If Internet Businesses need City Business Licenses Say you have registered a cloud technology business with the state you live in to obtain your Business Entity Number, and you have also obtained your EIN tax number. It seems that the next step is to obtain a Business License in the city you are living in. But I can't tell if that's actually necessary, since the cloud is inherently everywhere. For example: If you are planning on starting a business located in the City of Foo or conducting business within the City's limits, you must first complete a business license application. This makes sense if you have a storefront or building where customers come within the city. But I am not sure about if you have an internet business. Since internet businesses are potentially mobile, the idea of "doing business" is unclear. The actual doing of business, where a transaction occurs (i.e. a customer buys something) likely occurs in the cloud, in some remote Amazon server perhaps. You might do some administrative work at a coffee shop here or there, etc. So I'm wondering if you need to obtain a city business tax license at all, or if so, in which cities the license must be obtained. I don't imagine you would need a license in every city you would sell to, as that would be a lot of work. At the same time, you could be a traveling entrepreneur living in a motor home traveling all across the states. Wondering if in that case, too, you would need to register in each city. But for the more simple case, of just working from coffee shops or coworking spaces within a single city (or within a few nearby cities), wondering what the consensus is on if you need to obtain a city business tax license, or what exactly you need to obtain other than the state entity ID. For clarification, let's say the business does one or all of the following: Sells physical goods online. Sells cloud goods (like data storage space, or compute power). Has a subscription service for digital products in the cloud. Does research. Business A does 1, 2, and 3. Business B does only 2 and 3. Business C does only 4. That is, it doesn't sell any products, just does internal research. In all cases, there won't be any customers visiting any place physically.
For business A, the place where the person sits who transmits the orders to ship the goods to the customer, the place where the person sits who transmits the orders to authorize customers to access their newly purchased cloud goods, and the place where the person sits who authorizes customer subscriptions are all places where A does business. If any of these are done by an automated script, then the place where the person sits who starts and stops that script, and potentially troubleshoots it, is a place where it does business. For D, if it does not sell any of this research, then it does not do business. if it does, then the place where the person (or people) who do the research do it is a place where it does business, and so also is the place where the person sits who takes orders for the research, or runs the script which does this. If any of these are multiple variable places, such as cofeeshops with wifi, but they are all within the city Foo, then the company does business within Foo. The Foo City Clerk can probably say how the form should be filled out in such a case. This is assuming that Foo has an ordinance requiring a Business License, not all localities have such a requirement. Or the requirement may differ depending on the type of business, all this varies widely depending on the location/jurisdiction. But the business is done where a human does it, not in the cloud, even if the human uses cloud tools to do business. A human must be at some physical location at any given time.
In Germany, there is no concept that corresponds directly to public domain. You automatically hold the Urheberrecht (~ copyright) for all creative works that you make, and it can't be given up or transferred (§29 UrhG). The work only enters the Gemeinfreiheit (~public domain) 70 years after your death. You can however license Verwertungsrechte (economic usage rights). When you make creative works in the course of employment (see §43 UrhG), your employer automatically gets the Verwertungsrechte necessary in the context for the work, which is typically an exclusive right (no one else, not even you, can use the work). Your are not in an employment relationship with your school, so it has no rights to your works and cannot prevent you from publishing them on copyright grounds. When you see advice on the internet to check with your school first, that is U.S.-specific advice. Since you're still a minor (7–17), you only have limited capacity to enter contracts or legal transactions (bedingte Geschäftsfähigkeit). While you are able to make transactions involving your own means (e.g. buying something with your pocket money) or make transactions that are only to your benefit (such as accepting a gift), other transactions are schwebend unwirksam (~ pending ratification), until your parents agree. The relevant law is in §107 and §108 BGB. This is a problem with open source licenses. If you publish software under a license, this license is schwebend unwirksam. Someone might start using the software under the license. But then if your parents refuse ratification, the license would be invalid, and everyone would have to stop using your software and destroy any derivative works they made. This is a bit of a problem, especially since open source licenses are otherwise assumed to be irrevocable. So if you want to offer a license (including open source licenses), please give legal certainty to the recipients of the license and ask your parents for their consent first, possibly even in writing. Per §107 BGB, the license you offer with their consent will be valid.
A reasonable person might well believe that your enterprise is being sponsored by or is affiliated with Amazon, and so you would be infringing Amazon's trademark. Even if there is no reasonable confusion, Amazon might well think otherwise and take legal action against you. You don't want to start a business by defending a lawsuit, even if you win, particularly not a suit from your supplier. Why not choose a different name, particularly as that would make it easier to expand into non-amazon cards later? Something like 'Buy Better gift cards' or 'Gift Card World' might be a better choice. In general, you may not use a firm or product name that would cause reasonable consumers to confuse you with the trademark holder, or to think that you are endorsed by, affiliated with, or sponsored by the trademark holder without permission (which you are not likely to get).
