Terms of Service

Last updated: November 11, 2026

These Terms of Service ("Terms") are an agreement between you and HireNinja LLC ("xstate", "we", "us"), the operator of xstate.com, go.xstate.com, api.xstate.com, the xstate mobile and desktop apps, and the related email, storage, audience, agent and migration services (together, the "Service").

By creating an account, signing in, or using the Service, you agree to these Terms and to our Privacy Policy. If you use the Service for an organization, you agree on behalf of that organization and confirm you have authority to bind it; "you" then means both you and that organization.

If you do not agree, do not use the Service.

1. Who can use xstateCopy Anchor Link

• You must be at least 16 years old, or the age of digital consent where you live if higher.
• You must give accurate sign-up information and keep it up to date.
• You may not use the Service if you are barred from receiving it under the laws of your country or the United States, including sanctions and export control laws.

2. Accounts and organizationsCopy Anchor Link

• Your account. You sign up with an email and password or with Google. You are responsible for keeping your sign-in details secure and for everything done under your account. Tell us right away at hello@xstate.com if you suspect unauthorized access.
• Organizations. Domains, mailboxes, storage, audiences, agents and settings belong to an organization. The organization's admins decide who is a member, what each member can access, and can remove members. When a member is removed, the organization keeps the data that member created in its space.
• Invitations. Admins can invite people by email, including when importing from another provider. An invited person who accepts agrees to these Terms.

3. Your domainsCopy Anchor Link

• You may only connect domains that you own or are authorized to manage. We check ownership with DNS records before we accept mail for a domain or import data for it.
• You are responsible for your domain registration and DNS. If you change your MX, SPF, DKIM, DMARC or other records, mail delivery may stop or change. If you use one-click DNS setup (Domain Connect), you authorize us to add the listed records through your DNS provider.
• If your domain lapses or you lose control of it, mail for it may be lost or delivered to someone else. We are not responsible for that.

4. Free and paid featuresCopy Anchor Link

• Business email on your own domain is offered free of charge, subject to the limits in section 6.
• Some features, including AI agents, are not part of a free plan and may require a paid plan. We will show prices and limits before you are charged. Paid plans renew until cancelled, and fees are non-refundable except where the law requires otherwise or we say so in writing.
• We may introduce, change or remove plans, limits and prices. For changes that increase what you pay, we will give at least 30 days' notice, and you can cancel before the change takes effect.
• Taxes are your responsibility, except taxes on our income.

5. Your contentCopy Anchor Link

"Your Content" means everything you or your members put into the Service or receive through it: email messages and attachments, files, contacts, audience data, agent instructions and memory, and similar material.

• You own Your Content. We claim no ownership of it.
• License to us. You give us a worldwide, non-exclusive, royalty-free license to host, store, copy, transmit, index, process and display Your Content only as needed to run, secure and improve the Service for you, to follow your instructions (including those you give through agents and connectors), and to comply with the law. This license ends when Your Content is deleted from the Service, except for copies kept in backups or as required by law for a limited time.
• We don't train on it. We do not use Your Content to train AI models, and we do not sell it.
• Your responsibility. You confirm you have the rights and any consents needed for Your Content, including personal data of other people (for example, contacts and website visitors), and that Your Content and your use of the Service comply with the law.
• Backups. We take reasonable steps to protect Your Content, but the Service is not a backup service. Keep your own copies of anything important.

6. Acceptable use and sending limitsCopy Anchor Link

You must not use the Service, or let anyone else use it, to:

1. Send spam, unsolicited bulk or commercial email, or email to purchased, rented or scraped lists.
2. Send phishing, malware, or email that impersonates another person or organization or forges headers.
3. Break anti-spam and marketing laws such as CAN-SPAM, CASL, the GDPR and the ePrivacy rules, including rules on consent and unsubscribe links.
4. Store or share content that is illegal, infringes intellectual property or privacy rights, sexually exploits minors, or promotes violence or terrorism.
5. Harass, threaten or defraud anyone.
6. Probe, scan or test the vulnerability of the Service, get around limits or security controls, or access other customers' data, unless you have our written permission.
7. Overload or disrupt the Service, or use it to attack other systems.
8. Resell the Service or offer it as part of a hosting product without our written agreement.
9. Use public share links to distribute malware or content that breaks these Terms.

We apply sending limits per mailbox, domain and organization, and we watch bounce and complaint rates. We may delay, limit or block outgoing mail, suspend a mailbox, domain or organization, or remove content when we reasonably believe these rules are broken or the Service, our sending reputation or other customers are at risk. Where we can, we will tell you and give you a chance to fix the problem first.

7. AI agentsCopy Anchor Link

• Your own AI keys. Agents run on AI models from providers you choose (for example, Anthropic or OpenAI), using API keys your organization supplies. When an agent runs, we send the instructions, inputs and data the agent needs to that provider. Your use of each provider is governed by your agreement with that provider, and the provider bills you directly for usage.
• You control agents. Your organization decides what triggers an agent, what it may read, what tools it may use, and which actions need a person's approval. Actions an agent takes, such as sending email, are taken on your organization's behalf, and you are responsible for them as if a member had taken them.
• Check the output. AI output can be wrong, incomplete or inappropriate. Review it before you rely on it, especially for legal, medical, financial or other important decisions. Agents must follow section 6.
• Spend caps. Cost estimates and monthly spend caps are best-effort tools to help you control usage. They may not stop every charge, and provider charges remain your responsibility.
• Connectors and secrets. You can connect agents to third-party services (for example, MCP servers) and store secrets for them. Third-party services are governed by their own terms, and we are not responsible for them. We keep secrets encrypted and do not show their values to AI models.

