I recently built a website for a friend, and someone who saw it contacted me about creating a similar custom site for them. The project would use HTML and Tailwind, and the pay seems worthwhile for the amount of work involved. However, this would be my first project for someone I don't know personally, so I'm unsure how to handle the business and legal side.
They may need a contact form, possibly through a third-party service such as Formspree. I would prefer for the client to create and own that account so I'm not responsible if the service has problems. I'm also wondering who should provide the site's privacy policy, terms and conditions, and other legal content. My plan is to deliver the website files, with the client hosting the site themselves.
I don't have an LLC or other formal business entity, but I'm considering a written contract that clearly defines the deliverables, includes an approval process, and limits my liability to the project fee. What should I include in the agreement, and are there any other precautions I should take as a freelance web developer in Canada?
3 Answers
It’s reasonable to take the project, but treat it like a real client engagement rather than an informal favor. Use a written agreement that describes exactly what you’re delivering, the timeline, payment schedule, number of revisions, and when the work is considered accepted. Ask for a deposit before starting and make it clear that the client owns and controls their hosting and third-party service accounts.
You should also exclude responsibility for outages or changes made by services such as Formspree or the hosting provider. A liability cap can be useful, but have a local lawyer review the contract if the project or potential risk is significant. You don’t necessarily need a corporation to sign a contract, but you still have personal legal and tax responsibilities as a sole proprietor.
For a simple informational site, the privacy and legal requirements depend on what the site actually does. A contact form, analytics, cookies, hosting logs, and embedded services can all involve personal information, even if the site is otherwise just static HTML. Don’t promise that the site needs no privacy notice merely because it has no database.
The client should provide or approve the privacy policy, terms, and other business-specific legal text. You can implement the pages and connect a policy-generation service if they choose one, but they should create the account, pay for it, and remain responsible for the content. Make that division of responsibility explicit in the contract.
Have the client identify whoever is responsible for privacy compliance and provide the required wording. Your role can be limited to adding the pages and configuring the technical pieces they approve.
A straightforward setup would be static HTML, CSS, and JavaScript hosted in the client’s own Cloudflare account. Give them clear deliverables and acceptance criteria, such as the pages included, responsive behavior, browser support, form functionality, and what counts as a bug versus a new feature. Once they approve the work and receive the files, ongoing maintenance should be covered by a separate agreement.
Also distinguish between building the site’s structure and creating its content. If the client supplies the text, images, and business claims, say that they are responsible for having the rights to use them and for ensuring they’re accurate and lawful. Content writing or legal compliance should be a separate paid service, not an assumption.