Hacker News new | past | comments | ask | show | jobs | submit login
Ask HN: What is legally required to run a small service-based web application?
77 points by IgorPartola on Feb 2, 2011 | hide | past | favorite | 58 comments
I am gearing up for releasing a web application, targeted at a small audience where I'd like to sell monthly/yearly subscriptions. I am wondering what kind of a legal structure do I need to have in place in order to do this properly. Specifically, I want to (1) limit my liability and (2) make sure that customers trust it enough to sign up. And of course, I'd like for it to not cost an exorbitant amount to set up.

Also, I am deciding between PayPal and Google Checkout for the payment processor. I have little experience with integrating either, and while PayPal is more widespread, Google's documentation seems to be clearer. Any recommendations?

Not sure if this matters, but I am doing all of this as a side-project, and have a full-time job.

Thank you.

EDIT: I am in North Carolina, US. There is nothing about this service that's region specific. Ideally, I'd be able to have international sign-ups. So far, I have had as many hits from Europe + Asia as from the US.




You don't need a legal structure to charge people money. Sole proprietorship is the most common form of business in the United States -- by quite a large margin. For example, BCC is structured as a sole proprietorship: when someone pays me for bingo cards, they're really paying me for bingo cards.

You will probably find that no B2C customer actually cares about the structure of your business, legally. Your website design matters 10,000 times more in terms of trust gained. Your mileage may vary if you sell B2B, particular B2BigFreakingEnterprise.

With regards to liability: your main defense against liability is not your corporate structure or your terms of service. It is not pissing anyone off so bad that they decide to sue you.

You can, if you choose, get an LLC and create a Terms of Service. These are more to allow you to sleep better at night than insurance against catastrophe: no matter what you do right now, if you get sued, life is going to suck.

You want to sell subscriptions? Paypal Website Payments Pro + Spreedly. You can do it in two hours of coding and about two days or so in time it takes Paypal to review your business. I do not recommend doing yearly subscriptions until you have history: doing so increases your risk profile.

Your main regulatory issue for the typical SaaS app is simple: you owe income taxes on it, both to the US and to North Carolina. Luckily, you will have very good records of sales (because you'll be able to grab them from Paypal). If you want to deduct expenses, make sure to record them and keep proof of them (generally, receipts work fine -- for e-receipts, print to PDF and put it in your Dropbox so that you don't lose it).


You're 100% right from a technical standpoint, but I disagree with your opinion on the liability issues. I know it seems inconceivable when you start your business, but being sued is a possibility for just about anyone. It's entirely possible for your business to be sued because of the actions of an employee, for example. If that happens, and you're a sole proprietor, you are the one being sued.

This might sound like paranoia, but I'm living it, and you're right about another thing. It sucks. We have a corporation, one person in the organization did something none of the other members were aware of, and now we're being sued. The plaintiff even went so far as to try and sue all of the partners personally. Fortunately, the courts set the bar really high for breaching the corporate firewall. Being sued personally is no joke. If someone gets a judgement against you for some exorbitant sum of money, it's hard to resolve. It can follow you around for a long time.

Setting up a corporation is so simple, and so inexpensive that I don't understand why anyone wouldn't do it. I respect the fact that you've built a very successful business entirely on your own, and entirely organically, but operating without a corporation seems like flying trapeze without a net.


So, having looked into this a few times, my personal opinion is that a quickie instafigleaf will wilt like the fig leaf it is under legal scrutiny. Regardless of whether it is a LC or not, my software business has substantially less in assets than a taco truck, and any tortious behavior it carries out is definitionally certain to have been carried out by me personally. My expectation is that a lawsuit means I get held personally liable and that means bankruptcy. I could drop five hundred bucks tomorrow and be BCC LLC, but that does not change my estimate of risk of bankruptcy.

I would certainly get something formal if I had partners, like you did. I sincerely hope it works out for you.


That's a valid point regarding partners and mitigating risk. If you're a one-man company, it's a lot easier to manage the risks, so forming a corporation may be superfluous. I think it depends on your product as well. The chances of being sued while providing a simple product like bingo cards is minimal. If you're providing a service to businesses, you stand a much greater risk of being sued. It's all a balance.

