Master Service Agreement

This agreement governs all managed AI assistant services provided by Hirelessly.
A signed Statement of Work (SOW) is required to activate services under this MSA.

Contents

1. 1. Definitions
2. 2. Services & Delegation of Authority
3. 3. Policy Guardrails — What AI Agents Will Not Do
4. 4. Client Responsibilities
5. 5. Data Access, Privacy & Security
6. 6. Payment Terms
7. 7. Service Levels (SLA)
8. 8. Warranties
9. 9. Limitation of Liability
10. 10. Indemnification
11. 11. Acceptable Use Policy
12. 12. Term & Termination
13. 13. Confidentiality
14. 14. Intellectual Property
15. 15. General Provisions
16. 16. Signature & Execution

Definitions

The following terms have specific meanings throughout this Agreement:

Services & Delegation of Authority

2.1 Nature of Services

Hirelessly is a managed service provider, not a software platform. We do not provide Client with access to a self-service tool. Instead, Hirelessly's team deploys, configures, and operates AI Agents on Client's behalf within Client's own Authorized Tools. The relationship is that of service provider and client — not licensor and licensee.

2.2 What AI Agents Are Authorized to Do

Each SOW includes a Delegation of Authority Schedule specifying the exact actions each AI Agent is authorized to take. No agent may take actions outside those defined in the applicable SOW. Typical authorized actions include:

• Reading, categorizing, drafting, and sending email responses within parameters set by Client
• Creating, modifying, and accepting calendar events within Client's calendar application
• Updating, tagging, and creating records in Client's CRM within defined field boundaries
• Responding to inbound customer support inquiries using Client-approved knowledge base content
• Qualifying inbound leads and booking discovery calls per Client's defined criteria
• Compiling and delivering automated reports from Client's connected data sources

2.3 What AI Agents Are NOT Authorized to Do

Unless explicitly stated in the SOW Delegation of Authority Schedule, AI Agents are never authorized to:

• Commit to pricing, delivery timelines, refunds, or contractual terms on Client's behalf
• Accept, decline, or counter offers that create legally binding obligations
• Access systems, data, or OAuth scopes beyond those documented in the Authorization & Access Schedule
• Delete client records, contacts, or data without explicit per-action written approval
• Send outbound communications to lists exceeding thresholds defined in the SOW without HITL approval
• Take any action in HIPAA, FINRA, or SEC-regulated workflows without a separate Compliance Addendum
• Issue or process payments, charge cards, or modify subscription billing
• Respond to formal legal notices, regulatory inquiries, or demand letters

2.4 Human-in-the-Loop (HITL) Escalation

Certain actions are always routed to Client's designated HITL contact before execution. The SOW defines the specific triggers. Standard HITL triggers include complaints, refund requests, legal inquiries, bulk outbound sends, and any action outside the agent's trained knowledge base. Hirelessly will surface HITL escalations to Client within the response time defined in the SOW SLA. If Client does not respond within the defined window, the agent takes no action and logs the item as pending.

2.5 Onboarding

Services begin with an onboarding session where Hirelessly maps Client's workflows, documents the Delegation of Authority, establishes the Authorization & Access Schedule, and configures agents. Client must designate a primary contact and a HITL contact before onboarding begins. Target activation is within 5 business days of completed onboarding for standard tiers.

Policy Guardrails — What AI Agents Will Not Do

The following guardrails apply to all engagements regardless of SOW terms. These are not negotiable and exist to protect both Parties and Client's end-customers.

Layer 1 — Absolute Prohibitions (No Exceptions)

1. 1.No legally binding commitments. AI Agents will not make, accept, counter, or imply offers that constitute binding contracts, including price quotations as offers, acceptance of vendor terms, or agreement to service-level commitments.
2. 2.No financial transactions. AI Agents will not initiate, approve, modify, or reverse any financial transaction including payments, refunds, chargebacks, or subscription changes.
3. 3.No regulated health or legal content. AI Agents will not provide, generate, or relay medical advice, legal advice, tax advice, or investment advice of any kind, even if instructed to do so by Client.
4. 4.No unauthorized data access. AI Agents will not access any system, database, or data category beyond the OAuth scopes and API keys documented in the current Authorization & Access Schedule.
5. 5.No destructive data actions. AI Agents will not delete, overwrite, or permanently modify Client records unless explicitly authorized per-action in writing by Client's designated contact.
6. 6.No communications to regulated categories. AI Agents will not send debt collection communications, legal notices, medical information to patients, or any communication regulated under HIPAA, FDCPA, or equivalent laws without a signed Compliance Addendum.
7. 7.No SMS or voice automation. AI Agents will not send automated SMS messages or make automated voice calls without a separate TCPA Compliance Rider executed by both Parties.
8. 8.No spam or deceptive communications. AI Agents will not send unsolicited bulk email, use deceptive subject lines, or send commercial email in violation of CAN-SPAM, CASL, or applicable anti-spam laws.

