Template version: August 19, 2026
This agreement is an enterprise template, not public clickwrap. Complete the customer- and deal-specific fields and use an Order Form for each customer before signature. No insurance, certification, service-level, data-residency, or international-transfer commitment is included unless a signed Order Form or addendum expressly states it.
This Master Services Agreement (the "MSA") is entered into as of [EFFECTIVE DATE] between Babaji Central Company LLC, a California limited liability company operating the Outpost Returns service, with an address at 1106 2nd Street, #130, Encinitas, California 92024 ("Outpost"), and [CUSTOMER LEGAL NAME], a [STATE AND ENTITY TYPE], with an address at [CUSTOMER ADDRESS] ("Customer"). Outpost and Customer are each a "Party" and together the "Parties."
1. Agreement structure
This MSA governs Order Forms signed by the Parties and the Services identified in them. Each Order Form is incorporated into the Agreement. The "Agreement" consists of this MSA, each Order Form, the Data Processing Addendum ("DPA"), any signed service-level agreement or statement of work, and documents expressly incorporated by reference.
If there is a conflict, the order of precedence is: the DPA for Processing matters; the Order Form; a signed service-level agreement or statement of work for its specific subject; this MSA; and other incorporated documents. An Order Form changes this MSA only if it cites the specific section and states the change.
2. Definitions
"Affiliate" means an entity that controls, is controlled by, or is under common control with a Party, where control means ownership of more than 50 percent of voting interests or the power to direct management.
"Authorized User" means an individual whom Customer authorizes to use the Services under Customer's account, including Customer personnel, contractors, and authorized brand-client users.
"Customer Data" means data, content, photographs, records, credentials, configurations, and instructions submitted to or Processed through the Services by or for Customer, excluding Outpost Technology and Deidentified Data.
"Customer-Directed Integration" means a third-party service, account, system, or provider independently selected, authorized, or credentialed by Customer for interoperability with the Services.
"Deidentified Data" means data derived from operation of the Services that does not reasonably identify Customer, an Authorized User, a return consumer, or another person and is maintained subject to commitments against reidentification.
"Documentation" means Outpost's then-current user documentation for the Services.
"Order Form" means a mutually executed ordering document identifying Services, term, fees, usage, and other commercial terms.
"Outpost Technology" means the Services, software, workflows, documentation, designs, models, know-how, tools, improvements, and technology owned or licensed by Outpost, excluding Customer Data.
"Process" and related terms have the meaning in the DPA.
"Services" means the hosted Outpost returns-processing platform, station applications, support, and related services identified in an Order Form.
3. Orders and Affiliates
An Order Form is binding when signed by authorized representatives. Customer Affiliates may purchase Services by signing an Order Form that references this MSA. Each such Affiliate is independently responsible for its Order Form, and only the Customer entity signing an Order Form may enforce it, unless the Order Form states joint responsibility.
Purchase orders are for Customer's administrative convenience only. Preprinted or electronic purchase-order terms do not modify the Agreement, even if Outpost accepts or references the purchase order.
4. Access and license
Subject to the Agreement and payment of fees, Outpost grants Customer during the applicable Order Term a limited, nonexclusive, nontransferable, nonsublicensable right to permit Authorized Users to access and use the Services for Customer's internal business operations and Customer's authorized provision of returns-processing services to its brand clients.
Customer may allow brand-client users to access tenant-isolated portal features for their own records, but Customer remains responsible for those users and for defining the brand-client relationship. Customer may not resell the Services as a standalone software service or grant a third party broader rights than Customer receives. Unless a signed Order Form says otherwise, the Services are offered only to United States-based businesses for operations in the United States.
Outpost will provide the Services materially according to the Documentation and Order Form. Outpost may update functionality, interfaces, or workflows to improve the Services, address security, comply with law, or respond to third-party dependency changes. Outpost will not materially reduce the core functionality purchased during the then-current Order Term, except where continued functionality would create material security, legal, or third-party risk.
5. Implementation, support, and dependencies
Each Party will timely provide personnel, information, decisions, access, and cooperation reasonably needed for implementation. Customer is responsible for its facilities, networks, supported devices and browsers, printers, Customer-Directed Integrations, source data, mappings, configuration, training, and change management.
Unless an Order Form states otherwise, standard support is requested through benn@boxfortcommerce.com and handled on a commercially reasonable basis during Outpost's ordinary California business operations. Support response targets are not resolution commitments. No uptime guarantee or service credit applies unless stated in a signed service-level agreement.
