Data processing addendum

This addendum forms part of the terms between Axionary Labs (“we”, “us”) and a customer that uses Caute to process personal data on its own behalf, such as a team on the Team plan (“you”). It applies wherever data protection law, such as the GDPR, the UK GDPR or US state privacy laws, applies to that processing. Where it differs from the terms on personal data, this addendum wins. If you need a signed copy, write to legal@axionarylabs.com.

1. Who does what

You decide what is saved in Caute and why, so for that personal data you are the controller and we are your processor. We process it only to provide Caute to you, as the terms, this addendum and your use of the product instruct, and we’ll tell you if we think an instruction breaks the law. For the account data we need to run the service and bill you, such as sign-in records, we are a controller ourselves, as the privacy policy says.

2. What is processed

• Subject matter and purpose: keeping what your people save, and making it findable and usable for them and for the apps and assistants they connect.
• Nature: storing, encrypting, extracting text from, transcribing, indexing, searching, summarising and, at your direction, sending to the apps you connect.
• Duration: for as long as you use Caute, then until deletion as in section 8.
• Data subjects: your people, and anyone named or shown in what they save.
• Categories of data: names, email addresses and whatever else appears in saved pages, files, emails, recordings, notes and conversations. Caute isn’t designed for special categories of data, such as health records; if you save them, you decide that it is lawful.

3. Confidentiality

Everyone at Axionary Labs who can reach your data is bound to keep it confidential. Nobody looks at your library in the ordinary course of running Caute. Access for an investigation you ask for, or that the law requires, is limited, approved and logged.

4. Security

We keep the technical and organisational measures on our security page, which is part of this addendum. In short: each space’s files are encrypted with keys held in AWS’s key management service; the database itself refuses to return rows from spaces a caller can’t read; files from outside are scanned and opened in sandboxes with no network; every read and write by an app or token is recorded; and connections use TLS. We may improve these measures, never weaken them.

5. Subprocessors

You authorise the subprocessors on our subprocessors page. Each is bound by a written agreement giving your data at least the protection this addendum does, and we remain responsible for them. We’ll update that page at least 30 days before a new subprocessor handles what you save; if you object on reasonable data protection grounds and we can’t resolve it, you may end the affected service and be refunded for the time left unused. The apps and assistants you connect, an AI key you add, and your own company sign-in provider aren’t our subprocessors: you chose them, and they act under your agreements with them.

6. Helping you

• People’s requests: Caute lets you find, export, correct and delete what is saved, which answers most requests to access, correct, move or erase data. If a request reaches us, we’ll pass it to you and won’t answer it ourselves unless the law requires.
• Assessments: we’ll give you the information you reasonably need for a data protection impact assessment or a consultation with a regulator.
• Audits: we’ll answer reasonable written questions about how we meet this addendum, once a year or after an incident. Caute hasn’t had an independent audit or certification; we’ll say so on the security page when it has.

7. If something goes wrong

If we become aware of a breach of security that leads to your personal data being lost, changed, disclosed or accessed without authorisation, we’ll tell you without undue delay, and within 72 hours, with what we know: what happened, what data and how many people it may touch, what we are doing, and who to ask. We’ll add what we learn as we learn it. Write to security@axionarylabs.com to report one.

8. When it ends

Anyone on your team can export what they can read at any time, in Caute’s open card format. What you delete, and what an account held when it is closed, is deleted at once, and from backups within 10 days. We keep nothing afterwards except what the law requires, such as billing records.

9. Transfers

Caute runs in the United States, and its subprocessors process data there. Where the law requires a safeguard for personal data leaving the European Economic Area, the United Kingdom or Switzerland, the European Commission’s standard contractual clauses (module two, controller to processor, with module three for our subprocessors), the UK addendum to them, and the Swiss amendments are part of this addendum, with the details in section 2 and on the security and subprocessors pages as their annexes, the law of Ireland governing the clauses, and its courts deciding disputes about them. If they conflict with this addendum, the clauses win.

10. The rest

Liability under this addendum is as the terms limit it, except where the law or the clauses don’t allow that. We may update this addendum, and will tell you before a change that lessens its protection takes effect. Questions: privacy@axionarylabs.com.