About a year ago, I completed a simple project for a client on his already existing website: he's actually someone I know (a friend of friends) and we only had a verbal agreement.
It is an automated procedure that store the users data in a database, allows some queries, and creates automated emails with attachments, etc.
I turned over the work ready-to-use. He had to compile text, add attachments, etc. He did that part all alone. I gave only the clean working software and he payed me as required.
A few months ago, he asked me to make some minor changes. I did those, but while using the site, I realised that he is selling courses that are literally copied from other courses and adapted to his needs. There are videos from TV channels, pictures from Google searches, pieces of movies, PDF documents as well as many other resources he likely accessed on the internet.
I told him that he can't sell this material since it amounts to (surely) infringing on copyrighted resources, but his response was "don't worry, all that is publicly visible is original, I took this materials only for teaching purposes and also is sent one-to-one in private email address, so none will find out and also they can't make my emails public because they will break the privacy laws."
There is no written agreement binding us and I don't want to be involved in any legal action.
Is it appropriate that I make him sign an agreement to this effect?
If he were facing any legal action, would it extend to me?