You're not going to find an OSI-approved or FSF-approved license that meets your needs because these licenses comply with the OSI definition or FSF definition of open-source software, and your requirements don't. Looking at your requirements, it looks like you want a license where users can modify the software and use it for private use, but cannot use it for commercial use. I ran a search on TL;DR Legal to see what licenses match. There are some one-off licenses that appear to be written by individuals or groups or written by companies that explicitly call out a particular software package. One appears to be a modification of the Apache License. I wouldn't recommend simply using one of these without not only reading them thoroughly yourself, but also consulting a lawyer - just because they started with a license that is trusted doesn't mean that a change they made didn't cause problems if it were to be challenged. For a project hosted on GitHub, it doesn't need to be open-source. You can upload a project that is all rights reserved, but by using GitHub, you do need to allow others to view and fork your repository. However, I wouldn't expect many outside contributors. Why should I give you my hard work if you're just going to turn around and make money on it? That's essentially free labor. I'm not aware of any listing of vetted licenses that are designed for commercial use of software, like how the OSI and FSF maintain lists of licenses. There is a Binpress license generator, but again, it's not a vetted license. How much stake you put into license generator or some random license you find on the Internet is up to you and the level of risk that you find acceptable. If you want to make money on your open-source software, you may want to rethink your approach. In my experience, I've usually seen dual licensing achieve this. One license is a custom written commercial license while the other is a very strong copyleft license, like GPL or AGPL (depending on how you intend your software to be used), which forces companies to also open-source their software if they use yours. It doesn't explicitly prevent commercial usage, but many companies will either look for an alternative that has a more permissive license or purchase the commercial license to prevent their software from being required to be open-source as well. You may also be interested in questions on Open Source about how to monetize open-source projects. There are options out there - selling support and maintenance or related services or selling additional documentation or examples. Under this model, all of your software is free and open source under any of the well-known open-source software licenses, but you make money supporting users of the software.
There are basically two kinds of things one could do. One could assign or transfer intellectual property rights and contracts related to the app to the entity, or one could license the intellectual property rights to the entity. Generally speaking, in a related party transaction, everything should be in a signed writing, and a notice of the transfer of an intellectual property right that has been registered or filed with a government agency should be provided to the government agency in question. Since there are potentially copyright, patent, trademark, publicity, and contractual rights that might be associated with the app, each aspect which exists should be transferred or licensed, as the case may be. While the forms to do this aren't particular long, the concepts involved and correct terminology are subtle, so this would not be a wise undertaking to attempt on a do it yourself basis.
If you can accurately describe in one license what constitutes the conditions where you wish to let users freely copy the software, and forbid any other uses, then you can also offer a second license that allows specified commercial uses with a second license. Basically, it reduces to being clear (to yourself and to the world) on what you mean by &quot;service&quot;, and what you want to allow vs. prohibit. That SSPL has a section on &quot;Offering the program as a service&quot;, though it does not prohibit it, it just requires the user to make the source code available for free. You could rewrite that section, and then hire a lawyer to give an opinion as to whether your re-write does what you think it does. Pay attention to the fact that you are interested in restrictions on &quot;cloud servers&quot; but the SSPL permissions are broader.
In US law, a trademark application only requires that you are now selling, or intend to sell in the reasonably near future, a product (or service) using the specified name. You don't have to provide an example, or a design, and it does not have to be patented. The applicant might be planning to license someone else's patent, or to market off-the-shelf tech not protected by patent. The applicant might be planning to market tech still under development and not yet ready to be submitted for a patent. I do not know Chinese trademark law, but I suspect it is similar in this regard. I have not heard of any country that requires a patent, a design, or an example of a working product along with a trademark registration. However, there is, in many countries, a requirement that actual sales occur within a limited period after the trademark is granted, and if this does not happen, the trademark registration may be canceled. The time allowed varies.
No, you do not need to show a privacy policy just for running a publicly accessible server, as long as any traffic data such as IP addresses is only used as strictly necessary for providing the service requested by the user. The background here is that while GDPR is a very general law, the ePrivacy directive (ePD) provides more details for telecommunication and information society services, which also includes SSH servers. Per ePD Art 6, traffic data may be used (1) for the purpose of the transmission/service or when the data has been anonymized, (2) for billing purposes, or (3) for marketing or value added services, when the user has given their consent. Information about the processing is only required under ePrivacy for cases (2) and (3), but not for processing that is strictly necessary. Now the tricky question is under what circumstances you can log (failed) log-in attempts or use tools like fail2ban. One argument is that such measures are strictly necessary to ensure the security of the communication, but these measures are evidently not necessary for performing the transmission in the sense of ePD. There are a few ways to resolve this: necessity has to be interpreted more broadly, and security measures are indeed necessary. For example, ePD Art 6(5) mentions fraud detection, without authorizing it explicitly. an IP address is effectively anonymized in the sense of the ePD since you do not realistically have means for linking the IP address to any particular person. This is a fairly weak argument, but could be supported by GDPR Recital 26 which defines anonymous data. Counterpoint: IP addresses are online identifiers which are explicitly included in the definition of personal data in GDPR Art 4(1). an IP address is not just traffic data that falls under the ePD, but also personal data that falls under the GDPR. When the IP address is merely used to make a transmission, it is not processed as personal data and only ePD concerns apply. But when we process it to ban the IP, it is processed as personal data under a legitimate interest. This processing does not fall under any of the categories from ePD Art 6, so that only GDPR concerns apply. These include a requirement to inform the data subject about the processing at the time in accordance with GDPR Art 13, which could be satisfied by displaying a link to a privacy policy in the course of the login process. For a legitimate interest argument, it also depends on the expectations of the typical data subject. Since some security measures such as security logs are normal and should be expected, a legitimate interest argument is likely to be strong. I think this is the correct conclusion, even though the “it's not traffic data, or at least doesn't fall under the ePD” argument is quite weak. It hinges on the assumption that security measures are not “value added services”. This fits the intent of the ePD, but not the actual definition of value added services. In any case, you do not need to ask for consent unless you're required to obtain consent e.g. under ePD Art 6(3) or because your processing of personal data relies on consent as the legal basis per GDPR Art 6. It also has to be noted that ePD has no immediate effect, but has to be implemented by each EU member state in national law. These laws can provide more specific guidance.