Privacy Policy

Effective date: October 9, 2026 · Version v2026-10-09

Cache CRM (“Cache”, “we”, “us”) is a customer relationship management platform for home-service businesses. Cache CRM is a product of SoCal Cleaner, LLC. This policy explains what personal information we collect, where it comes from, why we collect it, who we share it with, how long we keep it, and what choices you have.

This policy covers two different groups of people, and the difference matters:

• Our customers — the businesses that sign up for Cache and the people who use it on their behalf. Each business gets an isolated tenant we call a Workspace. For their account data, Cache is the controller.
• Our customers' customers — the homeowners and businesses whose contact details, jobs, messages, estimates and invoices a Workspace stores inside Cache. For that data, Cache is a processor and a service provider: the Workspace decides what is collected and why, and we handle it on their documented instructions under our Data Processing Addendum. If you are one of these people and want your information corrected or deleted, contact the business you hired; you may also contact us at support@cachecrm.com and we will route the request to them.

1. Information we collect

Account information

When someone creates a Cache account or is invited to a Workspace, we collect their name, email address, phone number, password credential (or Google sign-in identifier), role, company name, legal entity name, business address, business phone, timezone and any logo they upload. If a user signs in with Google, we receive their name, email address and profile image from Google — never their Google password. When you accept our Terms of Service or Privacy Policy, we record the version accepted, the date and time, a hashed form of your IP address, and your user agent.

Workspace (CRM) data

Workspaces enter and generate business records in Cache: contacts (names, phone numbers, email addresses, service addresses, tags, notes), leads, jobs and schedules, estimates, invoices and payment records, call logs, and message threads. This content belongs to the Workspace. We store and process it to provide the service, and we do not use it to build advertising profiles or sell it to anyone.

Messages and calls

Cache sends and receives SMS through Twilio and email through Resend on behalf of Workspaces. We store message and email content, sender and recipient addresses or numbers, timestamps and delivery status. For calls placed or received through Twilio we store call metadata (direction, duration, outcome) and, where a Workspace has enabled call recording with the consent that its state requires, the recording link and any transcript Twilio returns. Voicemails a caller chooses to leave are recorded, stored and may be transcribed the same way.

Call recording is off by default. A Workspace administrator must turn it on. When it is on, the other party hears a recording announcement (for example, “This call may be recorded”) before recording begins — on inbound calls before the call is connected, on outbound calls as soon as the customer answers — so that calls with people in all-party-consent states such as California (Cal. Penal Code § 632) are lawful. Recordings and transcripts belong to the Workspace, are kept as described in Section 7, and can be deleted by the Workspace. The Workspace is responsible for any additional notice or consent its industry or its own customers’ laws require.

We store SMS opt-in and opt-out status for each contact, together with a Workspace-wide opt-out registry: the keyword or carrier signal that caused the opt-out, the number involved, and when it happened. This includes STOP, START and HELP keyword handling and opt-out signals reported to us by carriers. For email, we store unsubscribe status for non-transactional mail.

Payment information

Card details never touch Cache servers. Card payments are collected and processed by Stripe. Cache stores only Stripe identifiers (customer ID, payment method ID), the last four digits and card brand as returned by Stripe, the amount, the currency and the payment status. We never store full card numbers, CVV codes or magnetic-stripe data. In the iPhone app, a team member saving a customer’s card types it into Stripe’s own secure card field, and the number goes from that field directly to Stripe. Payments in Cache are a Workspace’s customers paying that business for its services; Cache does not sell anything to you inside the iPhone app. Non-card payments a Workspace records manually — cash, check, Zelle, other — are stored as an amount, a method label and an optional confirmation number.

Usage and device information

We collect standard technical information when the app or website is used: IP address, browser or app version, operating system, device type, pages or screens viewed, timestamps, and server-side request and error logs. If you use the mobile app and turn on notifications, we store the push notification token your device issues. We use this to keep the service running, to investigate abuse, and to fix defects.