Outpost may schedule maintenance with reasonable notice when practicable. Emergency maintenance may occur without advance notice. Performance and availability can depend on Customer systems and third-party providers outside Outpost's control.
6. Customer responsibilities
Customer will:
- use the Services according to the Agreement, Documentation, and law;
- ensure Authorized Users are at least 18 and authorized for business use;
- provide accurate account, billing, integration, facility, and configuration information;
- assign permissions using least privilege and promptly revoke unnecessary access;
- secure credentials, station devices, printers, local networks, endpoints, and Customer-Directed Integrations;
- validate warehouse, client, location, disposition, grading, billing, printing, and integration mappings before production use;
- maintain appropriate business-continuity and manual fallback procedures for warehouse operations;
- review return decisions, AI-assisted output, write-backs, invoices to its clients, and external-system results; and
- notify Outpost promptly of suspected unauthorized access, data issues, or material errors.
Customer is responsible for its products, customers, workforce, facilities, return policies, warehouse operations, regulatory obligations, and the accuracy and legality of its instructions. Outpost does not take title to returned goods and is not a warehouseman, carrier, seller, merchant of record, employer, insurer, payment adviser, legal adviser, or decision maker for Customer's return consumers or inventory.
7. Acceptable use
Customer will not, and will not permit anyone to:
- violate law or third-party rights; submit malware or unlawful data; or use the Services for fraud, deception, harassment, surveillance, or discrimination;
- access another customer's workspace or defeat tenant, role, facility, brand, security, authentication, usage, or billing controls;
- disrupt, overload, probe, scan, or test the Services without prior written authorization and an agreed test plan;
- reverse engineer, decompile, disassemble, copy, scrape, frame, or derive source code or nonpublic structure except where a prohibition is unenforceable under law;
- use the Services or output to build or train a competing service or publish benchmarks without Outpost's written consent;
- remove proprietary notices or represent Outpost output as independently verified; or
- use the Services in high-risk activities where failure could reasonably cause death, personal injury, or catastrophic physical or environmental damage.
Outpost may suspend affected access under Section 17 and will use reasonable efforts to limit its response to the affected account, user, feature, or data.
8. Customer Data
As between the Parties, Customer owns Customer Data. Customer grants Outpost and its subprocessors a nonexclusive, worldwide, limited right during the Agreement and applicable transition period to host, copy, transmit, display, transform, and otherwise Process Customer Data only to provide, secure, support, administer, and improve the Services; comply with Customer's documented instructions and law; prevent abuse; and exercise Outpost's rights under the Agreement.
Customer represents and warrants that it has all rights, notices, permissions, and lawful bases needed for the Processing, including return-consumer contact details, package and item photos, workforce information, and integration data. Customer is responsible for accuracy, quality, legality, and minimization. Customer will not provide regulated or highly sensitive data not expressly supported by the Services and the DPA.
Outpost may create and use Deidentified Data to measure, secure, support, and improve the Services and for lawful business planning. Outpost will maintain it in deidentified form, not attempt to reidentify it except to test deidentification as permitted by law, and not disclose it in a way that reasonably identifies Customer or a person.
9. Privacy and security
The Data Processing Addendum, or an attached execution copy, governs Outpost's Processing of personal information on Customer's behalf. Each Party will comply with its obligations under applicable privacy and data-protection law. Customer is the Controller/Business and Outpost is the Processor/Service Provider unless law assigns different roles.
Outpost will maintain reasonable administrative, technical, and organizational safeguards designed to protect Customer Data, as described in the DPA. Customer acknowledges that no service can eliminate all risk and that Customer users, devices, credentials, configurations, and third-party systems are shared security responsibilities.
Outpost will notify Customer of a confirmed Security Incident as stated in the DPA. Each Party will maintain an incident contact. Customer will not make a public statement identifying Outpost as the cause of an incident before the facts are reasonably established, except where law requires it.
10. Customer-Directed Integrations
Customer may authorize Outpost to exchange Customer Data with Customer-Directed Integrations such as warehouse management systems, marketplaces, carriers, printing services, or payment providers. Customer instructs and authorizes the exchange needed for the enabled workflow.
Customer-Directed Integrations are governed by Customer's agreement with the third party. Outpost does not control and is not responsible for their availability, security, changes, acts, omissions, data handling, charges, or results. Outpost may suspend an integration if credentials fail, the provider changes or disables its interface, the provider or law requires suspension, or continued operation creates material risk.