BTW, I'm not suggesting that you should form a corp. Just to be clear on that. I do think this conversation is beneficial for the topic starter though.

I hear the "weak corporations are worthless" argument a lot. I will say that our simple little corporation is holding up really well, and we didn't spend a bunch of money forming it. We did not use one of those insta-corporation sites though. We paid a local attorney, with whom we sat down and met with, to establish our corporation and provide guidelines for maintaining it. It cost us less than $1000.

IMO, the bottom line with litigation is that it comes down to who has a bigger war chest. A weak corporate structure doesn't appear to be the shot that will sink our ship. Being unable to sustain the fight is the top threat.

When the personal lawsuit hit the door, the first thing I did was investigate bankruptcy. It is possible to discharge debt resulting from a judgement, but it depends on your circumstances. I definitely lack the depth of understanding required to explain it fully, but the gist of it is that receiving a discharge for a judgement isn't always as straight forward as something like credit card debt. Anyone engaged in a business with non-trivial risk of legal exposure should understand the implications before dismissing the benefits of having a corporation.


I'm not a lawyer, but I've been lead to believe that in the US at least, if you are the only member of your company (which I believe Patrick is), then no corporate structure is going to to protect you from liability. I think even with only 2 people it's a bit iffy (especially if the other person is your spouse).

If you are by yourself, Sole Proprietor is easier and simpler for taxes and the like. LLC is more complex and may offer NO extra liability protection.


That's not quite true - I'd research that a little more.

As far as taxes, a single member LLC can be classified as a "disregarded entity". In that case, the taxes are treated exactly as they would be for a sole proprietorship. The additional complexity of an LLC is just the state franchise taxes (which are usually quite low or zero at first) and a couple of documents - it's not a big deal.


Well, as I have learned, anyone can sue you at any time. I could file a lawsuit against you right now, and you'd have to answer it in court. I've also learned that there are no absolutes. An LLC/S-Corp/C-Corp does not offer absolute protection, but it's not worthless either. There are "tests" that pass or fail, and that determines your individual liability.

In our case, the impression I have developed is that if you're acting in the course of business, and you're acting in good faith, your corporation stands a good chance of protecting you. If you set up a corporation for the purposes of protecting yourself while screwing people over, your corporation probably will not protect you. The possible number of scenarios is far to broad to express as a "protection/no protection" dichotomy.


As far as simplicity goes, consider this. As a sole proprietor, you must file a Schedule C with the IRS if you intend to take any deductions. Filing a Schedule C also dramatically increases your chances of an audit. Also, when you are audited, the audit covers all of your personal finances. If my corporation is audited, the audit does not automatically extend to my personal finances.

Having a corporation actually simplified my situation, even when I was a one-man consultant shop. I've always maintained separate bank accounts for my businesses, which gives me a clearer picture of my business performance by isolating my personal finances from the picture. I find the required filing to be minimal in contrast to the added clarity.

I can't make the argument that it requires less paperwork, but IMO, it does make the paperwork simpler.


You may also end up with schedule C income anyway if your legal entity provides you with a dividend or other payment outside your regular salary, and you are likely to want to do that anyway because non-salary distributions are not subject to social security taxes - saves you 15%.


You are correct. A legal entity of any type is not going to protect anyone given the typical underfunded HN startup profile.

The great thing about technology/web based businesses is that they don't take much capital to start.

Unfortunately probably the single most important factor in determining whether a legal entity will be respected when it comes to liability is whether the entity has sufficient assets given the character and nature of the business.

So, for a business that is started with say $100K and maintains some assets thereafter, pretty straightforward that shareholders, limited partners, members, etc. will not be personally liable. However, if it starts with $1 and you keep a few hundred to a few thousand in cash or other assets in the business, it's not going to shield you personally. (Of course, you also need to respect all the other formalities, accounting, regular meetings, authorizations to act, etc.)

Probably the best thing about using some type of legal entity is (as you mentioned) is that it makes it easier and provides more clarity to "who owns what" when there is more than one person involved in the company.