The Cache iPhone app

The iPhone app asks for device permissions only when you use the feature that needs them, and you can change each one at any time in iOS Settings → Cache:

• Microphone — only to carry the audio of business calls you place or answer in the app. Cache does not listen or record through the microphone outside a call; whether a call is recorded is the Workspace setting described above.
• Camera and Photos — only to take or pick the photos and documents you choose to attach to a message, a record, your profile or your company logo. Cache never reads your photo library in the background.
• Notifications — to alert you to new messages, leads, payments and calls. Push notifications are delivered through Apple Push Notification service and Expo. Incoming calls use Apple’s VoIP push and CallKit, so the system call screen shows the caller’s name or number.

The app does not access your device contacts or your location, does not use the advertising identifier, does not track you across other companies’ apps or websites, and contains no advertising or analytics SDK. If the app crashes, a crash report (error details, app version, device model and a pseudonymous account identifier — never message content, email addresses or phone numbers) is sent to Sentry so we can fix the defect.

Location and addresses

Cache uses the Google Maps Platform, including Places, to autocomplete and validate service addresses that a Workspace enters. Address lookups you type are sent to Google to return suggestions. Cache does not track device location in the background.

Cookies and similar technologies

We keep this minimal. The marketing site at cachecrm.com uses no advertising cookies, no analytics SDK, no session replay and no cross-site tracking pixels. The application uses cookies and local browser storage that are strictly necessary to keep you signed in, remember your active Workspace, and hold your interface preferences. We do not sell or share information for cross-context behavioral advertising.

Where the information comes from

We collect personal information from: you directly, when you create an account, fill in a form on our website, or contact support; the Workspace you belong to or are a customer of, when it enters or imports records about you; your device and browser automatically, when you use the app or website; our sub-processors, which report delivery status, opt-out signals, payment results and similar operational data back to us; and the third-party integrations a Workspace chooses to connect.

2. Mobile Information and SMS Consent

Phone numbers and SMS opt-in consent collected through the form at cachecrm.com/#contact, inside the Cache application, or by a Workspace from its own customers are used only to deliver the messages the user requested — and for nothing else.

Specifically:

• We use the mobile number you give us to schedule and confirm demos, to send account and security notifications, and to reply to your support requests.
• Where a Workspace has collected consent from its own customer, that number is used to deliver the appointment reminders, estimates, invoices and service updates from the business that customer hired.
• Consent is never a condition of buying anything. You may withdraw it at any time by replying STOP to any message, or by emailing support@cachecrm.com. A STOP is applied across every number in that Workspace, not only the number you replied to, and we send one confirmation message. Reply START to opt back in, or HELP for the program name and contact details.
• Automated and scheduled messages are sent only between 8:00 a.m. and 9:00 p.m. in the sending Workspace's local time zone.
• We share mobile numbers with our messaging carrier (Twilio) solely to transmit those messages. We do not share, sell, rent or lease mobile numbers or opt-in data to marketers, data brokers, affiliates or lead generators.

See our SMS Terms & Conditions for the full messaging program disclosure.

3. How we use information

• To provide, operate and maintain the Cache platform and its features.
• To create and secure accounts, authenticate users, enforce Workspace isolation and record acceptance of our agreements.
• To send transactional messages you or a Workspace asked for: SMS, email, appointment reminders, estimates, invoices and receipts — and to send push notifications to devices that enabled them.
• To record and honor opt-outs and unsubscribes, and to evidence them if a complaint is later made.
• To process payments and record them against the correct invoice.
• To respond to demo requests, support tickets and bug reports.
• To calculate the dashboard metrics a Workspace relies on — revenue, active jobs, conversion, recurring revenue, collected versus outstanding.
• To detect, investigate and prevent fraud, abuse, spam and security incidents.
• To comply with legal obligations, including telecommunications and tax rules.
• To improve the product — using aggregated or de-identified information wherever that is sufficient.

