This Enterprise Service Agreement (the “Agreement”) applies to enterprise plans and other subscriptions that are governed by an Order Form. For self-serve plans that are not under an Order Form, see the Consumer Terms of Service.
This is the current version and applies to Order Forms entered into on or after September 3, 2026.
This Agreement governs Customer’s access to and use of the XOXO Services. “XOXO” means XOXO Systems, Inc., with offices at 801 International Pkwy STE 550143, Flower Mound, TX 75022, USA. “Customer” means the entity identified on the applicable Order Form.
By executing an Order Form that references this Agreement, or by accessing or using the Services under such an Order Form, Customer agrees to this Agreement and the documents incorporated by reference: the Order Form, XOXO’s Privacy Policy, and XOXO’s Data Processing Agreement (“DPA”).
XOXO may update this Agreement and incorporated documents as described in Section 11.7. The current version at each posted URL controls, subject to the notice requirements in that Section.
The person executing this Agreement or the Order Form represents that they have authority to bind Customer. If Customer does not agree, Customer must not access or use the Services.
1. Services
1.1 License. Subject to this Agreement and payment of any applicable Fees, XOXO grants Customer a limited, non-exclusive, non-transferable (except under Section 11.4), non-sublicensable, worldwide right for its Authorized Users to access and use the Services during the Term, whether directly or through APIs, Model Context Protocol (“MCP”) interfaces, automated tools, or integrations, solely for Customer’s internal business purposes and subject to the commercial terms and Plan Limits in the Order Form, any product-specific terms, and Section 4.
Each Authorized User must have a unique account. Credentials may not be shared. Customer is responsible for all access and use of the Services through Customer’s accounts, including use by agents, scripts, MCP clients, and other automated systems Customer authorizes. Customer’s administrators may place orders, enable features, connect systems, and modify subscriptions through the Services, and those actions bind Customer.
1.2 What the Services include. The Services are the software products and solutions XOXO makes available under the Order Form. They may include data integration, telemetry, analytics, decision-support tools, MCP servers and clients, APIs, agentic workflow and agent deployment features, related hosted software, and Documentation. The Services are designed to help Customer unify data, improve operational workflows, make data-driven decisions, and build and run agentic workflows. Each product has its own commercial model and Plan Limits. Product-specific terms, if any, control that product’s fees, plan structure, metering, and retention to the extent they conflict with this Agreement, except where the Order Form expressly provides otherwise.
1.3 Restrictions. Customer will not, and will not permit Authorized Users to: (i) reverse engineer, decompile, disassemble, or attempt to derive source code, model weights, or underlying components of the Services, except to the extent applicable law prohibits this restriction; (ii) copy, modify, frame, mirror, or create derivative works of the Services except as the Services expressly permit; (iii) sell, resell, rent, lease, sublicense, or provide the Services to a third party, or use them for the benefit of a third party, except through APIs, MCPs, or integrations authorized in the Order Form or Documentation; (iv) use the Services or any Outputs or interactions to build a competing product or to train or develop a competing AI or machine learning model; (v) use the Services for benchmarking or competitive analysis, or to monitor availability or performance, except for Customer’s internal capacity planning; (vi) scrape or systematically extract data from the Services except through documented APIs or MCPs provided for Customer’s use; (vii) circumvent or disable security measures or Plan Limits, except for good-faith security research disclosed to XOXO under a vulnerability disclosure process XOXO publishes; (viii) transmit malware or interfere with the Services; (ix) remove proprietary notices; or (x) use the Services in violation of law or this Agreement.
XOXO may suspend access upon written notice if it reasonably determines that Customer or an Authorized User has violated this Section or Section 1.10. Prior notice is not required where immediate suspension is reasonably necessary to prevent harm to the Services, other customers, or third parties, or to comply with law. XOXO will restore access promptly after the condition is cured, where curable.
1.4 Support. XOXO will provide Support as specified in the Order Form.
1.5 Technical requirements; Connected Systems. Customer is solely responsible for Customer Systems and Third-Party Services used with the Services, including databases, warehouses, SaaS platforms, MCP servers, and other integrations. XOXO disclaims warranties relating to Customer Systems and Third-Party Services.
Customer controls whether and how Customer Systems connect to the Services. By connecting a Customer System, Customer instructs XOXO to access and interoperate with that system solely to provide and support the Services. Customer is responsible for ensuring that those connections comply with all terms applicable to the Customer System.
1.6 Changes and regulatory compliance. Customer acknowledges that the regulatory environment for artificial intelligence, data integrations, and automated agents is evolving. XOXO may update, modify, or discontinue features, including models, algorithms, third-party providers, MCP interfaces, and infrastructure, and may restrict features in specific jurisdictions to comply with law. XOXO will use commercially reasonable efforts to notify Customer of material changes. No such change is a breach or a material reduction of the Services by itself, provided the core functionality described in the Documentation remains materially available.
