Data Processing Addendum

Last updated October 16, 2026

This Data Processing Addendum ("DPA") is between Silver Mountain Technologies, LLC, doing business as Cachejay ("Cachejay"), and the customer that uses Cachejay for a business or team ("you"). It forms part of the Terms of Service and applies whenever Cachejay processes personal data on your behalf. You accept it by using Cachejay for a team or business. To sign a copy, email hello@cachejay.com.

1. Roles

You are the controller of the personal data in your Cachejay accounts: the screen text, screenshots, transcripts and notes your people capture, and anything about others in them. Cachejay is your processor. Where you are yourself a processor for someone else, Cachejay is your subprocessor.

2. What we process

• Purpose: to provide Cachejay: sync, store and search notes and captures, write notes and summaries, and answer the AI apps your users connect.
• Data subjects: your users, and people who appear in what they capture (for example, colleagues and customers on calls or in documents).
• Data: names, email addresses, account and device records, screen text, screenshots, call transcripts, AI agent sessions, and notes derived from them. Audio is never stored or sent.
• Duration: for as long as you use Cachejay, then until deletion under section 8.

You're responsible for having a lawful basis for this processing, including telling people on calls that are transcribed and getting any consent the law requires.

3. Only on your instructions

We process personal data only to provide Cachejay and on your documented instructions. The Terms, this DPA and your use of Cachejay's settings are your instructions. We won't sell it, use it to train AI models, or use it for our own purposes. If the law requires us to process it otherwise, we'll tell you first unless the law forbids that. If we think an instruction breaks data protection law, we'll tell you.

4. Confidentiality

Everyone at Cachejay who can access personal data is bound by confidentiality, and only a small number of staff have production access, used only to operate the service or support you when you ask.

5. Subprocessors

You authorize the subprocessors listed on Subprocessors. We'll update that page before we add or replace one; email us to be told by email. You can object on reasonable data protection grounds within 30 days of the change. If we can't resolve it, you can end the affected service and we'll refund any prepaid fees for the time left. We hold each subprocessor to data protection terms at least as protective as this DPA, and we're responsible for their work.

6. Security

We maintain the technical and organizational measures described on Security, including encryption in transit, one namespace per account, hashed tokens and secrets masked before upload. We may improve them over time but won't make them materially weaker.

7. Breach notice

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your personal data, we'll notify you without undue delay, and within 72 hours. We'll tell you what we know, what we're doing about it, and keep you updated, so you can meet your own obligations.

8. Deletion

Your users can delete their cloud data, or their whole account, at any time from Account › Your data at cachejay.com/app. When your plan ends and isn't renewed, everything in the cloud is deleted 60 days later. Deleted data may remain in backups for a short time until those backups expire.

9. Helping with requests and compliance

• Data subject requests. Your users can export or delete their data themselves at cachejay.com/app, under Account › Your data. If you need more help responding to a request to access, correct, delete or move personal data, we'll provide it. If a request comes to us directly, we'll pass it to you.
• Assessments. We'll give reasonable help with data protection impact assessments and consultations with regulators, as far as they concern Cachejay.

10. International transfers

Cachejay is run from the United States, and personal data is processed there. Where personal data from the EU, EEA or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914) apply and are incorporated by reference: Module 2 (controller to processor) or Module 3 (processor to processor), as fits. For data from the United Kingdom, the UK International Data Transfer Addendum to those clauses applies. For those clauses: clause 7 (docking) applies; under clause 9 the general authorization in section 5 applies; the optional wording in clause 11 doesn't; clauses 17 and 18 choose the law and courts of Ireland; the annexes are filled in from sections 2, 5 and 6 of this DPA.

11. Audits

We'll make available the information you reasonably need to show we meet this DPA. Send a reasonable written request or a security questionnaire to hello@cachejay.com and we'll answer it. If that isn't enough to satisfy a regulator or your legal obligations, we'll agree on a further audit with reasonable notice, scope and confidentiality, at your cost, no more than once a year.

12. Everything else

If this DPA conflicts with the Terms, this DPA wins on personal data. If it conflicts with the Standard Contractual Clauses, the clauses win. The limits of liability in the Terms apply to this DPA, as far as the law allows.