I have a stupid question: for a one-person business, how does purchasing an umbrella insurance compare with setting up an LLC? Say an LLC in California costs $800 a year. I think you can buy umbrella insurance covering you up to a few million for less than that. And it seems that it doesn't have the problem you point out...?


Insurance is protection from a defined set of liabilities. A lot of people conflate umbrella insurance with "everything" insurance. It's not. Wells Fargo has a good page [1] on the topic. Insurance isn't a bad idea if you're engaged in a business with specific liabilities.

It gives you a chip to play if you are sued. You can say to the plaintiff, "I have insurance that may allow us to reach a settlement without going to trial." Then you and the plaintiff engage in a settlement negotiation that may or may not be successful. You can further strengthen your position by limiting your liability to your corporation. I can tell you from my experience that you feel much more exposed when it looks like the lawsuit is coming at your personally than you do when it is your business.

[1] - https://www.wellsfargo.com/biz/insurance/property_liability/...


Having been a co-founder of a company that was on the receiving end of IP litigation I can say that I found the whole experience incredibly stressful - I hate to think what it would have been like if it was me personally, rather than the company, being sued.

Fortunately the case was completely groundless - but it still took months of time and quite a bit of money paid to lawyers to make it go away. That's the thing that really sucks about being sued - the chances are that even if you are completely in the right you may well still end up having to spend a chunk of money on lawyers.


Does anyone advise getting insurance to cover these sorts of liability? Would General or Professional Liability or even IP liability insurance cover all the legal costs? I'm thinking that in addition to corporate structure as a way of handling this unknown (but significant) risk.


With regards to liability: your main defense against liability is not your corporate structure or your terms of service. It is not pissing anyone off so bad that they decide to sue you.

I agree that "doing good" is necessary but unfortunately, not sufficient legal protection.

You're overlooking those whose business model is "revenue by lawyer". There are scumbags out there who haven't figured out how to make money legitimately, so they just sue the most likely target. Paying them off is often more cost effective than prevailing in court, regardless of the merits of their case. I know one who kept his small business alive for 3 years with a settlement from a large corporation who just wanted him to go away.

If may not matter now, but once you're big enough, they will find you. Make sure your legal moat is in place ahead of time.


I'd just like to add that there are costs to doing business that you can claim that are well within your right. I'm not a tax or legal specialist but things like servers, shipping costs, and your unpaid time may all be deductible to balance against your revenue.

It's worth it to hire an accountant to make sure your business is crystal clean, and that you're not penalizing yourself unnecessarily.


your unpaid time

Not deductible in the US. It isn't a close question, either.


When talking about time and pay, it's important to remember that if the business has revenue, there better be someone getting paid, for corporations that is.


Thank you for a detailed reply. What do you recommend as a source for the Terms of Service. Is it worthwhile to get it from a lawyer or is there a sort of "industry standard"?


You have permission to rewrite (any of) mine, if you want them. Wordpress also has theirs available under a very permissive license. NOLO presumably has one available in their books.

If you pay a lawyer $1,000 to draft terms of service, your lawyer will have $1,000 more in his pocket than he otherwise would.


IAAL. If you do the self-service route for terms of service, make sure you do your homework. If you do a search/replace on someone else's terms (even those offered under CC or other permissive licenses), make sure you at least run some Google searches on the rationale behind each clause of the terms. There is a HUGE amount of common ground from one site's terms to another's, but you can still get badly burned if you miss something on liability, IP rights, user generated content, etc.

The one area that I recommend you learn about is enforceability of online terms. Make sure you understand concepts like unconscionable terms, conspicuous notice, valid assent, and so on. These are big, ugly words, but the concepts behind them are not difficult to grasp. Every online transaction is a balance between disclosing important terms to users on the one hand, and not being obnoxious about it on the other hand.

Same advise applies to privacy policies, although it's worth noting that those are typically just plain language disclosures of your practices (at least in the U.S.)

Anyway, I'm curious because I'm considering offering review/preparation of website terms and privacy policies as a fixed fee service: what would you say is a fair price for that?

(Obligatory: My comments above aren't intended as legal advice and I don't represent anyone on HN.)