If XOXO materially reduces the core functionality of a paid Service, Customer may terminate the affected Order Form by written notice within thirty (30) days of XOXO’s notice, and XOXO will refund prepaid Fees for the unused remainder of the then-current Term for the affected Service.
1.7 Usage Data. XOXO may collect and analyze data relating to access, use, and performance of the Services (“Usage Data”), including technical logs, metadata, telemetry, authentication data, device and connection information, administrative settings, and usage patterns related to Customer Data (such as how frequently it is accessed). Usage Data excludes Customer Data itself. As between the parties, XOXO owns Usage Data. XOXO may use Usage Data in de-identified and aggregated form, during and after the Term, to maintain, improve, and enhance XOXO’s products and to develop new offerings. Usage Data will not be combined or re-identified in a way that would reveal Customer Data or identify Customer or its Authorized Users. XOXO may make Usage Data publicly available if it does not identify Customer or Authorized Users. XOXO will not sell Usage Data to data brokers or use it for third-party advertising.
1.8 AI data practices. Neither XOXO nor its AI providers will use Customer Data to train, improve, or develop generally available AI models or services. This does not restrict processing Customer Data to provide the Services to Customer, including generating Outputs and performing Actions, or a provider’s processing for safety, security, or legal compliance as described in the Privacy Policy and DPA.
XOXO may use Customer Data to create and maintain models, prompts, or agent configurations solely for Customer’s use (“Customer Models”). Customer Models will not be made available to other customers, and XOXO will not incorporate Customer Data into models or services available to third parties. Customer retains rights in the underlying Customer Data. XOXO retains rights in the algorithms, tooling, and methodologies used to create Customer Models. XOXO will delete Customer Models upon termination or expiration in accordance with Section 8.5. Customer may opt out of Customer Models by thirty (30) days’ written notice to legal@xoxo.systems or through Service settings if offered.
1.9 AI Services and agents. The Services may incorporate artificial intelligence, machine learning, third-party models, automated agents, and MCP-based tools (collectively, “AI Services”). Customer’s administrators may enable or disable AI Services through Service settings where that control is offered. Use of AI Services involves sharing Customer Data with subprocessors and model providers to generate Outputs and perform Actions. Customer authorizes that sharing, which is further described in the Privacy Policy and DPA.
XOXO’s agreements with AI providers will require them to maintain confidentiality of Customer Data and to comply with Section 1.8. XOXO is not liable for unavailability, errors, or degraded performance of AI Services caused by third-party providers.
If Customer uses its own account or API keys with a third-party AI provider (“Customer-Managed Account”), Customer’s relationship with that provider is solely between Customer and the provider. Customer is responsible for activity, fees, and compliance under the Customer-Managed Account. XOXO is not responsible for liability arising from Customer’s failure to comply with that account’s terms.
1.10 Customer responsibilities.
(a) Customer is responsible for reviewing Outputs for accuracy and appropriateness before use. XOXO does not guarantee that Outputs will be accurate, complete, or suitable for any purpose.
(b) Where Customer uses automated agents, MCP tools, or workflows, Customer is responsible for configuring permissions, authorizing Actions, and reviewing results, and is responsible for all Actions as if taken by the authorizing Authorized User.
(c) Interactions initiated by automated systems, agents, MCP clients, or programmatic workflows on Customer’s behalf constitute Customer’s use of the Services and count toward Plan Limits. Customer assumes all risk associated with third-party systems, MCP servers, integrations, or agent frameworks that Customer authorizes. XOXO is not liable for loss or damage arising from such access.
(d) AI Services are not a substitute for professional judgment. Customer may not use AI Services where use or failure could lead to death, personal injury, or environmental damage, or to make or materially support consequential decisions about individuals without appropriate human oversight as required by law.
(e) Customer is solely responsible for ensuring that use of agents and MCP connections complies with the terms, policies, and technical requirements of any third-party service, website, or platform accessed on Customer’s behalf. Third parties may restrict, suspend, or prohibit agent or MCP use. Such restrictions may interrupt workflows, and XOXO has no obligation to modify the Services to accommodate those changes.
1.11 Third-Party Services. The Services integrate with Third-Party Services. Customer is responsible for enabling and configuring each integration. XOXO may share or receive Customer Data through those integrations to provide the Services. Third-Party Services are not under XOXO’s control, and Customer’s use of them is governed by Customer’s agreement with the provider.
1.12 Previews. XOXO may make available products or features not yet generally available (“Previews”), whether labeled beta, alpha, pilot, preview, experimental, or similar. Previews are provided “as is,” are not intended for production use unless the Order Form says otherwise, and may be modified, discontinued, or never made generally available. Previews are excluded from the warranty in Section 5.1 and from any service level commitments. XOXO has no liability arising from a Preview’s features, availability, or performance. Once generally released, continued use may require additional Fees and will be subject to the Plan Limits for that product. XOXO’s security, confidentiality, and Customer Data obligations continue to apply to Previews.
