't have it, add it before your first fundraising conversation.
Roles matter too. "We'll both do everything" works for two weeks. After that, someone needs to own product decisions, someone needs to own commercial decisions, and someone needs the authority to make a call when there's a disagreement. The Founders Agreement is where you write that down while everyone still likes each other.
- Splitting equity 50/50 with no vesting — one founder can leave Day 1 and keep half the company
- No buyback provisions — if a founder leaves, can the company buy back unvested shares?
- Not addressing what happens to IP built before the company was incorporated
- Signing it too late — after a dispute has already started, it's too late to document the original agreement
Privacy Policy
A legal requirement for any website or app that collects data.
A Privacy Policy is a public document that tells users what data you collect, how you use it, who you share it with, and how they can request deletion. It's not optional. GDPR (Europe), CCPA (California), and PIPEDA (Canada) all require it if you collect any personal data — including email addresses, analytics, or cookies. "Any website" is not an exaggeration: if you have a contact form or Google Analytics installed, you're collecting personal data.
The fines for non-compliance aren't hypothetical. GDPR violations can result in penalties up to 4% of annual global turnover or €20 million, whichever is higher. For a pre-revenue startup, the reputational risk and potential cleanup cost are more likely concerns — app stores, payment processors, and enterprise customers will ask to see your Privacy Policy before they work with you.
A good Privacy Policy is written in plain language, not dense legal boilerplate. It should tell users exactly what you do with their data. The ones that hide your data practices in 40 pages of legalese create liability, not protection — if a user claims they didn't understand, and the policy was designed to obscure, you lose.
- Copy-pasting a template without updating it for your actual data practices
- Not listing third-party services (analytics, payment processors, email tools) by name
- Forgetting to include a contact address for data deletion requests
- Not updating the policy when you add new features that collect new types of data
Terms of Service
Your liability protection and the rules of engagement with users.
Terms of Service (also called Terms and Conditions, or ToS) is the agreement between you and your users that defines what they can and can't do with your product, limits your liability if something goes wrong, and sets out the rules for disputes. Without one, you have no agreement — which means users can argue that anything they do with your product is fair use, and you have limited grounds to remove an account or terminate a relationship.
The most important clause for early-stage startups is limitation of liability. Products break. APIs go down. If a user loses business because your software was unavailable and you don't have a liability cap, you're exposed. A standard ToS limits your liability to the amount the user paid you — for a free product, that's zero. For a $50/month subscription, that's capped at a reasonable amount. Without it, the ceiling is whatever a court decides.
Terms of Service also govern account termination rights. You need the ability to terminate accounts that violate your policies, spam other users, or engage in fraud. Without explicit termination language, terminating an account can expose you to claims of breach of contract. It's the kind of problem that never happens until it does — and then it's expensive.
- No limitation of liability clause — leaving yourself exposed to unlimited damages claims
- Using consumer-facing terms for a B2B product (or vice versa) — the legal standards are different
- No governing law clause — disputes default to whatever jurisdiction a plaintiff chooses
- Not requiring users to affirmatively accept the ToS (a link in the footer doesn't count in all jurisdictions)
All 5 documents. Plus 13 more. $49.
FounderVault generates all 18 startup legal documents in 60 seconds — auto-filled with your details, every clause explained in plain English. No subscriptions, no lawyers, no surprises.
Get All 18 Documents — $49 →