I recently spoke to a lawyer, and the cost of starting a business through him seemed reasonable, until we discussed a privacy policy and terms of service. The cost suddenly doubled, even though he stated that he would be just copying them from a similar site and adjusting them to my site's needs. I realize the importance of these items, but I'm still not willing to pay multiple thousands of dollars for them.


I'd pay $200-400 for the TOS/PP. Maybe more if my business were on the more complex/risky side.


I for one would pay a reasonable fee for such a service. So far, I have found http://www.bennadel.com/coldfusion/privacy-policy-generator.... which does exactly what you said: a search/replace of some generic ToS, but reading it I see that almost none of it applies (e.g.: I would have no users interacting with each other and trading goods/services).


I'm looking for that service. What are your qualifications and how can I contact you?


http://www.linkedin.com/in/solirvine

sol at yusonirvine.com


There are boilerplate documents, but they need to fit your business. Go find a good, efficient lawyer who specializes in this sort of thing and you can get the whole thing done for under a grand or so. LLC, TOS, PP, and any corporate docs you need.

It's not difficult stuff, but if you're going to do it (and I would), do it right.


For a "sole proprietorship", is it necessary to register a company at all for doing what the OP asked (starting a website as a side project), or can he just do it as an individual and just pay taxes on the profits as regular income?

PS> I am thinking of doing something similar to the OP, and not sure if this complicates things, I am on a H1 visa.


There may be local rules which require some form of business registration, but in the US the typical case is that the first -- and only -- time the government hears of the existence of a sole proprietorship is on Schedule C attached to the individual's tax return, which documents its income and expenses, calculates the profits, and tells you what other pieces of paper to copy the profit number onto to figure out how much tax you owe.

Sole propretorship == doing it as an individual.

This is not legal advice: if you're physically in America when doing the work, the IRS probably doesn't care about your citizenship, you owe it money on your sideline income. It may not be, strictly speaking, legal to work for someone other than your employer (yes, including yourself) while you are on a H1. In practice I'd bet you that this is commonly overlooked.


About the H1, you are right, friend of mine lived in San Fransisco on for a couple of year, on an H1 visa, he had a full-time job, and had a small revenue from his website, paid his taxes accordingly, never had a problem. (It's actually the same in Canada, i'm in locked visa, and i do contracting from time to time, never had a problem)


If you operate under a name other than your personal given name, you may need to file for a d/b/a with your state.


* Your city-of-residence probably requires you to file (and pay annually) for a business license, even if you are doing a purely online business.

* If you accept payments in any name besides your own (e.g., a website name), and you don't have an LLC/corporation/partnership, you probably need to apply (and pay) for a DBA (no, not that kind of DBA - a "Doing Business As"). Accepting payments in a name other than your own without this could result in prosecution for fraud.

In my personal IANAL opinion, the LLC (Limited Liability Company) is the best "side projects for profit" option. Relatively simple and inexpensive formation (order of $100 w/o lawyer), limited liability (how limited? courts will tell), no "double taxation" from a corporate structure.

But do your own research beyond asking on forums.

kb


Where abouts in NC are you? I'm in Raleigh, and would be happy to meet up and show you some of how I'm setup. I charge yearly subscriptions for digital content, as well as one-off sales. I use both GC and PP for checking out - no sense in limiting yourself too much, imo. I have sales from around the world, and GC and PP have covered the overwhelming majority of those sales.

EDIT: Ahh... you're in Durham. I've got to be in Durham this afternoon. If you'd like to get together, ping mgkimsal@gmail.com. Also, I'll be at the tripug PHP meeting in Carrboro next Wed evening at 6:30 if you'd care to meet up and review stuff in more detail.

Good luck.


Hey, I live in Durham and I'm incorporated as an S-Corp, which can have some advantages (just don't let tptacek hear you talking about them). I'm friends with your boss at TransLoc too. It would be nice to meet up sometime and talk shop. joshua.pearce at that google mail service.


There's nothing wrong with S-Corps! They're superior in a lot of ways to LLC's. The only things I get ranty about are: (1) not incorporating at all, and (2) using S-Corps to dodge FICA taxes.