Customer understands that a live write-back can move inventory, change return status, submit compliance results, or otherwise affect an external system. Customer must validate the configuration and authorize personnel before live use. Outpost is not responsible for results caused by Customer configuration, source data, instructions, credentials, unauthorized use, or the external system.
11. AI-assisted features
If enabled, AI-assisted features may classify products, categorize reasons, or restate structured facts as a concise summary. Output may be inaccurate or incomplete and is not a substitute for human review. Customer is responsible for reviewing output before using it for inventory, compliance, customer, financial, workforce, or other material decisions.
Outpost will use an AI provider only as described in the DPA and subprocessor list. Outpost will not knowingly send payment credentials, integration secrets, or return-consumer email addresses to the current AI classification or summarization feature. Customer will not submit data that the feature documentation does not support.
12. Fees, invoicing, and taxes
Customer will pay the fees and usage charges in each Order Form. Unless the Order Form states otherwise, recurring fees are invoiced in advance, usage charges in arrears, and invoices are due within 30 days. Fees are stated in United States dollars, noncancelable, and nonrefundable except as expressly provided in the Agreement.
Customer must dispute an invoice in good faith within 30 days after receipt, with reasonable detail, and timely pay undisputed amounts. Failure to dispute within 30 days waives the dispute to the extent permitted by law, except for duplicate charges, fraud, or nonwaivable rights. Overdue undisputed amounts may accrue interest at the lesser of 1.0 percent per month or the maximum lawful rate, plus reasonable collection costs.
Fees exclude sales, use, value-added, withholding, and similar taxes. Customer is responsible for taxes arising from its purchase, excluding taxes based on Outpost's net income, property, or employees. If Customer must withhold, it will provide documentation and cooperate in obtaining available relief; unless an Order Form states otherwise, fees will be grossed up to ensure Outpost receives the invoiced amount where lawful.
13. Confidentiality
"Confidential Information" means nonpublic information disclosed by a Party that is marked confidential or reasonably should be understood as confidential, including Customer Data, product plans, pricing, security information, credentials, business processes, software, and technical information.
The receiving Party will use Confidential Information only to perform or exercise rights under the Agreement, protect it using at least reasonable care, and disclose it only to personnel, Affiliates, contractors, advisers, auditors, insurers, and financing sources who need it and are bound by confidentiality obligations at least as protective. Each Party is responsible for its recipients.
Confidential Information excludes information the receiving Party can document: was lawfully known without restriction; becomes public without breach; is lawfully received from a third party without duty; or is independently developed without use. If disclosure is legally required, the receiving Party will, where lawful, give prompt notice and reasonable assistance to seek protective treatment, and disclose only what is required.
Unauthorized use or disclosure may cause irreparable harm for which damages are inadequate, so the disclosing Party may seek appropriate injunctive relief without waiving other remedies or, where lawful, posting bond.
14. Intellectual property
Outpost and its licensors own Outpost Technology and all related intellectual-property rights. No rights are granted except the express access right in Section 4. If Customer gives feedback, Customer grants Outpost a perpetual, irrevocable, worldwide, royalty-free right to use it without identifying Customer or disclosing Customer Confidential Information.
Customer owns Customer-specific trademarks, data, and materials it supplies. Customer grants Outpost a limited right to display Customer's name and marks inside Customer's own workspace and customer communications required to provide the Services. Outpost may not use Customer's name or logo in public marketing, customer lists, case studies, or press releases without Customer's prior written consent.
15. Warranties
Each Party warrants that it has authority to enter the Agreement. Outpost warrants during a paid Order Term that the Services will perform in all material respects according to the Documentation and that it will provide any professional services in a professional and workmanlike manner.
Customer must report a reproducible material nonconformity promptly. Outpost's exclusive obligation and Customer's exclusive remedy is for Outpost to use commercially reasonable efforts to correct or reperform; if Outpost cannot do so within a reasonable period, Customer may terminate the affected Service and receive a refund of prepaid recurring fees allocable to the unused post-termination portion. Usage charges already incurred are not refunded.
The warranty does not cover issues caused by Customer Data, configuration, unauthorized use, unsupported environments, Customer-Directed Integrations, beta features, or events outside Outpost's reasonable control.
16. Disclaimers
EXCEPT FOR THE EXPRESS WARRANTIES IN SECTION 15, THE SERVICES, OUTPUT, DOCUMENTATION, TRIALS, AND BETA FEATURES ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUTPOST DISCLAIMS IMPLIED OR STATUTORY WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, QUIET ENJOYMENT, AND WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.