2. Ownership
2.1 Intellectual property. XOXO retains all right, title, and interest, including Intellectual Property Rights, in and to the XOXO Properties. Customer retains all right, title, and interest in and to Customer Data, including Inputs and Outputs created by Customer or Authorized Users using the Services. Customer’s ownership of Outputs does not extend to the XOXO Properties, including models, algorithms, prompts, templates, MCP interfaces, or other components used to generate Outputs.
To the extent XOXO has any right, title, or interest in Outputs, XOXO hereby assigns those rights to Customer. XOXO makes no representation that any Output is eligible for copyright or other intellectual property protection. Due to the nature of AI Services, Outputs may not be unique, and other customers may receive similar output. XOXO’s assignment does not extend to other customers’ output or to Third-Party Services content.
Customer may not remove, alter, or obscure proprietary rights notices on the XOXO Properties.
2.2 No implied licenses. Except for rights expressly granted, no license is granted by implication or otherwise.
2.3 Feedback. Customer may voluntarily provide suggestions or other feedback (“Feedback”). Customer grants XOXO an irrevocable, perpetual, worldwide, royalty-free, sublicensable, transferable license to use Feedback for any purpose, including to improve XOXO’s products, without payment. XOXO will not identify Customer as the source of Feedback. Feedback does not include Customer Data and is provided AS IS.
2.4 License to Customer Data. Customer grants XOXO a non-exclusive, worldwide, royalty-free, transferable, sublicensable license to extract, process, display, copy, store, transmit, modify, and otherwise use Customer Data solely to provide, maintain, and support the Services for Customer, subject to Section 1.8, the Privacy Policy, and the DPA. XOXO may sublicense this right to subprocessors as necessary to provide the Services.
3. Fees and payment
3.1 Payment terms. Except as set forth in an Order Form, Fees are due thirty (30) days after Customer’s receipt of an undisputed invoice. Customer will provide accurate billing and contact information. All Fees are non-refundable and non-cancellable except as otherwise stated in this Agreement.
3.2 Renewal Fees. XOXO may modify Fees for a renewal upon at least sixty (60) days’ written notice before expiration of the then-current Term.
3.3 Usage, subscriptions, and true-up. Commercial models vary by product and may include a committed subscription, usage-based or pay-as-you-go billing, prepaid credits, overage charges, or a combination of those, as set out in the Order Form or product-specific terms. Except as provided in the Order Form: (i) committed quantities and Plan Limits apply for the Term stated; (ii) additional quantities added during a Term are at the then-current Order Form pricing, co-term, and prorated; and (iii) usage-based Fees are invoiced as specified in the Order Form. If actual usage exceeds the Plan Limits in the Order Form (determined monthly unless the Order Form says otherwise), XOXO will notify Customer and may invoice overage, throttle or suspend the affected features, or require an upgrade, as specified in the Order Form. Usage by automated systems, agents, and MCP workflows counts the same as Authorized User usage.
3.4 Disputed invoices. Customer may withhold only the specific amounts it disputes in good faith if, within the invoice payment period, Customer notifies XOXO of the dispute, states the reasons, and provides reasonable supporting documentation. Customer must pay undisputed amounts. The parties will work to resolve disputes promptly. Amounts determined to be payable are due within thirty (30) days of that determination.
3.5 Interest and collection. Undisputed Fees not paid when due bear interest at 1.5% per month, or the maximum rate allowed by law if lower. XOXO may recover reasonable costs of collecting undisputed overdue Fees, including reasonable attorneys’ fees.
3.6 Resellers. If Customer purchases through an authorized reseller or pays through a payment processor, Customer’s payment relationship with that party is governed by Customer’s agreement with them. XOXO may disclose information about Customer, this Agreement, or the Order Form to that reseller or processor as needed to bill and support the Services.
3.7 Taxes. Fees are exclusive of Taxes. Customer is responsible for all Taxes arising out of this Agreement, excluding taxes based on XOXO’s net income. If Customer is required to withhold Taxes, Customer will gross up payments so that XOXO receives the amount it would have received without withholding, unless XOXO provides a valid exemption or reduced-rate documentation.
3.8 Evaluations. Any trial or other evaluation is limited to the features and duration XOXO communicates, may be used only to evaluate the Services, and does not auto-renew. Access ends when the evaluation ends unless Customer purchases the Services.
