Privacy Policy

Last updated: 19 August 2026 · Avolvia (Pty) Ltd t/a GoStartr

Avolvia (Pty) Ltd, trading as GoStartr ("GoStartr", "we", "us", "our"), operates the GoStartr platform, GoStartr Mail, the Abby AI voice agent, and related sales-enablement, AI training, and implementation services (collectively, the "Services"). This policy explains what personal information we collect, why, how we use, protect, share, retain, and disclose it, and the rights and choices you have. It applies to visitors, prospects, account holders, their team members, and individuals whose information is processed through the Services, wherever they are located, including the United States, Canada and South Africa.

Two roles. For our own website, marketing, and account administration, GoStartr is the controller / responsible party / business (the term each law below uses). When a customer uses the Services to manage their own leads, contacts, mailboxes, and calls, GoStartr acts as a processor / operator / service provider on that customer's behalf and instructions, and the customer is the controller. For processor data, the customer's own privacy notice governs, and requests should be directed to that customer; we will support them as required by our contract and applicable law.

1. Who is responsible & how to reach us

Entity: Avolvia (Pty) Ltd, trading as GoStartr, a private company incorporated in South Africa
Registered address: The Colab, 194 Bancor Avenue, Menlyn Maine, Pretoria, 0081, South Africa
Information Officer / privacy contact: Bruce T. Steyn
Email: privacy@gostartr.com
Phone: +27 82 233 3529

Contact us for any privacy request, question, or complaint. We respond within the timeframes required by the law that applies to your request (see section 11).

Flagged for update. GoStartr is in the process of forming a United States affiliate. Once that entity exists and takes on US customer contracts, this section should be updated to name it alongside Avolvia and to add a US mailing address and phone number for US requests specifically. Until then, Avolvia (Pty) Ltd is the only entity that exists and the only one this policy can accurately name.

2. Information we collect

Category	Examples	Source
Contact & identity	Name, email, phone, company, job title	Forms, booking page, calls, account signup
Lead & sales data	Enquiry details, interest, messages, pipeline stage, notes, deal value	You, our customers, your interactions
Voice & call data	Call recordings, transcripts, summaries, sentiment, outcomes	Abby AI voice agent calls (with consent)
Google user data	Your email address and basic profile; permission to send email on your behalf; calendar events we create or read for scheduling	Google account you connect (OAuth)
Communications	Emails and messages you send/receive through the Services, delivery and bounce metadata	Your use of GoStartr Mail
Usage & technical	IP address, device/browser, pages viewed, cookies, log data	Automatically, when you use the site/app
Account & billing	Login credentials (hashed), workspace settings, plan, billing details processed by our payment provider	Registration and use

3. Google user data & Limited Use

When you connect a Google account, we request only the access needed to provide the features you enable: permission to send email as you (gmail.send), your email address and basic profile, and calendar access to create and manage scheduling events. We request the narrowest scopes required and do not request permission to read the full contents of your inbox for general use.

GoStartr's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features you request; we do not sell it; we do not use it for advertising; we do not allow humans to read it except with your consent, for security or legal reasons, or where processing is limited to abuse detection or is aggregated/anonymized. We do not transfer it except as needed to provide the Services, comply with law, or as part of a merger or acquisition with your notice.

4. Why we process it

To respond to enquiries, book meetings, and deliver the Services you request.
To send and track email you originate through GoStartr Mail from your connected account.
To follow up on leads, including automated email and AI voice calls where the individual provided their details and consented to contact.
To operate, secure, troubleshoot, and improve the platform. We train and tune AI features only on aggregated or de-identified data, or on a customer's own data on their instruction; we do not train models on your connected Google mailbox content.
To process payments, prevent fraud and abuse, and enforce our Terms.
To comply with legal, tax, and regulatory obligations and respond to lawful requests.

Under POPIA, our lawful bases include your consent, performance of a contract with you or your employer, and our legitimate interests in operating and securing the Services, balanced against your rights. Under PIPEDA, we rely on your meaningful consent (express or implied, depending on the sensitivity of the information and your reasonable expectations) for each purpose above.

5. Voice AI (Abby), call recording & messaging consent

Where an individual submits details on a GoStartr or customer landing/booking page, they must affirmatively consent to be contacted, including by an automated AI voice agent (Abby) and to that call being recorded. We store the consent wording shown and the date/time it was given. Abby self-identifies as artificial when asked. Calls may be recorded and transcribed to qualify the enquiry, schedule meetings, and improve quality; recording notice is provided at the start of the call, and calls into US two-party-consent states are handled accordingly. Automated calls and texts to US numbers are made only consistent with the Telephone Consumer Protection Act (TCPA) and applicable state law; to Canadian numbers, consistent with CASL and the CRTC's Unsolicited Telecommunications Rules; to South African numbers, consistent with POPIA section 69. Marketing email complies with the CAN-SPAM Act (US), CASL (Canada), and POPIA (South Africa), and includes a working unsubscribe in every message. Any recipient may end a call, reply STOP to texts, use an unsubscribe link, withdraw consent, or ask not to be contacted at any time.

