Cloudflare
Weighted across nine legal categories. Lower is worse.
Executive summary
Cloudflare’s agreement provides a structured SaaS framework with clear auto-renewal notices and reciprocal IP indemnification, but heavily favors the provider through unilateral termination rights, broad user indemnification, and mandatory individual arbitration with class waivers. Consumers should carefully review the strict non-refundable billing policy and the lack of explicit carve-outs for gross negligence in liability limitations.
Category breakdown
Acceptance of Terms & Scope
Contract formation and service boundaries
The agreement uses a hybrid clickwrap/browsewrap model where clicking, using, or accessing services constitutes acceptance, which dilutes explicit consent. The scope is clearly defined but incorporates multiple external documents by reference, potentially obscuring obligations.
Key findings
- Hybrid acceptance mechanism combines explicit clicks with passive use
- Broad scope incorporating Service-Specific Terms and Domain Agreements
- No age verification or child protection clauses noted
Evidence from the document
This Agreement is effective when you click to accept it, use or access the Services, or otherwise indicate your acceptance of the Agreement.
Recommendations
- Require explicit clickwrap consent only, removing 'use or access' as acceptance
- Provide plain-language summaries of incorporated external terms
User Accounts
Registration, suspension, and termination
Cloudflare reserves the absolute right to suspend or terminate accounts at its sole discretion, with or without notice or reason, and provides no cure period or human appeal process. This creates significant risk of sudden service loss without recourse.
Key findings
- Unilateral termination at sole discretion without notice
- No cure period for violations
- No explicit data export or appeal mechanisms
Evidence from the document
We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all.
Recommendations
- Introduce specific violation triggers with written notice and cure periods
- Implement a formal appeal process with human review and data export options before closure
Intellectual Property & UGC
Content ownership and licensing
Users retain ownership of their content, but grant an overly broad, fully sublicensable license to modify and create derivatives, extending beyond what is strictly necessary for service operation. Feedback licenses are perpetual and irrevocable.
Key findings
- User retains ownership of Customer Content
- License grants full sublicensing and derivative creation rights
- Feedback license is perpetual, irrevocable, and transferable
Evidence from the document
Subject to the terms of this Agreement, you hereby grant us a non-exclusive, fully sublicensable, worldwide, royalty-free right to collect, use, copy, store, transmit, modify and create derivative works of Customer Content, in each case to the extent necessary to provide the Services.
Recommendations
- Narrow the license strictly to operational necessity without sublicensing rights
- Limit feedback licenses to non-exclusive, revocable terms during active use
Data Privacy
Data collection, usage, and protection
The agreement properly designates Cloudflare as a data processor and references compliance with GDPR and CCPA via a separate Data Processing Addendum. However, it lacks granular consumer controls within the TOS and includes broad network data retention and monitoring rights.
Key findings
- References DPA for GDPR/CCPA compliance
- Broad retention and monitoring rights over Network Data
- Security guarantees are explicitly disclaimed
Evidence from the document
If Customer Content includes the personal data of European data subjects as those terms are defined by EU and UK Data Protection Laws... Cloudflare is a data processor or sub-processor, as applicable, and Cloudflare will handle such Personal Data in compliance with Cloudflare’s Data Processing Addendum
Recommendations
- Incorporate direct links to privacy dashboards for granular data controls
- Clarify data retention periods and deletion protocols post-termination
Payment & Subscriptions
Billing and subscription management
Auto-renewal and price changes are disclosed with a 30-day notice period, and cancellation can be done online. However, the strict non-refundable policy denies proration for unused portions, and billing begins immediately upon service use regardless of configuration.
Key findings
- Clear 30-day advance notice for price changes
- Online cancellation via dashboard permitted
- Strict non-refundable policy with no proration
- Billing triggers immediately upon use
Evidence from the document
FEES ARE NONREFUNDABLE. YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM.