4. Product plans, limits, and retention
4.1 Product-specific commercial terms. Each XOXO product and solution has its own commercial model. A product may be offered as a committed subscription, usage-based or pay-as-you-go service, prepaid credits, a free or evaluation tier, a combination of those, or another structure disclosed in the Order Form, product pricing, Documentation, or product-specific terms. Fees, included usage, Plan Limits, billing cadence, and retention are determined at the product level. If a product publishes its own terms of service, those terms control that product’s fees, plan structure, metering, and retention to the extent they conflict with this Section 4, except where the Order Form expressly provides otherwise.
4.2 Plan Limits. “Plan Limits” means the caps, quotas, and metering that apply to Customer’s use of a product, as set out in the Order Form or, if the Order Form is silent, in the applicable product pricing, Documentation, or product-specific terms. Depending on the product and plan, Plan Limits may include data consumption, rate limits, AI or compute credits, storage, retention periods, seats, API or MCP calls, aggregated data volume, or other limits. Plan Limits vary from product to product. The Order Form and the limits disclosed for the purchased product control.
4.3 Retention. Retention periods, including for logs, telemetry, and stored files, are product-specific Plan Limits. After the applicable retention period, XOXO may delete that data. XOXO is not an archival provider. Customer is responsible for exporting data it needs to retain.
4.4 Changes to Plan Limits. XOXO may change generally available Plan Limits or consumption rates with reasonable notice, effective only prospectively, except that committed Plan Limits stated in an Order Form with a fixed Term of twelve (12) months or longer will not be reduced during that Term without Customer’s consent.
5. Warranty and liability
5.1 Limited warranty. XOXO warrants that during the Term the Services will conform in all material respects to the Documentation, and that XOXO will not materially decrease the overall security or overall functionality of the Services. This warranty does not apply to the extent a nonconformity results from (a) modification by anyone other than XOXO, (b) use with Customer Systems not recommended in the Documentation, or (c) use not in conformance with the Documentation. This warranty does not apply to evaluations or Previews and does not extend to the accuracy or completeness of Documentation, Outputs, or Customer Data.
5.2 Mutual representations. Each party represents that it has validly entered into this Agreement and has the legal power to do so. Customer further represents that it has all rights and permissions required to submit Inputs, connect Customer Systems, and instruct XOXO to process Customer Data and perform Actions.
5.3 Remedy. If the Services do not conform to Section 5.1, XOXO will, as its sole obligation and Customer’s exclusive remedy, at XOXO’s election: (i) use commercially reasonable efforts to correct the nonconformity if XOXO can recreate it; (ii) replace the nonconforming Service; or (iii) if neither is commercially feasible, terminate the Order Form for the affected Service and refund prepaid Fees for the remaining Term of that Service. Customer must notify XOXO in writing within thirty (30) days of identifying a nonconformity, with a reasonably specific description.
5.4 Disclaimer. EXCEPT AS PROVIDED IN SECTION 5.1, THE XOXO PROPERTIES, AI SERVICES, MCP INTERFACES, OUTPUTS, AND ACTIONS ARE PROVIDED “AS IS” AND “AS AVAILABLE.” XOXO DISCLAIMS ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING NON-INFRINGEMENT, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE. XOXO DOES NOT WARRANT THAT THE SERVICES OR AI SERVICES WILL BE ERROR-FREE, UNINTERRUPTED, OR MEET CUSTOMER’S REQUIREMENTS. AI SERVICES MAY PRODUCE INACCURATE OUTPUTS, INCLUDING HALLUCINATIONS. XOXO MAKES NO WARRANTY REGARDING THE ACCURACY OF ANY OUTPUT OR TELEMETRY. CUSTOMER IS RESPONSIBLE FOR VERIFYING OUTPUTS AND ACTIONS BEFORE USE. CUSTOMER ASSUMES ALL RISK IN CONNECTION WITH ITS USE OF AND RELIANCE ON THE XOXO PROPERTIES, AI SERVICES, THIRD-PARTY SERVICES, CONNECTED SYSTEMS, OUTPUTS, AND ACTIONS. XOXO HAS NO LIABILITY FOR LOSS CAUSED BY UNAVAILABILITY, INCOMPLETENESS, OR INACCURACY OF CUSTOMER DATA, OR BY DELETION OF DATA IN ACCORDANCE WITH PLAN LIMITS (INCLUDING LOG RETENTION). AUTOMATED AGENTS ARE SOFTWARE AND NOT INDEPENDENT LEGAL ENTITIES THAT CAN BIND, OR OWE DUTIES TO, CUSTOMER OR AUTHORIZED USERS.