8. Audience and website trackingCopy Anchor Link

If you install our website snippet or send us data through our API to track visitors, leads or customers:

• You are responsible for telling your visitors about it in your own privacy notice and for getting any consent the law requires (for example, cookie consent in the EU and UK).
• You must not use it to collect sensitive data, such as health or financial account data, or data about children.
• You must keep your Secret Key secret. Anyone with it can act on your organization's audience data.

For this data, we act as your processor or service provider, as described in our Privacy Policy.

9. Importing from other providersCopy Anchor Link

When you import from another provider (for example, Google Workspace), you authorize us to access that provider's data for your organization through the access you grant, and to copy mail, contacts, files and sharing settings into xstate. You confirm you have the authority to do so for every account you import. You can revoke our access at the provider at any time; doing so will stop the import.

10. Third-party servicesCopy Anchor Link

The Service relies on and connects to third-party services, such as DNS providers, AI providers, app stores and services you connect. We are not responsible for third-party services, and your use of them is governed by their terms.

11. Mobile and desktop appsCopy Anchor Link

Our apps are licensed to you, not sold, for use with the Service. If you download an app from the Apple App Store or Google Play, that store's terms also apply. Apple and Google are not parties to these Terms and have no obligation to support the apps.

12. Our intellectual propertyCopy Anchor Link

The Service, including its software, design, and the xstate name and logos, belongs to us or our licensors. We grant you a limited, non-exclusive, non-transferable right to use the Service under these Terms. You may not copy, modify, or reverse engineer it, except as the law allows. If you send us feedback or ideas, we may use them without any obligation to you.

13. SecurityCopy Anchor Link

We use reasonable technical and organizational measures to protect the Service and Your Content. No system is perfectly secure. You are responsible for the security of your devices, passwords, API keys and the people you give access to. Report vulnerabilities to hello@xstate.com.

14. Availability and changes to the ServiceCopy Anchor Link

We work to keep the Service available, but we do not guarantee it will be uninterrupted or error-free, and we offer no service-level commitment unless a separate written agreement says so. We may change, add or remove features. If we remove a major feature you rely on, we will try to give you reasonable notice.

15. Suspension and terminationCopy Anchor Link

• By you. You can stop using the Service at any time and delete your organization from Settings. Cancelling a paid plan takes effect at the end of the current billing period.
• By us. We may suspend or end your access, in whole or in part, if you break these Terms, if you don't pay, if we must do so by law, or if your use puts the Service, other customers or third parties at risk. Where reasonable, we will give notice first.
• Long inactivity. We may close free accounts that have had no sign-in and no mail activity for 12 months, after giving at least 30 days' notice to the account's email address.
• After termination. You will have 30 days to export Your Content where the law and circumstances allow (for example, not when the account was closed for abuse). After that we delete it, as described in our Privacy Policy. Sections that by their nature should survive, including 5, 12 and 16 to 20, survive.

16. DisclaimersCopy Anchor Link

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT THE LAW ALLOWS, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT EMAIL WILL BE DELIVERED, THAT IT WON'T BE MARKED AS SPAM, OR THAT AI OUTPUT WILL BE ACCURATE.

17. Limitation of liabilityCopy Anchor Link

TO THE FULLEST EXTENT THE LAW ALLOWS:

• WE ARE NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, EVEN IF WE WERE TOLD THEY WERE POSSIBLE.
• OUR TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE IS LIMITED TO THE GREATER OF (A) THE AMOUNT YOU PAID US FOR THE SERVICE IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (B) US $100.

Some places do not allow these limits, so they may not fully apply to you. Nothing in these Terms limits liability that cannot be limited by law, such as for fraud or for death or personal injury caused by negligence.

18. IndemnityCopy Anchor Link

You will defend and indemnify us, and our affiliates, officers and employees, against claims, losses and costs (including reasonable legal fees) arising from Your Content, your use of the Service, your agents' actions, or your breach of these Terms or the law.

19. Governing law and disputesCopy Anchor Link

These Terms are governed by the laws of the State of Delaware, USA, without regard to conflict-of-law rules. Disputes will be resolved exclusively in the state and federal courts located in the State of Delaware, and both sides consent to those courts' jurisdiction. If you are a consumer living in the EU or UK, you also keep the protection of the mandatory laws of your country and may bring claims in your local courts.

Before filing a claim, please contact us at hello@xstate.com so we can try to resolve it informally within 30 days.

20. GeneralCopy Anchor Link

• Changes to these Terms. We may update these Terms. For material changes, we will notify you by email or in the app at least 30 days before they take effect. Continuing to use the Service after that means you accept the new Terms.
• Entire agreement. These Terms, the Privacy Policy and any order form or data processing agreement you sign with us are the whole agreement between us about the Service.
• Assignment. You may not transfer these Terms without our consent. We may transfer them as part of a merger, acquisition or sale of assets.
• No waiver; severability. If we don't enforce a term, we haven't waived it. If a term is found unenforceable, the rest stays in effect.
• Notices. We send notices to the email address on your account or in the app. You can send notices to hello@xstate.com or 16192 Coastal Highway, Lewes, DE 19958, USA.

ContactCopy Anchor Link

HireNinja LLC
16192 Coastal Highway, Lewes, DE 19958, USA
hello@xstate.com