Cache does not use Workspace CRM content or message content to train machine-learning models, and we do not sell personal information. Separately, and only when a Workspace switches on an AI integration and supplies its own API key, that Workspace's automations and AI assistants can send message text and contact fields to a third-party AI provider — see Section 5.

4. Legal bases

Where a legal basis is required, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (securing the platform, preventing abuse, improving the product), consent (SMS messaging and optional communications), and compliance with legal obligations.

5. Sub-processors and service providers

Cache runs on third-party infrastructure. Each provider below receives only the data needed for its function, under a contract that restricts its use and requires it to protect that data to the same or an equal standard as this policy. The same list, with locations, is published at cachecrm.com/subprocessors. We will give at least 30 days' notice before adding a new sub-processor; email support@cachecrm.com to be added to that notice list.

Core sub-processors — used for every Workspace

Optional sub-processors — only if a Workspace turns them on

AI assistance

AI features are off by default. A Workspace administrator must connect a provider and paste that Workspace's own API key before anything is sent. When an AI automation runs, the prompt the Workspace wrote is filled in server-side and sent to the provider it chose. The fields that can be substituted into a prompt are: workspace name; the body of the last inbound message (up to 2,000 characters); contact first name, last name, full name, phone, email and company; job date, time, revenue and status; invoice number, amount and due date; estimate total; and lead name, phone, email, pipeline, stage and assigned user. Service addresses, contact notes and payment data are not sent.

A Workspace can also switch on an AI assistant that replies to inbound texts, emails or phone calls on the Workspace's behalf (for example, after business hours). When it is on, the conversation with that customer — the messages exchanged, the contact's name, phone number, email and service address, and the Workspace's pricing and booking instructions — is sent to the AI provider the Workspace selected (Anthropic, Google or ElevenLabs for voice) to generate each reply. The assistant identifies itself as an AI at the start of the conversation, a person can take over at any time, and the Workspace administrator must give explicit consent before the first assistant is enabled. The provider processes this content to produce the reply and does not use it to train models under our agreements; we keep the conversation only as part of the Workspace's normal message history.

Because the Workspace supplies its own key, the Workspace is contracting with that provider directly and the provider's own terms — including whatever retention or human-review practices they permit — govern what happens to the content. Cache does not hold a shared AI key, does not train models on Customer Data, and does not send anything to an AI provider for a Workspace that has not enabled one. AI output can be written to a contact note or sent to a customer as SMS or email by the Workspace's automation; the Workspace remains the sender and is responsible for that content.

6. When we share information

We share personal information only in these situations:

• With the sub-processors above, to operate the service.
• Within a Workspace, with the other members of that Workspace, according to their assigned role and permissions.
• With the Workspace whose customer you are, if you are an end customer whose record lives in their account.
• For legal reasons, when we reasonably believe disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of Cache, our customers or the public.
• In a business transfer, if Cache is involved in a merger, acquisition or sale of assets — with notice to affected customers and the same protections carried forward.

We never sell personal information, and we never share mobile numbers or SMS consent with third parties for marketing or promotional purposes.

7. Data retention

We keep information only as long as we need it for the purpose it was collected for, plus any period the law requires. By category:

We may keep information longer where we must to comply with legal, tax or telecommunications obligations, to resolve a dispute, or to enforce our agreements.

8. Security

We take the security of this data seriously and design for it rather than bolt it on:

• Data is encrypted in transit with TLS and at rest by our infrastructure providers.
• Every record is scoped to a Workspace, and database security rules enforce that a signed-in user can only read and write inside a Workspace they belong to.
• Access to production systems is limited to the small number of people who need it. Certain privileged actions — data exports, record merges, API credential changes and administrative operations — are logged. We do not currently keep a general read-access log of every record viewed.
• Card data is handled exclusively by Stripe, a PCI-DSS Level 1 service provider. Cache stores tokens, not cards.
• Secret credentials for Twilio, Stripe, Resend and any AI provider a Workspace connects live only on the server side and are never shipped to a browser or mobile app.