5.5 Limitation of liability.
5.5.1 OTHER THAN DAMAGES INCURRED OR PAID TO A THIRD PARTY THAT ARE COVERED BY A PARTY’S INDEMNIFICATION OBLIGATIONS, OR THAT ARISE FROM CUSTOMER’S BREACH OF SECTION 1.3, NEITHER PARTY WILL BE LIABLE FOR INCIDENTAL, SPECIAL, PUNITIVE, EXEMPLARY, CONSEQUENTIAL, OR INDIRECT DAMAGES, LOSS OF REVENUES OR PROFITS, LOSS OF DATA, OR COST OF COVER, WHETHER OR NOT ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
5.5.2 EXCEPT FOR (A) CUSTOMER’S UNDISPUTED PAYMENT OBLIGATIONS, (B) CUSTOMER’S BREACH OF SECTION 1.3, (C) A PARTY’S INFRINGEMENT OR MISAPPROPRIATION OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS, (D) A PARTY’S INDEMNIFICATION OBLIGATIONS UNDER SECTION 6, AND (E) LIABILITY FOR GROSS NEGLIGENCE, WILLFUL MISCONDUCT, OR DEATH OR BODILY INJURY TO THE EXTENT SUCH LIMITATION IS PROHIBITED BY LAW, EACH PARTY’S TOTAL LIABILITY FOR CLAIMS ARISING OUT OF THIS AGREEMENT WILL NOT EXCEED THE FEES ACTUALLY PAID OR PAYABLE BY CUSTOMER FOR THE SERVICES THAT ARE THE SUBJECT OF THE CLAIM DURING THE TWELVE (12) MONTHS PRECEDING THE INITIAL INCIDENT GIVING RISE TO LIABILITY (THE “GENERAL LIABILITY CAP”). THIS LIMITATION APPLIES REGARDLESS OF THE FORM OF ACTION AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.
5.5.3 FOR CLAIMS ARISING OUT OF A Data Breach OR UNDER THE DPA, XOXO’S TOTAL LIABILITY TO CUSTOMER AND ITS AFFILIATES IN THE AGGREGATE WILL NOT EXCEED TWO TIMES (2×) THE FEES ACTUALLY PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM DURING THE TWELVE (12) MONTHS PRECEDING THE INITIAL INCIDENT (THE “DATA BREACH CLAIMS CAP”). XOXO WILL NOT BE LIABLE FOR THE SAME EVENT UNDER BOTH THE GENERAL LIABILITY CAP AND THE DATA BREACH CLAIMS CAP. THE CAPS ARE NOT CUMULATIVE; IF CLAIMS ARE SUBJECT TO EACH CAP, MAXIMUM TOTAL LIABILITY WILL NOT EXCEED THE DATA BREACH CLAIMS CAP.
6. Indemnity
6.1 Indemnity of Customer. Subject to Section 6.1.2, XOXO will defend Customer and its directors, employees, and agents against any third-party claim alleging that Customer’s authorized use of the Services infringes that third party’s Intellectual Property Rights enforceable in a jurisdiction where Customer is authorized to use the Services (a “Claim Against Customer”), and will indemnify Customer from damages, losses, and reasonable attorneys’ fees finally awarded, or paid in a XOXO-approved settlement, provided Customer (i) gives prompt written notice, (ii) gives XOXO sole control of defense and settlement, and (iii) provides reasonable assistance. Customer may participate with its own counsel at its expense.
6.1.2 XOXO’s obligations do not apply to the extent Customer settles or admits liability without XOXO’s prior written consent, or the claim arises from: (a) Customer Data or Outputs; (b) Actions taken by automated agents or MCP tools with Customer’s authorization; (c) Customer’s material breach; (d) combination of the Services with software, hardware, or systems not provided by XOXO; (e) compliance with Customer requirements outside the Documentation; or (f) a matter covered by Customer’s indemnity.
6.1.3 If a Claim Against Customer has occurred or is likely, XOXO may, at no cost to Customer: (i) modify the Services so they are non-infringing without breaching Section 5.1; (ii) obtain a license for Customer’s continued use; or (iii) if those remedies are not reasonably available, terminate the affected Order Form and refund prepaid Fees for the remaining Term.
6.1.4 This Section 6.1 is XOXO’s sole liability and Customer’s exclusive remedy for third-party intellectual property infringement claims of the type described.
6.2 Indemnity of XOXO. Customer will defend XOXO and its directors, employees, and agents against any third-party claim arising out of (i) Customer’s or Authorized Users’ violation of this Agreement or law; (ii) Customer Data or Outputs infringing or violating Intellectual Property Rights or privacy rights; (iii) submission of Restricted Data; (iv) use of the Services beyond the license granted; (v) any Customer System; or (vi) any script, agent, MCP server, automated workflow, or third-party integration Customer authorizes (each, a “Claim Against XOXO”), and will indemnify XOXO from damages, losses, and reasonable attorneys’ fees awarded or incurred, or paid in a Customer-approved settlement, provided XOXO (a) gives prompt written notice, (b) gives Customer sole control of defense and settlement, and (c) provides reasonable assistance. XOXO may participate with its own counsel at its expense. Customer will not settle a claim that imposes liability, an admission of fault, or an ongoing obligation on XOXO without XOXO’s prior written consent, not to be unreasonably withheld.