OUTPOST DOES NOT WARRANT UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE OPERATION; CONTINUED AVAILABILITY OR COMPATIBILITY OF THIRD-PARTY SYSTEMS; OR CORRECTNESS OF OUTPUT, FORECASTS, CLASSIFICATIONS, SUMMARIES, ROUTING, INVENTORY ACTIONS, OR BILLING DATA WITHOUT CUSTOMER REVIEW. CUSTOMER REMAINS RESPONSIBLE FOR OPERATIONAL, INVENTORY, FINANCIAL, LEGAL, COMPLIANCE, AND CUSTOMER-SERVICE DECISIONS.
17. Suspension
Outpost may suspend or restrict affected access when reasonably necessary to contain a security incident; stop unlawful or prohibited use; protect the Services, another customer, or a third party; comply with law or a provider requirement; or address undisputed amounts more than [10] days overdue after notice. Outpost will provide advance notice and an opportunity to cure where practicable. In urgent cases, notice may follow. Outpost will use reasonable efforts to limit the restriction and restore access after the cause is resolved.
Suspension does not relieve Customer of fees, but if a suspension results solely from Outpost's uncured material breach, Customer's remedies are those in the Agreement.
18. Indemnification
Outpost IP indemnity
Outpost will defend Customer and its officers, directors, and personnel from a third-party claim that the unmodified paid Services, used as authorized, directly infringe a United States patent, copyright, or trademark, and will pay damages finally awarded and settlements approved by Outpost. Outpost may obtain continued rights, modify or replace the affected Services, or terminate the affected Services and refund prepaid recurring fees allocable to the unused post-termination period.
Outpost has no obligation for claims arising from Customer Data; Customer instructions; modifications not made by Outpost; combinations not supplied by Outpost; continued use after notice; Customer-Directed Integrations; open-source components used according to their licenses; or use outside the Agreement.
Customer indemnity
Customer will defend Outpost and its Affiliates, officers, directors, and personnel from third-party claims arising from Customer Data; Customer's violation of Sections 6 or 7; Customer's products, returns operations, services, instructions, or relationship with a return consumer; Customer's failure to provide required privacy rights or notices; or a Customer-Directed Integration, and will pay damages finally awarded and settlements approved by Customer.
Procedure
The indemnified Party will give prompt notice, reasonable cooperation at the indemnifying Party's expense, and sole control of defense and settlement. Delay relieves an obligation only to the extent materially prejudiced. A settlement may not admit fault by or impose nonmonetary obligations on the indemnified Party without consent, not to be unreasonably withheld.
19. Limitation of liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, PUNITIVE, OR CONSEQUENTIAL DAMAGES; LOST PROFITS, REVENUE, SAVINGS, GOODWILL, OR BUSINESS OPPORTUNITY; OR LOSS OR CORRUPTION OF DATA, EVEN IF ADVISED OF THE POSSIBILITY.
EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THE AGREEMENT WILL NOT EXCEED FEES PAID OR PAYABLE BY CUSTOMER UNDER THE APPLICABLE ORDER FORM DURING THE 12 MONTHS BEFORE THE FIRST EVENT GIVING RISE TO LIABILITY.
"Excluded Claims" means Customer's payment obligations; Customer's breach of Section 7; either Party's fraud, willful misconduct, or liability that cannot lawfully be limited; and each Party's indemnification obligations. The Parties should state any negotiated enhanced cap for confidentiality, privacy, security, or data claims in the Order Form. Unless expressly stated, those claims remain subject to the general cap to the maximum extent permitted by law.
The exclusions and caps apply in aggregate, regardless of legal theory, and are an essential basis of the bargain. They do not create duplicate recovery. If a remedy fails of its essential purpose, the limitations continue to apply.
20. Insurance
No insurance commitment is included in this MSA. Outpost is not required to carry a specific policy, maintain a specific limit, or provide a certificate of insurance unless a signed Order Form expressly states that requirement. Any agreed insurance requirement does not expand Outpost's liability beyond the Agreement's exclusions and caps unless the Order Form expressly says otherwise. Customer will maintain insurance appropriate for its warehouse, employment, products, property, and logistics risks.
21. Term and renewal
This MSA begins on the Effective Date and continues until all Order Forms expire or terminate. Each Order Form begins and renews as stated in it. If an Order Form is silent, its initial term is 12 months and it renews for successive 12-month terms unless either Party gives at least 30 days' written notice before the current term ends.
Renewal pricing may increase only as stated in the Order Form or on at least [60] days' notice before renewal. Usage-based charges may vary according to measured use under the contracted rate.