Layer 2 — Human Approval Required Before Action

• Outbound email to any list exceeding the threshold defined in Client's SOW
• CRM field updates affecting more than the record threshold defined in Client's SOW
• Any inbound complaint, refund request, or escalation from Client's end-customer
• Any response to a communication that references legal action, regulatory inquiry, or dispute
• Any calendar action on behalf of Client's CEO, founder, or equivalent executive
• Any action involving pricing, discounts, or commercial terms

Layer 3 — Outside Standard Retainer Scope

• Social media content requiring legal or brand review before publishing
• Contract drafting, redlining, or legal document preparation
• Customer dispute resolution for transactions above $500 in value
• Any workflow involving Client's end-customer payment card data (PCI scope)
• Work in HIPAA-covered environments without a signed BAA (Business Associate Agreement)

Client Responsibilities

Hirelessly's services depend on Client fulfilling the following obligations. Failure to do so may result in degraded service, suspension of agents, or additional fees.

1. 1.Own and maintain your tools. Client is responsible for subscribing to, paying for, and maintaining all Authorized Tools (Gmail, HubSpot, Salesforce, Slack, etc.). Hirelessly does not provide, resell, or manage third-party tool subscriptions on Client's behalf.
2. 2.Grant and maintain access. Client must provide valid OAuth connections or API keys for all tools listed in the Authorization & Access Schedule. Client must notify Hirelessly within 24 hours if access credentials are revoked, expired, or compromised.
3. 3.Designate contacts. Client must maintain an active primary contact and HITL contact throughout the engagement. These contacts must be reachable during business hours for escalations.
4. 4.Provide accurate information. Client is responsible for ensuring that the knowledge bases, templates, and workflow rules provided to Hirelessly are accurate, lawful, and up to date. AI Agent outputs are only as accurate as the information Client provides.
5. 5.Obtain end-customer consents. Client is responsible for obtaining all required consents from its end-customers for automated AI processing of their data, including any consents required under GDPR, CCPA, or applicable privacy law.
6. 6.Review agent activity. Client agrees to review the weekly activity digest provided by Hirelessly and notify Hirelessly within 5 business days of any agent output that appears incorrect, out-of-scope, or in need of adjustment.
7. 7.Comply with applicable law. Client is responsible for ensuring that the use of Hirelessly's services in its business complies with all applicable laws, including email marketing laws, data protection laws, and industry-specific regulations.
8. 8.Do not instruct agents outside guardrails. Client must not instruct or attempt to instruct Hirelessly to configure agents in ways that violate Section 3 of this Agreement.

Data Access, Privacy & Security

5.1 Data Processing Roles

For purposes of applicable data protection law, Client is the data controller and Hirelessly is a data processor. Hirelessly processes Client Data only on documented instructions from Client as set out in this Agreement and the applicable SOW.

5.2 What Data Hirelessly Accesses

Hirelessly accesses only the data categories and tool scopes documented in the Authorization & Access Schedule. Hirelessly will not request OAuth scopes broader than necessary for the services defined in the SOW ("principle of least privilege").

5.3 How Hirelessly Uses Client Data

Client Data is used solely to perform the Services. Hirelessly will not:

• Sell, rent, or share Client Data with third parties for commercial purposes
• Use Client Data to train general-purpose AI models without Client's explicit written consent
• Retain Client Data beyond 30 days after termination of the Agreement
• Transfer Client Data outside the country of processing without appropriate safeguards

5.4 Sub-Processors

Hirelessly uses third-party AI and infrastructure providers ("sub-processors") to deliver the Services. Current sub-processors include AI model providers (e.g., Anthropic, OpenAI) and cloud infrastructure (e.g., AWS, Vercel). A current sub-processor list is available on request. Hirelessly will notify Client 14 days before adding a new sub-processor that processes Client Data.

5.5 Security Standards

• Encrypted credential storage for all OAuth tokens and API keys
• Access controls limiting which Hirelessly team members can access Client configurations
• Regular security reviews of agent infrastructure
• Incident response procedures including breach notification

5.6 Breach Notification

In the event of a security incident affecting Client Data, Hirelessly will notify Client within 72 hours of becoming aware of the incident, provide details of the data affected and the steps taken to contain it, and cooperate fully with Client's incident response.

5.7 Data Return and Deletion

Upon termination of this Agreement, Hirelessly will revoke all OAuth tokens and API connections within 48 hours, provide Client with a summary of all agent configurations built during the engagement, and delete or return all Client Data within 30 days as directed by Client.