6.3 Process; exclusions. Neither party’s defense or indemnity obligations apply to the extent the claim arises from the indemnified party’s fraud, willful misconduct, or material breach. Failure to provide prompt notice or reasonable cooperation excuses the indemnifying party only to the extent it is materially prejudiced.
7. Confidentiality
7.1 Definition. “Confidential Information” is information a party discloses that is marked confidential, identified as confidential, or that a reasonable person would understand is confidential given its nature or the circumstances. The XOXO Properties are XOXO’s Confidential Information. Customer Data is Customer’s Confidential Information. Personal Data is also protected under Section 8.
Confidential Information does not include information the recipient can show: (a) was rightfully known without restriction before disclosure; (b) is independently developed without use of the discloser’s Confidential Information; (c) is rightfully received from a third party without a confidentiality duty; or (d) is or becomes public through no fault of the recipient.
7.2 Care and use. The recipient will use Confidential Information only to perform under this Agreement, and will protect it with at least reasonable care. The recipient may disclose it to employees, contractors, professional advisors, and, in connection with due diligence, actual or prospective investors or acquirers, who have a need to know and are bound by confidentiality obligations at least as protective as these. The recipient is responsible for those persons. The recipient may disclose Confidential Information if required by law, after giving notice to the discloser if legally permitted, and will disclose only what is required.
These obligations survive for three (3) years after termination, except that trade secrets remain protected for so long as they remain trade secrets.
7.3 Equitable relief. Each party acknowledges that a breach of this Section 7 or of the other party’s Intellectual Property Rights may cause irreparable harm, and that the other party may seek injunctive relief in any court of competent jurisdiction without waiving the dispute-resolution provisions of this Agreement.
8. Protection of Customer Data
8.1 Security. XOXO will implement and maintain commercially reasonable administrative, technical, and physical security measures designed to protect Customer Data. Customer will promptly notify XOXO if it becomes aware of unauthorized access originating from Customer’s environment or credentials, and will cooperate with investigation and response.
8.2 Privacy Policy and DPA. Each party will process Personal Data in accordance with applicable data protection laws, the Privacy Policy, and the DPA, which is incorporated by reference. If XOXO processes Personal Data on Customer’s behalf, the DPA governs that processing. If there is a conflict between this Agreement and the DPA with respect to Personal Data, the DPA controls.
8.3 Access to Customer Data. The Services depend on Customer making Customer Data available through Customer Systems. Customer is solely responsible for obtaining consents, authorizations, and access needed for the Services (and Third-Party Services) to reach that data. XOXO is not liable for failure, delay, or deficiency arising from Customer’s or its providers’ systems, or from errors in Customer Data. Customer is responsible for the accuracy, quality, legality, and appropriateness of Customer Data, and for ensuring Customer Data does not infringe third-party rights, violate law, or contain malware.
8.4 Restricted Data. The Services are not designed for data subject to heightened regulatory regimes (“Restricted Data”), including protected health information under HIPAA, payment card data protected by PCI-DSS, and “nonpublic personal information” under the Gramm-Leach-Bliley Act. Customer will not submit Restricted Data. XOXO does not offer a HIPAA business associate agreement and has no liability under this Agreement for Restricted Data. Customer also assumes all risk if it submits biometric identifiers, precise geolocation, genetic data, data of individuals under 13, or health-related data. XOXO assumes no additional security or compliance obligations for that data beyond Section 8.1, except as the DPA requires for Personal Data.
8.5 Retention and backups. XOXO is not a backup, archival, or records-retention provider. Customer is solely responsible for backing up Customer Data it needs to retain. Retention periods are product-specific Plan Limits as described in Section 4.3. Other than a Data Breach, XOXO has no obligation or liability for loss, alteration, destruction, or recovery of Customer Data, including deletion in accordance with Plan Limits.
8.6 Configuration. Customer is solely responsible for configuring the Services in compliance with Customer’s legal and regulatory obligations. XOXO is not liable for data exposure, non-compliance, or incidents resulting from Customer’s configuration, permissions, agent settings, or MCP tool grants.
9. Term and termination
9.1 Term. This Agreement remains in effect during the Term of any unexpired Order Form, unless terminated earlier. Upon renewal of an Order Form, this Agreement extends accordingly. Order Forms may not be terminated for convenience during the Term unless the Order Form expressly allows it.
9.2 Auto-renewal. Each Order Form automatically renews for successive periods equal to one (1) year or the preceding Term, whichever is shorter, at the prior quantity and Plan Limits (including overages and add-ons then in effect), unless either party gives written notice of non-renewal at least sixty (60) days before expiration, or the Order Form provides otherwise.
