Got a cease-and-desist from a large US website over a tool I sold. Is complying and replying enough?
I'm a solo developer in Quebec. I sell small data and automation tools on an online marketplace, and I have a website that lists them.
A few days ago I got a cease-and-desist by email from the in-house lawyer of a large US website. It's about one of my tools, which pulled business listings from their service for the person running it. The tool ran inside each user's own account with credentials the user supplied, so the results went straight to them. I never received the data or the credentials. It never had a paying customer.
The letter claims breach of their terms of service, scraping and getting around their access controls, copyright in their compilation of content, and trademark infringement because my website used their name and logo in a way that "suggests affiliation". They ask me to confirm in writing within about two weeks that I've stopped and won't resume, to delete any of their data, and to identify anyone I gave their data to. It ends by saying they reserve their legal rights.
I don't want to fight it. So far I've:
- deleted the tool from the marketplace
- removed every mention of the company and its logo from my website, and added a line saying I'm not affiliated with the companies the site names
- kept my own records, but I hold none of their data and there's no one to identify
I plan to reply with a short letter confirming those steps. It says I don't agree with the allegations and don't admit liability, and that I reserve my rights.
My questions:
- Legally, is a written confirmation like this usually enough to resolve a cease-and-desist, or could they still sue me? They're in the US and I'm in Quebec.
- Could a reply like that be used against me later, even with the "no admission of liability" line?
- Is there a legal reason to have a lawyer send the reply instead of sending it myself?
Thanks for any help.