try by outlining a proper contract with them, get some legal input and ask a lawyer to look it over. if the lawyer is worth their salt, they should be able to give better advice than I can.
Although it got me thinking, what's the worst thing that can happen if I have no contract at all?
To some degree, that means your contract doesn't matter, and if it doesn't matter, you don't really need it. But --- a contract sets expectations, and generally, reasonable people will follow reasonable contract provisions when they're written down.
Your lawyer and theirs will have a lot of stuff that's important to say in a contract for legal reasons, but you also want to define the scope, define the service level, define payment terms and cancelation terms. Even if you and they know that nobody will be held to the terms, you can feel OK about turning off their service (which may include deleting their data) if they don't pay after N days, if you said that would happen in the contract, and there's no extenuating circumstance.
You don't need a huge contract in legalese. Just 2 sentences will do. Something dumb like "I will give you this, and in return you will give me $300. Once you stop giving me $300, I will stop giving you this."
But yeah, lawyers give better advice and lawyers are often cheaper than programmers.