Payment Terms

1. 1.Retainer structure. Fees are billed as a monthly retainer on the 1st of each calendar month, covering services for that month. Annual plans are billed upfront at the discounted rate specified in the SOW.
2. 2.Payment method. Client authorizes payment by credit card or ACH bank transfer. Payment is due within 15 days of invoice issuance ("net 15").
3. 3.Late payment. Invoices unpaid after a 5-day grace period accrue interest at 1.5% per month. Hirelessly may suspend (not terminate) AI Agents after 10 days of non-payment without incurring liability to Client. Services resume within 24 hours of payment receipt.
4. 4.Scope and change orders. The monthly retainer covers the services defined in the SOW. Work outside that scope requires a written Change Order with agreed additional fees before work begins.
5. 5.No refunds for partial months. Monthly retainer fees are non-refundable. If Client terminates mid-month, the final month's retainer is not prorated. Annual plan refunds are limited to unused complete months at the standard monthly rate.
6. 6.Price changes. Hirelessly will provide 60 days written notice before increasing retainer rates. Changes do not apply during a pre-paid annual term.
7. 7.Taxes. Fees are exclusive of applicable sales, use, VAT, or similar taxes. Client is responsible for all such taxes, except for taxes based on Hirelessly's net income.

Service Levels (SLA)

Service level commitments for each engagement are defined in the SOW. Standard SLAs for each plan tier are as follows:

SLA Remedy: If Hirelessly fails to meet the processing time SLA in more than 5% of trigger events in a calendar month, Client is entitled to a service credit of 10% of that month's retainer, applied to the following invoice. Service credits are the sole remedy for SLA failures.

Exclusions: SLAs do not apply during: scheduled maintenance (minimum 48 hours notice), outages caused by third-party tool providers, or force majeure events.

Warranties

8.1 Hirelessly Warrants That:

• Services will be performed professionally and in accordance with industry standards for managed AI services
• AI Agents will operate within the Delegation of Authority and Policy Guardrails defined in this Agreement and the applicable SOW
• Hirelessly has the right to enter into this Agreement and perform the Services
• Hirelessly maintains security practices appropriate to the nature of Client Data processed

8.2 Warranty Exclusions

• Client-provided instructions, templates, or knowledge base content that were inaccurate, outdated, or unlawful
• Client's failure to maintain Authorized Tools or provide access as required under Section 4
• Actions explicitly approved by Client's HITL contact
• Third-party tool outages, API changes, or rate limits outside Hirelessly's control
• AI model outputs that fall within expected statistical variation for the model tier used

8.3 No Outcome Guarantee

Hirelessly does not guarantee specific business outcomes including but not limited to revenue generated, leads converted, support tickets resolved, or cost savings achieved. Performance metrics in marketing materials are illustrative averages, not contractual commitments.

Limitation of Liability

9.1 Liability Cap

Hirelessly's total aggregate liability to Client arising out of or related to this Agreement is capped at the total fees paid by Client in the 12 months immediately preceding the event giving rise to the claim.

9.2 Mutual Exclusion of Consequential Damages

Neither Party will be liable to the other for any indirect, incidental, special, consequential, or punitive damages — including lost profits, lost revenue, loss of data, business interruption, or reputational harm — even if advised of the possibility of such damages.

9.3 Exceptions to the Cap

• Hirelessly's gross negligence or willful misconduct causing a data breach of Client Data
• Hirelessly's indemnification obligations under Section 10 for IP infringement claims
• Either Party's breach of confidentiality obligations under Section 13
• Death or personal injury caused by a Party's negligence

Indemnification

10.1 Hirelessly Indemnifies Client Against:

• Third-party claims arising from AI Agents acting outside the Delegation of Authority or Policy Guardrails — provided Client did not instruct or approve the out-of-scope action
• Data breaches caused by Hirelessly's failure to maintain security obligations under Section 5
• Third-party intellectual property infringement claims arising from Hirelessly's underlying technology (not Client-provided content)

10.2 Client Indemnifies Hirelessly Against:

• Third-party claims arising from actions Client's HITL contact explicitly approved before execution
• Claims from Client's end-customers arising from Client's failure to obtain required data processing consents
• Regulatory actions or fines arising from Client's failure to comply with applicable law
• Claims arising from inaccurate, outdated, or unlawful content Client provided as knowledge base or templates
• Client's direction to override or circumvent Policy Guardrails defined in Section 3

10.3 Indemnification Process

The indemnified Party must: (a) promptly notify the indemnifying Party in writing of any claim, (b) give the indemnifying Party sole control of the defense, and (c) reasonably cooperate at the indemnifying Party's expense.