9.3 Termination for breach. Either party may terminate this Agreement and affected Order Forms if the other party materially breaches and fails to cure within thirty (30) days after written notice specifying the breach. If Customer fails to pay undisputed Fees and that failure continues more than fifteen (15) days after written notice, XOXO may terminate immediately. XOXO may alternatively suspend the Services if Customer violates Section 1.1 or 1.3.
9.4 Insolvency. Either party may terminate immediately if the other party has a receiver appointed, makes an assignment for the benefit of creditors, or becomes unable to pay debts as they become due, except as prohibited by bankruptcy law.
9.5 Effect of termination. Expiration or termination does not relieve Customer of undisputed amounts accrued. Upon termination or expiration, licenses end, Customer must stop using the Services and delete XOXO Confidential Information, and XOXO has no further obligation to provide the Services or Support. Customer should download Customer Data before the effective date of termination, subject to applicable Plan Limits and retention periods for the relevant product. Upon Customer’s written request within thirty (30) days after termination, XOXO will delete Customer’s account and associated Customer Data within thirty (30) days after that request, except for copies retained in backups or as required by law or the DPA, which remain subject to confidentiality until deleted. XOXO is not obligated to provide custom export, migration, or transition assistance unless the parties agree in writing.
If Customer does not request deletion, XOXO may delete the account or, if XOXO offers a self-serve tier for the same product, convert it to that tier under the then-current Consumer Terms of Service.
9.6 Survival. Sections 1.3, 1.7, 1.8, 1.10, 2, 3, 4, 5.4, 5.5, 6, 7, 8, 9.5, 9.6, 11 (except 11.3), and 12 survive.
10. Export; anti-corruption; government
10.1 Export and sanctions. Each party will comply with applicable export controls and sanctions, including the Export Administration Regulations and OFAC rules. Each party represents it is not, and is not owned or controlled by, a person on the SDN List or another restricted-party list. Customer will not export or re-export the Services without XOXO’s prior written consent and any required license.
10.2 Anti-corruption. Neither party has received or offered any illegal bribe, kickback, or improper gift in connection with this Agreement. Ordinary-course reasonable gifts and entertainment do not violate this Section.
10.3 U.S. government. The Services, Documentation, and related technology are commercial items provided with only those rights customarily provided to the public, in accordance with FAR 12.211, FAR 12.212, DFARS 252.227-7015, and DFARS 227.7202-3, as applicable. Additional government rights require a mutually signed addendum.
11. Miscellaneous
11.1 Notices. Notices must be in writing. XOXO may send notices to the email on Customer’s account or through the Services. Customer will send notices to:
XOXO Systems, Inc.
Attn: Legal
801 International Pkwy STE 550143
Flower Mound, TX 75022
USA
with a copy to legal@xoxo.systems.
Email notice is effective on the next business day after sending, unless the sender receives an automated delivery failure.
11.2 Independent contractors. The parties are independent contractors. This Agreement does not create a partnership, joint venture, or agency.
11.3 Force majeure. Neither party is liable for delay or failure (other than payment obligations) caused by events beyond its reasonable control. If such an event continues more than sixty (60) days and prevents a party from performing, the other party may terminate the affected Order Forms upon written notice without penalty.
11.4 Assignment. Neither party may assign this Agreement without the other’s prior written consent, not to be unreasonably withheld, except that either party may assign to an Affiliate or in connection with a merger, change of control, reorganization, or sale of substantially all assets related to this Agreement. Any other attempted assignment is void. This Agreement binds permitted successors and assigns.
11.5 Severability. If a provision is invalid, it will be interpreted to reflect the parties’ intent, and the remainder remains in effect.
11.6 Waiver. Failure or delay in exercising a right is not a waiver unless in writing.
11.7 Entire agreement; order of precedence; modifications. This Agreement, the Order Form, the Privacy Policy, the DPA, and any product-specific terms for products Customer uses are the entire agreement regarding the Services and supersede prior or contemporaneous agreements on that subject. Customer purchase orders and similar documents are rejected and have no effect.
Order of precedence: (1) the Order Form (including negotiated amendments), (2) the DPA with respect to Personal Data, (3) product-specific terms with respect to that product’s fees, plan structure, metering, and retention, (4) this Agreement, (5) the Privacy Policy.
XOXO may update this Agreement, the Privacy Policy, and the DPA. If XOXO makes a material change to this Agreement, it will give at least thirty (30) days’ notice by email or through the Services; provided that if an Order Form has a fixed term of twelve (12) months or longer, material changes to this Agreement instead take effect at the start of the next renewal Term. If a material change is not acceptable, Customer’s exclusive remedy is to decline to renew under Section 9.2. Negotiated terms that expressly prohibit unilateral modification are not affected. An Order Form is subject to the version of this Agreement in effect when that Order Form is executed. Updates to the Privacy Policy and DPA take effect as those documents provide.