22. Termination
Either Party may terminate an Order Form or the MSA for the other Party's material breach if the breach is not cured within 30 days after written notice. A breach incapable of cure, insolvency event, unlawful access, fraud, or material security threat may support immediate termination to the extent permitted by law. Terminating the MSA terminates all Order Forms unless the Parties agree otherwise.
Upon Customer's termination for Outpost's uncured material breach, Outpost will refund prepaid recurring fees allocable to the unused post-termination portion of the affected Order Form. Upon Outpost's termination for Customer's breach, Customer will pay fees committed through the end of the then-current Order Term, to the extent enforceable, plus usage already incurred.
23. Data export and deletion
During the term, Customer may use available export features. Upon expiration or termination and payment of undisputed amounts, Outpost will provide Customer a [30]-day period to retrieve a standard export, unless the Order Form states otherwise. Custom exports, migration, or transition services may require a statement of work and fees.
Outpost will return or delete Customer Personal Data according to the DPA. Backup, immutable-retention, legal-hold, billing, fraud, and security records may remain protected for their applicable lifecycle and may not be available for ordinary use. Customer should not rely on Outpost as the sole archival system for records Customer must retain independently.
24. Compliance with law
Each Party will comply with law applicable to its own performance. Customer is responsible for laws governing its return consumers, products, retail promises, warehouses, employees and contractors, facility safety, records, taxes, sanctions, export, and inventory disposition. Outpost is responsible for laws applicable to Outpost as a software provider and employer.
Neither Party will export or use the Services in violation of sanctions or export-control law. Customer represents that it and its Authorized Users are not prohibited parties and will not use the Services in an embargoed location except as lawfully authorized.
25. Disputes and governing law
The Agreement is governed by the laws of the State of California, excluding conflict-of-laws rules. State and federal courts located in San Diego County, California have exclusive jurisdiction, and each Party consents to personal jurisdiction and venue. EACH PARTY WAIVES TRIAL BY JURY TO THE MAXIMUM EXTENT PERMITTED BY LAW.
Before filing a claim, a Party will give written notice and allow at least 30 days for executives with settlement authority to attempt resolution in good faith. Either Party may seek temporary or injunctive relief to protect security, Confidential Information, or intellectual property without completing escalation. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
26. Notices
Legal notices must be in writing and sent by personal delivery, nationally recognized overnight courier, or email with confirmation to the addresses below or a replacement address given by notice. Operational notices may be sent through the Services or to account contacts.
Email notice is effective on confirmed receipt; courier notice is effective on delivery. Security Incident notices are governed by the DPA.
27. General
Neither Party may assign the Agreement without consent, except to an Affiliate or in connection with a merger, reorganization, financing, or sale of substantially all relevant assets, if the assignee assumes the obligations and is not a direct competitor of the nonassigning Party. A prohibited assignment is void.
Outpost may use subcontractors and remains responsible for its contractual obligations. The Parties are independent contractors; no partnership, franchise, fiduciary, agency, employment, or exclusive relationship is created. There are no third-party beneficiaries except as expressly required by the DPA or transfer terms.
Neither Party is liable for delay caused by events beyond reasonable control, excluding payment obligations. The affected Party will mitigate and resume performance promptly. If a force-majeure event materially prevents the affected Services for more than 30 consecutive days, Customer may terminate those Services and receive a refund of prepaid recurring fees allocable to the unused post-termination portion.
Failure to enforce is not a waiver. If a provision is unenforceable, it will be modified to the minimum extent necessary and the remainder remains effective. Headings are for convenience. The Agreement is the entire agreement on its subject and supersedes prior proposals and discussions. Amendments must be in writing signed by authorized representatives, except updates expressly permitted by the DPA. Counterparts and electronic signatures are effective.
Sections that by nature should survive will survive, including payment, confidentiality, intellectual property, disclaimers, indemnification, liability limitations, data lifecycle, disputes, and general terms.
Signatures
Suggested Order Form fields
- Customer legal name, billing entity, addresses, and contacts.
- Services, plan, features, facilities, integrations, and implementation scope.
- Initial term, renewal, notice deadline, and launch date.
- Recurring fees, included usage, usage definition, overage rates, taxes, invoice cadence, and payment terms.
- Support tier and any signed service-level commitment.
- Data region, export window, deletion period, and special data restrictions.
- Security contacts and DPA/subprocessor URL.
- Negotiated liability cap, if any; indemnity changes, if any.
- Any insurance requirement expressly negotiated for the deal; none applies by default.
- Governing law or venue deviation, if any.
- Specific MSA sections modified by the Order Form.