We do not hold a SOC 2 report or other third-party security certification today. If we obtain one we will say so here.

No system is perfectly secure. If we become aware of a breach affecting personal information, we will notify affected customers and any required regulator without undue delay, and in any event within 72 hours of confirming the breach for customers covered by our Data Processing Addendum.

9. Your rights and choices

Depending on where you live, you may have the right to:

• Know what personal information we hold about you, the categories of sources it came from, the purposes we use it for, and who we disclose it to.
• Access a copy of that information in a portable, machine-readable format.
• Correct information that is inaccurate.
• Delete information, subject to our legal retention obligations.
• Withdraw consent — including SMS consent — at any time.
• Not be discriminated against for exercising any of these rights.

How to exercise them

Workspace administrators can export their Workspace data from the application at any time and can edit or delete most records directly. You can delete your own Cache account and the personal data associated with it at any time from My Settings → Danger zone → Delete my account inside the app. That deletes your reminders and push subscriptions, removes you from every Workspace you belong to, anonymizes your user profile, and deletes your login credential immediately. If you still own a Workspace, you will need to transfer it or schedule its deletion first, from Settings → General. A minimal record of your acceptance of these terms, and related audit-log entries, is retained for three years as compliance evidence even after your account is deleted. For anything the in-app path does not cover — a complete copy of everything we hold, correction of an account record, erasure of a Workspace and its contents, or if you are unable to sign in — email support@cachecrm.com and we will complete the request within 30 days.

We will verify your identity before acting, normally by confirming that the request comes from the email address on the account and, where the request is sensitive, by asking you to confirm details we already hold. We will not use the information you give us for verification for anything else.

Authorized agents. You may designate an authorized agent to make a request for you. We will ask the agent for written permission signed by you, and we may ask you to verify your own identity with us directly.

Response times. We acknowledge requests promptly and respond within 45 days, extendable once by a further 45 days if a request is complex, and we complete account closure, deletion and erasure requests within 30 days. We do not charge for these requests and we will not treat you differently for making one.

If you are an end customer of a Cache Workspace, we will forward your request to that business, since they control the record.

California residents (CCPA / CPRA)

If you are a California resident, you have the rights to know, access, delete, correct, and to opt out of sale or sharing of personal information, and to limit use of sensitive personal information.

Cache does not sell personal information and does not share personal information as those terms are defined by the CPRA, including for cross-context behavioral advertising. We have not done so in the preceding twelve months, and we do not knowingly sell or share the personal information of anyone under 16.

In the preceding twelve months we have collected the following categories of personal information, from the sources described in Section 1, for the business purposes listed in Section 3, and disclosed each to the service providers listed in Section 5:

Sensitive personal information. We collect two categories of sensitive personal information: account log-in credentials, and the contents of the messages and emails that pass through a Workspace's inbox. We use both only to perform the service you asked for — authenticating you, and sending, receiving and displaying your messages — and for the security, fraud-prevention and service-quality purposes permitted by Cal. Civ. Code section 1798.121(d). We do not use or disclose sensitive personal information to infer characteristics about anyone. Because our use falls within those permitted purposes, we do not offer a separate “Limit the Use of My Sensitive Personal Information” option; there is nothing to limit.

You may exercise your rights, or designate an authorized agent to do so, by emailing support@cachecrm.com.

10. International users

Cache is operated from the United States, is intended for customers in the United States, and its infrastructure providers store and process data in the United States. If you use Cache from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data-protection law may differ from that of your country.

11. Children

Cache is a business tool. It is not directed to children, and it is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has given us information, email support@cachecrm.com.

12. Changes to this policy

We may update this policy as the product or the law changes. When we do, we will revise the effective date and version at the top of this page. If a change is material — for example, a new category of data, a new purpose, or a new sub-processor — we will give account holders at least 30 days' notice by email and in the application before it takes effect.

13. Contact us

Questions, requests, or anything in this policy that is not clear:

Related: Terms of Service · SMS Terms · Data Processing Addendum · Sub-processors