I ran two S-Corps for web hosting/design over a 12yr period (in MO and DE), mostly a one man operation with occasional outsourcing. I had the opinions of a couple of accountants and a lawyer and a short class from the local community college sponsored by the SBA before I got things rolling. Their are tax advantages, and you retain a bit of the "corporate veil", but I was fortunate enough never to get sued. Get good advice first.


I'm in the US (Georgia), and the first thing I did to limit liability is to form an LLC (simple overview: http://en.wikipedia.org/wiki/Limited_liability_company)


I realize the laws are different between the two states, but how expensive and time-intensive was the process?


Setting up an LLC in NC is $200 initially, then $200 every April. I didn't quite grok that at first, because I'd filed my LLC paperwork in March, then needed to pay the $200 again in April - should have just waited until May.

Getting an EIN from IRS is free and took about 10 minutes.

Not sure about any local paperwork you'd need to file in NC - I didn't have to file any in Franklin county.


I had an independent accountant do the majority of the work for me for a total of $750. This included virtually all the setup, including verifying the name wasn't taken, filing the paperwork (state and local), all the official docs, getting TaxID, etc.

The process only took a few weeks from start to finish, which was a nice surprise.


In the UK setting up a limited company costs under £100, can be done online and takes a few hours.


Some important factors.. what country are you in? What country are your subscribers in? Can you incorporate in a 3rd country?

Regarding payments, there are nothing but horror stories regarding Paypal, and Google doesn't sound that much better. Look carefully concerning this..it could kill your business


Edited with details. Thank you.


Paypal is a nightmare compared to real merchant accounts. Talking to customer support there is like smashing your hand in a car door.

In the long run you're better off with either Braintree (which is fine all by itself) or Auth.net + Chargify/Spreedly/etc. I would switch to one of those options as soon as you validate the business, as the cost is significant early on.


About the second point you would ask your bank if they offer a payment gateway service, and offer Paypal or Checkout as a second option. When I am going to buy something online I trust more a service which charges me through a recognised bank, it feels safer in case I have a problem.


My personal finances are with a credit union that most people haven't heard of. Any suggestions of a non-horrible bank? Would using such a service mean that I have to be PCI compliant, or does my application never see the credit card number?


Read up on Recurly, Spreedly, and/or Chargify...

and also read this: http://news.ycombinator.com/item?id=2169870


Thanks. These look very promising.


I agree that you should consider creating an S-corp.

I live in Europe and suggest using paypal if you are targeting Europeans. Many Europeans do not have credit cards and need to do bank transfers to pay for things online which is why they use paypal.


I think you mean exorbitant :)


I do indeed. There I go trying to use a fancy word...


Why paypal/google instead of a real payments gateway like authorize.net?


I was under the impression that using something like authorize.net would impose more restrictions on my application (e.g.: require it to be PCI compliant, etc.) and require more work to get going.


I just set up Braintree and it was very easy. Probably not as easy as PayPal + Spreedly, though. If you want to go with a "real" payment gateway, I highly recommend it.

If anything, using Braintree removed all sorts of restrictions. They keep all the credit card information. Let them worry about PCI Compliance, not me.


fwiw, to provide a counterargument, i'm stuck with paypal. i applied to a "real" payment gateway and was denied due to low estimated processing volume.


PayPal and Google have an extra level of trust built in to them from a customer POV.


Really? Perhaps I'm atypical, but PayPal as your payment option always struck me as amateur hour. Not enough to keep me from buying, but it doesn't inspire trust.

If PayPal really enhanced customer trust, I'd expect to see more large retail corporations using it as a payment option.


many people keep money in there and treat it almost as virtual currency. They can just use paypal money to pay, it's secure, etc.

There's a whole class of people who can't get a credit card in the first place, but they can use paypal tied to their bank and move money in.

Paypal is more universal around the world than most other cards. Someone may have a JCB card or a Switch card - my standard merchant account gives me a harder time with those, and charges me a heftier fee, and in some cases I can't take 'overseas'-based cards at all (Solo cards, for example) - but those people in those countries can use PayPal - and they do with me.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: