BaseStack closed alpha: 14 days, free.

1. Parties, purpose and duration

This agreement is between Atten-X Companies LLC (“Atten-X,” “we”) and the company identified in the acceptance form (“Participant,” “you”). It grants a non-exclusive, non-transferable right to use BaseStack internally for evaluation, with authorized staff and contractors under your responsibility. You retain ownership of your data; Atten-X retains ownership of its pre-existing software and tools. Feedback may be used to improve the product without payment, but does not authorize disclosure of your confidential information or use of your name or logo.

The Alpha is free. Your 14-day period starts when we send working access credentials and written start and end dates. There is no automatic renewal, charge or promise of a future product. Either party may end the Alpha early by written notice. We may suspend access promptly for a security threat, unlawful use or material breach. The Alpha does not include ownership of the server, warehouse, pixel or dashboard. Continued use after the Alpha requires a new written agreement with its own terms, agreed before expiry, which may include a one-time fee and hosting charges. Absent that agreement, all pilot data is deleted as described in section 7.

2. What the Alpha includes

We set up a dedicated AWS Lightsail server and reporting database (your warehouse) for your brand, install the BaseStack pixel on your storefront, connect Shopify, Meta and Google Ads, and attempt a backfill of up to one year of available data. Platform approval, API limits and available history may restrict coverage. The Atten-X Team provides an initial starter dashboard and read-only reporting credentials via an approved private connection, not an open database port.

You agree to participate in a kickoff call for account onboarding, a 30-minute workflow interview, and an end-of-trial feedback call. Feedback covers usability, missing capabilities and what the service would be worth to you. Calls may be combined by agreement. Support is best-effort; there is no uptime guarantee, response-time commitment or obligation to build additional features.

3. Permissions and the read-only boundary

You authorize us to retrieve data from accounts you control and to configure the agreed app, pixel, webhooks and reporting services. Meta and Google Ads reporting access is read-only; the Alpha does not manage campaigns, budgets or ads. Shopify data extraction is read-only, but installation, tracking configuration and identifier/cart metadata can require limited writes. These exceptions must be disclosed and approved during onboarding. We do not intentionally change prices, inventory or order financial records.

Use platform authorization or an agreed secure transfer method, never a password or token in these forms or ordinary email. Grant only necessary permissions. You may revoke authorization at any time, which can stop the service. Database access does not include permission to expose network ports, change host security, share administrative credentials or bypass access controls.

4. Data, purpose and access

You own these records. You instruct us to collect, copy into your isolated database, organize, match and display them only for your Alpha and necessary support/security. Identity matching and attribution are estimates, not guaranteed facts. We do not sell or rent data, share it with other participants, use it for unrelated marketing, train AI models on it or build a cross-brand identity pool.

Access is limited to your authorized users, authorized members of the Atten-X Team who need it for setup, maintenance, security or support, and AWS as infrastructure provider. Personnel are subject to confidentiality obligations. We do not routinely browse customer records, but troubleshooting may require limited inspection. We do not create unrelated exports or secondary datasets. Disclosure legally required by an authority is permitted, with notice unless prohibited.

5. Privacy and security responsibilities

A brand-isolated, first-party implementation is not exempt from privacy law. You decide the purposes of processing and act as controller/business where applicable; Atten-X acts as processor/service provider on your documented instructions. AWS hosts the system as a subprocessor. Hosting region and any necessary data-processing or international-transfer terms must be agreed before live personal data is connected. Additional subprocessors require prior written notice and a reasonable opportunity to object or end the Alpha before their use.

You confirm you have authority to provide the data and access, comply with platform terms, and maintain required notices, lawful bases, consent and opt-out mechanisms, including applicable advertising and tracking choices. We configure collection to honor agreed consent signals and do not knowingly circumvent those choices. Tracking must remain disabled until those controls are verified. Do not provide specially regulated or children’s data without a separate written assessment and agreement.

Before live access, we will verify tenant isolation, HTTPS, encryption at rest for pilot storage, restricted administrator access, least-privilege reporting roles, protected secrets and firewall rules blocking public database access. AWS IAM governs AWS control-plane access; it does not replace application, host or database authentication. Dashboard and collection HTTPS endpoints may be internet-accessible; the database must not be. No system is completely secure.

We will notify you without undue delay after becoming aware of a personal-data breach affecting your pilot, share available information and cooperate on containment and legally required notifications. We will reasonably assist with relevant data-subject requests, processing information and compliance verification. You manage your users, credentials, devices and any notifications you are legally responsible for. These duties are not eliminated by the risk provisions below.

6. Your AI tools and custom work

You may build dashboards, queries and reports using your approved reporting access. You are responsible for tools you select, custom code, query load, exports and third-party access you authorize. Prefer aggregated or de-identified data. Do not put access tokens or raw personal data into an AI service without reviewing its retention, training and privacy terms and obtaining any required authorization.

A read-only query can still expose data or overload a server. Do not send host/admin credentials to AI tools, disable security controls or let custom services publish personal data. We may restrict unsafe activity. Losses caused by your unauthorized changes, credential sharing or third-party services are your responsibility to the extent caused by those actions; this does not excuse Atten-X’s own non-waivable duties.

7. Expiry, deletion and records

At expiry or earlier termination, we stop collection and revoke pilot access. As part of closeout, we permanently delete imported and derived pilot data, stored source tokens and reporting credentials from systems under our control, including pilot snapshots, backups and data-bearing support exports or logs. We will not retain a reusable copy. We coordinate removal/disablement of the app, pixel and webhooks; you must revoke platform permissions and remove any remaining code under your control. We provide written closeout and deletion confirmation.

Export anything needed before expiry; no post-trial recovery is promised. Deletion does not erase originals in Shopify, Meta or Google, or copies you or your tools created. Cloud-provider physical media sanitization follows AWS processes and is not a promise of immediate physical erasure. Any legally mandated retention is limited to what is required, isolated from further use and deleted when that obligation ends; we notify you unless prohibited.

We retain a minimal agreement/acceptance record, business contact information and a deletion record as needed for legal compliance and dispute handling, not your commerce or tracking dataset. Confidentiality, ownership and applicable liability terms survive closeout.

8. Risk acknowledgment, disclaimer and liability limit

9. Acceptance and general terms

The person accepting confirms authority to bind Participant. Checking the agreement box, typing your name, and submitting this form constitutes electronic acceptance of this Software Access Agreement and the 14-day Alpha summary above. An acceptance record is stored and a copy can be provided. Pilot activation requires completed acceptance and Atten-X’s written start confirmation. Notices may be sent by email between your designated contact and the Atten-X onboarding contact identified before activation.

This agreement and the Alpha summary describe the entire Alpha arrangement; this agreement controls any conflict. Changes require written agreement, not a silent website edit. If a provision is unenforceable, the rest remains effective to the extent lawful. This agreement does not impose arbitration, a class-action waiver or a chosen court or jurisdiction.