Recommendations
- Offer prorated refunds for cancellations mid-term
- Add explicit warning banners before trials convert to paid subscriptions
Limitation of Liability
Risk allocation and legal protection
Liability is capped at fees paid in the preceding 12 months, which is a standard commercial baseline. However, the clause excludes consequential damages broadly and fails to explicitly carve out gross negligence or willful misconduct, reducing consumer protection.
Key findings
- Aggregate liability capped at 12 months of fees
- Excludes indirect, incidental, and consequential damages
- No explicit carve-out for gross negligence or willful misconduct
Evidence from the document
YOU AGREE THAT THE AGGREGATE LIABILITY OF THE CLOUDFLARE ENTITIES TO YOU FOR ANY AND ALL CLAIMS ARISING OUT OF RELATING TO THE USE OF OR ANY INABILITY TO USE THE SERVICES ... IS LIMITED TO THE AMOUNTS YOU HAVE PAID TO CLOUDFLARE TO ACCESS AND USE THE SERVICE IN THE 12 MONTHS PRIOR TO THE CLAIM.
Recommendations
- Add explicit carve-outs for gross negligence, willful misconduct, and statutory non-waivable rights
- Ensure the cap does not apply to data breaches or security failures
Indemnification
Legal responsibility allocation
Users must indemnify Cloudflare for any claims arising from mere 'access to, use of, or alleged use' of the service, which is excessively broad and imposes unlimited financial risk. The clause lacks a carve-out for harms caused by Cloudflare’s own negligence.
Key findings
- Triggered by mere 'use' or 'alleged use'
- Covers unlimited claims, damages, and attorney fees
- Company retains exclusive defense control
- Reciprocal indemnity limited to US/EU IP infringement
Evidence from the document
You agree that you will be responsible for your use of the Service, and you agree to defend, indemnify, and hold harmless Cloudflare ... from and against any and all claims, liabilities, damages, losses, and expenses, including reasonable attorneys' fees and costs, arising out of or in any way connected with your access to, use of, or alleged use of the Service;
Recommendations
- Restrict user indemnification to actual breaches, unlawful conduct, or proven infringement
- Add mutual carve-outs for claims arising from the other party’s negligence or willful misconduct
Modification of Terms
How agreements can be changed
Material changes require reasonable efforts to notify users via email, and modifications apply prospectively at the next renewal. However, rejection only permits non-renewal without a pro-rated refund for prepaid terms, limiting practical exit options.
Key findings
- Advance notice required for material changes
- Prospective application only
- Rejection remedy limited to non-renewal
- No version archive or changelog mentioned
Evidence from the document
If a revision materially alters your rights we will use reasonable efforts to contact you, including sending a notification to the e-mail address(es) associated with your account.
Recommendations
- Guarantee a pro-rated refund for prepaid periods if users reject changes
- Maintain a public changelog and archived versions of past terms
Governing Law & Disputes
Jurisdiction and conflict resolution
The agreement mandates binding individual arbitration, waives class actions and jury trials, and forces exclusive jurisdiction in San Francisco County. While small claims are preserved, the structure severely restricts consumer access to justice and shifts procedural burdens.
Key findings
- Mandatory pre-dispute individual arbitration
- Class action and jury trial waivers
- Exclusive venue in San Francisco County, California
- Opt-out only available for future arbitration amendments
Evidence from the document
you and Cloudflare agree that any and all disputes arising in connection with this Agreement will be resolved by binding arbitration. ... YOU UNDERSTAND AND AGREE THAT, BY ENTERING INTO THESE TERMS, YOU AND CLOUDFLARE ARE EACH WAIVING THE RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION.
Recommendations
- Preserve court access for all disputes except minor ones
- Allow consumers to sue in their home jurisdiction and eliminate class/action waivers
- Ensure the company covers all arbitration filing and hearing fees
Ex-TerCo provides automated analysis of legal documents for informational purposes. This is not legal advice. Terms can change at any time.