Acceptable Use Policy

Client agrees not to use the Services to:

1. 1.Send spam, unsolicited commercial email, or bulk communications that violate CAN-SPAM, CASL, or applicable anti-spam laws
2. 2.Harass, threaten, defraud, impersonate, or mislead any third party
3. 3.Process personal data without required legal basis, consent, or notice to data subjects
4. 4.Access or attempt to access systems, accounts, or data Client is not authorized to access
5. 5.Circumvent, disable, or interfere with Hirelessly's HITL controls, guardrails, or security features
6. 6.Use AI Agents in workflows involving children's data (COPPA-covered)
7. 7.Use AI Agents to generate, distribute, or promote illegal, harmful, or discriminatory content
8. 8.Resell or sublicense access to Hirelessly's services without prior written consent
9. 9.Reverse engineer, copy, or replicate Hirelessly's agent architecture, prompts, or configurations
10. 10.Use the Services in any way that violates applicable law in Client's jurisdiction

Hirelessly reserves the right to suspend agents immediately upon discovering a violation of this AUP. Suspension under this section does not entitle Client to a refund.

Term & Termination

12.1 Term

This Agreement begins on the date both Parties sign the first SOW and continues until all SOWs have expired or been terminated. Each SOW has a minimum initial term of 3 months. After the initial term, the SOW auto-renews on a monthly basis.

12.2 Termination for Convenience

Either Party may terminate a SOW by providing 30 days written notice after the initial 3-month term.

12.3 Termination for Cause

• Material breach not cured within 14 days of written notice
• Insolvency, assignment for benefit of creditors, or bankruptcy
• Violation of the Acceptable Use Policy (Section 11) or Policy Guardrails (Section 3)
• Payment more than 30 days overdue

12.4 Effect of Termination

• Revoke all OAuth tokens and API connections within 48 hours
• Deliver a final off-boarding summary including all agent configurations
• Issue a final invoice for any outstanding fees
• Delete or return Client Data within 30 days per Client's instructions

Confidentiality

Each Party agrees to: (a) keep the other Party's Confidential Information strictly confidential; (b) use it only to perform obligations under this Agreement; and (c) share it only with employees or contractors who need to know and are bound by equivalent confidentiality obligations.

Confidentiality obligations survive termination of this Agreement for 3 years, except for Client Data which is subject to the data deletion obligations in Section 5.7.

Intellectual Property

1. 1.Client owns Client Data. All data, content, and information Client provides to Hirelessly remains Client's property. Hirelessly claims no ownership over Client Data.
2. 2.Client owns outputs. Content generated by AI Agents on Client's behalf (emails drafted, reports generated, CRM entries created) belongs to Client.
3. 3.Hirelessly owns its technology. Hirelessly's agent architecture, proprietary workflows, prompts, configuration methods, and technology platform remain Hirelessly's exclusive property.
4. 4.Feedback license. If Client provides feedback or suggestions about the Services, Client grants Hirelessly a perpetual, royalty-free license to use that feedback to improve the Services.
5. 5.No training on Client Data. Hirelessly will not use Client Data to train general-purpose AI models without Client's explicit written consent.

General Provisions

1. 1.Governing Law. This Agreement is governed by the laws of the Kingdom of Thailand, without regard to conflict of law principles. Hirelessly Co., Ltd. is incorporated and operates from Bangkok, Thailand.
2. 2.Dispute Resolution. The Parties agree to attempt to resolve disputes through good-faith negotiation for 30 days before initiating any legal proceeding. Any unresolved dispute will be submitted to binding arbitration under the rules of the Thai Arbitration Center (THAC) in Bangkok, Thailand.
3. 3.Entire Agreement. This Agreement, together with all executed SOWs, constitutes the entire agreement between the Parties.
4. 4.Amendments. Modifications to this MSA require written agreement signed by authorized representatives of both Parties.
5. 5.Severability. If any provision is found unenforceable, the remaining provisions continue in full force.
6. 6.Waiver. A Party's failure to enforce a provision is not a waiver of the right to enforce it later.
7. 7.Assignment. Client may not assign this Agreement without Hirelessly's prior written consent. Hirelessly may assign to a successor entity with 30 days notice.
8. 8.Force Majeure. Neither Party is liable for failure to perform due to causes beyond its reasonable control, including natural disasters, pandemics, or government actions.
9. 9.Notices. Notices must be in writing and sent by email with confirmation of receipt, or by courier to the registered business address.
10. 10.Independent Contractors. The Parties are independent contractors. Nothing creates an employment, partnership, joint venture, or agency relationship.
11. 11.No Third-Party Beneficiaries. This Agreement is for the sole benefit of the Parties.

Signature & Execution

By signing below, each Party confirms that they have read, understood, and agreed to this Master Service Agreement and that the individual signing has authority to bind the named entity.

This Agreement may be executed electronically. An electronic signature is legally binding under Thailand's Electronic Transactions Act B.E. 2544 (2001) and its amendments.

Legal Notice: This document is a template prepared by Hirelessly for general guidance. It does not constitute legal advice. Hirelessly recommends that both Parties have this Agreement reviewed by qualified legal counsel before execution.