Legal pages on a frame you run

Your frame serves a legal page at /#/legal/... in its console. Read this before you serve the frame to anyone but yourself: the pages that describe a provider describe YOU, and the software never fills them in with someone else's details.

Two kinds of page

Page	Owner	What it shows on your frame
Impressum / legal notice, Privacy Policy, Terms of Service, Cookie Policy, Data Processing Addendum, Service Level Notice, Vulnerability Disclosure, Digital Services Act information	you (provider)	Your name, address and contact, and links to the documents you publish. Until you provide them the page says, honestly, that the operator has not published a legal notice yet.
Software License Notice, Legal Changes	the software (software)	The licences (AGPL-3.0-or-later for the server, Apache-2.0 for the SDK), the author, the change history of the texts.
Risk Notice, Evaluation Access Terms, Federation Operator Terms	the network (network)	How the protocol works; the same on every frame, with a note that it is not a statement by you.

The texts of the author's own frames (theprotocol.cloud) are written for a provider established in Germany under German and EU law. They are published as an example in the source repository; they are not yours, and your frame never renders them as yours.

What to configure

Add these lines to your frame's env file (the kit's frame-up.py --legal-env FILE appends them and recreates the registry once):

LEGAL_SUITE_MODE=operator                     # the default; never set "theprotocol" on a frame you run
LEGAL_PROVIDER_LEGAL_NAME=Your Company Ltd     # the natural or legal person behind the frame
LEGAL_PROVIDER_LEGAL_FORM=limited company      # e.g. "sole proprietor", "GmbH"
LEGAL_PROVIDER_TRADING_AS=Your Frame           # the name you trade under, when it differs
LEGAL_PROVIDER_STREET=1 Example Road
LEGAL_PROVIDER_POSTAL_CODE=12345
LEGAL_PROVIDER_CITY=Exampletown
LEGAL_PROVIDER_COUNTRY=Examplia
LEGAL_PROVIDER_COUNTRY_CODE=EX                 # ISO 3166-1 alpha-2
LEGAL_CONTACT_EMAIL=legal@your.example         # the contact of your legal notice
LEGAL_PRIVACY_EMAIL=privacy@your.example       # data protection requests
LEGAL_SUPPORT_EMAIL=support@your.example
LEGAL_SECURITY_EMAIL=security@your.example     # published in /.well-known/security.txt
LEGAL_SUPERVISORY_AUTHORITY=Data Protection Authority of Examplia, 2 Example Square, Exampletown   # one line
LEGAL_GOVERNING_LAW=Examplia
LEGAL_VENUE=Exampletown, Examplia
LEGAL_BUSINESS_DAYS=Monday to Friday, public holidays of Exampletown excluded
LEGAL_VAT_ID=EX123456789                       # or LEGAL_SMALL_BUSINESS=true (see "Tax lines" below)
LEGAL_EDITORIAL_PERSON=Jane Doe                # the person responsible for editorial content; defaults to the legal name
LEGAL_TERMS_URL=https://your.example/terms     # links to the documents you publish
LEGAL_PRIVACY_URL=https://your.example/privacy
LEGAL_SECURITY_POLICY_URL=https://your.example/security

Every field is optional; a missing one leaves a gap, never a default. The frame's legal page names you from the first block (name, legal form, address, contact) and links the three documents; GET /api/v1/legal/config publishes the whole set so your own texts, or a template you render from them, can read the rest (supervisory authority, governing law, venue, business days, tax line, editorial person). The same facts reach the email footer of every mail the frame sends, the contact and termsOfService fields of its API documentation, and security.txt. With no security contact at all the frame serves no security.txt rather than someone else's.

Tax lines

LEGAL_VAT_ID is your VAT identification number. LEGAL_SMALL_BUSINESS=true says instead that you are a small business under § 19 UStG and charge no VAT; where the frame issues a receipt, the receipt then says so. Both are German rules; if neither applies to you, set neither, and the line is simply absent.

What you accept, and what you do not become

Federating with the network means accepting the Federation Operator Terms: the console asks for that acceptance when you apply (an operator application or a frame request) and again at activation, and records it. When the author republishes the texts, your account on the frame you applied through is asked again at your next login for the documents that changed. Two things the terms make explicit: you act in your own name and for your own account (§ 4.10, "No agency"), so nothing makes you the author's agent or representative, or the author a party to the contracts between you and your users; and you may say that your registry participates in TheProtocol federation, but must not present it as run by the author or use the author's name and marks as if it were (§ 4.8). The Operator Terms are one of the network pages your frame renders, with the note that they are not a statement by you.

What the law asks of you

That depends on where you are established and whom you serve. In the EU, at least: a legal notice naming you, a privacy policy that names what your frame processes and with whom (your frame talks to the registries it federates with, and to the geocoding and mail services you configure), and, because your users publish content, the points of contact and the notice procedure of the Digital Services Act. A frame that sells credits for money is a very different matter; the software ships that lane off and the author's Terms explain why.

Test-verified

frame-sandbox.py stands up a sandbox of your frame; open /#/legal/imprint there and read what a stranger would read. The export gate of the kit refuses to ship any personal detail of the author, and your own gate should refuse to serve a frame whose legal page still says "not published yet".