11.8 Affiliates. Customer Affiliates may use the Services under Customer’s account if the Order Form allows it. Customer is responsible for Affiliate use. An Affiliate that requires a separate workspace must execute its own Order Form.
11.9 Interpretation. “Including” means “including without limitation.” “Or” is not exclusive. Headings are for convenience only. Neither party is the drafter for purposes of construing ambiguity. Non-English translations, if any, are for convenience; English controls.
11.10 Electronic communications. Customer agrees to receive electronic communications related to this Agreement and the Services. Electronic notices satisfy any writing requirement.
11.11 No publicity. Neither party is granted any right to use the other party’s name, logo, or trademarks in marketing or publicity.
12. Dispute resolution
12.1 Informal resolution. Before commencing arbitration or litigation, the party raising a dispute will send written notice describing the dispute. The parties will attempt in good faith to resolve it for thirty (30) days after notice.
12.2 Arbitration. Subject to Section 12.3, any dispute arising out of or relating to this Agreement will be resolved by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules. The arbitration will be in English before a single arbitrator. Hearings will take place in Wilmington, Delaware, or by video conference. Judgment on the award may be entered in any court with jurisdiction. The Federal Arbitration Act governs this Section 12. The arbitrator may decide questions of arbitrability.
12.3 Exceptions. Either party may bring in court claims for actual or threatened infringement or misappropriation of Intellectual Property Rights, and claims for emergency injunctive relief (including to address a security incident).
12.4 Jury and class waiver. EACH PARTY IRREVOCABLY WAIVES ANY RIGHT TO A JURY TRIAL. EACH PARTY AGREES THAT DISPUTES WILL BE CONDUCTED ONLY ON AN INDIVIDUAL BASIS AND NOT AS A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION.
12.5 Governing law and venue. This Agreement is governed by the laws of the State of Delaware, excluding conflict-of-law rules. The U.N. Convention on Contracts for the International Sale of Goods does not apply. Subject to this Section 12, exclusive venue is the state or federal courts located in the State of Delaware, and each party consents to personal jurisdiction there.
12.6 Time limit. Any claim arising out of this Agreement must be commenced within one (1) year after it accrues, or it is permanently barred, except for claims of infringement or misappropriation of Intellectual Property Rights and claims for unpaid Fees.
13. Definitions
“Actions” means operations the Services perform at Customer’s direction or through agents, MCP tools, or workflows Customer enables, including reading from or writing to Customer Systems, calling APIs, sending messages, and executing automations.
“Affiliate” means an entity that controls, is controlled by, or is under common control with a party, where “control” means ownership of more than 50% of the voting interests.
“Authorized User” means a Customer employee or contractor authorized by Customer to use the Services on Customer’s behalf.
“Customer Data” means data, code, information, or other content made available by or on behalf of Customer or any Authorized User for upload to, or access, analysis, or processing by, the Services, including Inputs and Outputs.
“Customer System” means any application, data store, MCP server, account, or environment owned, operated, licensed, or managed by Customer or its Affiliate with which the Services are connected.
“Data Breach” means an actual breach of XOXO’s security directly caused by XOXO’s breach of Section 8.1 leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data in XOXO’s possession. Data Breaches do not include unsuccessful attempts or activities that do not compromise Personal Data, including failed logins, pings, port scans, denial-of-service attacks, or other attacks on firewalls or networked systems.
“Documentation” means XOXO’s published user documentation describing the design, functions, operation, or use of the Services, as updated from time to time.
“Fees” means amounts Customer must pay under this Agreement and the Order Form.
“Input” means Customer Data submitted by or on behalf of Customer to the Services for processing.
“Intellectual Property Rights” means patents, copyrights, trademarks, trade secrets, database rights, moral rights, and similar rights worldwide, including applications and registrations.
“Order Form” means the ordering document executed by Customer and XOXO specifying the Services, Fees, Term, Plan Limits, and other commercial terms.
“Output” means content generated by the Services in response to an Input.
“Personal Data” means personal data or personal information as defined under applicable data protection laws.
“Plan Limits” has the meaning given in Section 4.2.
“Services” means the XOXO software products, solutions, APIs, MCP interfaces, and related offerings identified in the Order Form.
“Support” means support described in the Order Form.
“Term” means the initial subscription period and any renewal periods in the applicable Order Form.
“Third-Party Service” means third-party services, models, infrastructure, or applications not provided by XOXO, including applications that host Customer Data.
“XOXO Properties” means the Services, Documentation, Usage Data, and all underlying models, algorithms, prompts, templates, MCP interfaces, and other components of the Services, including copies, modifications, and derivative works thereof.
Contact
Questions about this Agreement: legal@xoxo.systems
XOXO Systems, Inc.
801 International Pkwy STE 550143
Flower Mound, TX 75022
United States