6. How we share information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. We disclose information only to:

Service providers / sub-processors / operators that help us run the Services under contract and on our instructions, e.g. cloud hosting and databases (Google Cloud / Firebase), email and telephony infrastructure, AI model providers, calendar/scheduling, analytics, and payment processing.
Our customers, where you interact with a business that uses GoStartr, so they can manage the relationship.
Professional advisors (legal, accounting, security) under confidentiality.
Authorities and third parties where required by law, to respond to lawful requests and legal process, to protect rights, safety, and security, to enforce our Terms, or in connection with a merger, financing, acquisition, or sale of assets (with notice where required).

A current list of sub-processors is available on request from privacy@gostartr.com.

7. International transfers

GoStartr is based in South Africa. We and our sub-processors process personal information in South Africa, the United States, and other countries where our infrastructure providers operate (for example, our hosting is on Google Cloud / Firebase, which processes data in the US and elsewhere). This means personal information collected from a customer or contact in the United States, Canada, or South Africa may be transferred to and processed in a different one of those countries, and by us as a South African company.

For transfers of personal information out of South Africa (POPIA section 72), we rely on one or more of: your consent; the transfer being necessary to perform a contract with you or in your interest; or the recipient being subject to a law, binding corporate rules, or a written agreement that provides an adequate level of protection substantially similar to POPIA's conditions, which we require of our sub-processors by contract. For personal information we receive from Canadian contacts, we take the position under PIPEDA that we remain accountable for it after transfer and require our sub-processors to protect it to a comparable standard through contract. For US contacts, US privacy law does not generally restrict outbound transfer, but we apply the same contractual safeguards to all sub-processors regardless of the contact's location.

8. Retention & deletion

We keep personal information only as long as needed for the purposes above, to meet legal, tax, and accounting obligations, resolve disputes, and enforce agreements. The specific periods we apply to each category of record, and how each period was set, are in our Data Retention Policy. When you disconnect a Google account or close your account, we stop accessing your Google data and delete stored tokens; connected data is deleted or de-identified within a commercially reasonable period unless retention is legally required. You may request deletion at any time (see Section 11).

9. Security

We apply administrative, technical, and physical safeguards including encryption in transit, encryption of stored OAuth tokens, access controls, least-privilege access, and monitoring, consistent with POPIA's section 19 security-safeguards condition, PIPEDA's safeguards principle, and general US and Canadian data-security expectations for a company of our size. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

10. Data breach notification

We maintain an incident-response process. In the event of a security compromise affecting your personal information, we will investigate, take steps to contain and remediate it, and notify affected individuals, our customers, and regulators without undue delay. Depending on where you and the affected data are, this notification is made: to the South African Information Regulator and affected individuals as soon as reasonably possible under POPIA section 22; to affected individuals and, where the breach creates a real risk of significant harm, to the Privacy Commissioner of Canada under PIPEDA's breach-of-security-safeguards provisions; and to affected individuals and the relevant state regulator within the timeframes required by applicable US state breach-notification laws. Where GoStartr acts as a processor, we will notify the relevant customer (controller) so they can meet their own obligations.

11. Your rights & choices

Depending on where you live, you may have some or all of the following rights, which you can exercise by emailing privacy@gostartr.com. We will not discriminate against you for exercising them. We will ask you to verify your identity before acting on a request.

United States (including California's CCPA/CPRA)

Know and access the personal information we hold about you and how we use and disclose it.
Correct inaccurate personal information.
Delete personal information, subject to legal exceptions.
Opt out of any "sale" or "sharing" of personal information (note we do not sell or share it) and limit use of sensitive personal information.
Appeal a decision, and designate an authorized agent to act for you.
If you believe we have not resolved your request appropriately, you may contact your state Attorney General or, for California residents, the California Privacy Protection Agency.

Canada (PIPEDA, and Québec's Law 25 where applicable)

Be told, on request, what personal information we hold about you, how it has been and is being used, and to whom it has been disclosed.
Access your personal information and challenge its accuracy and completeness, and have it amended.
Withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.
Challenge our compliance with PIPEDA's ten fair-information principles by contacting us first, and then, if unresolved, the Office of the Privacy Commissioner of Canada.
If you are in Québec, you may also request information about any decision made about you based exclusively on automated processing, and request that a Québec-specific privacy impact assessment be considered for any transfer of your information outside Québec; Bruce Steyn acts as the privacy officer responsible for Québec residents' requests, at the contact in section 1.

South Africa (POPIA)

Be notified that personal information about you is being collected (section 18), including our identity, the purpose, and whether supplying it is voluntary or mandatory.
Access the personal information we hold about you (section 23), and request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained (section 24).
Object, on reasonable grounds, to processing of your personal information (section 11(3)), and object to processing for purposes of direct marketing (section 69).
Not be subject to a decision based solely on automated processing which affects you in a significant way, without an opportunity to make representations (section 71). We do not currently make any solely automated decision about a data subject that has a legal or similarly significant effect; Abby AI supports human decision-making, it does not replace it.
Lodge a complaint with the Information Regulator of South Africa: enquiries@inforegulator.org.za · +27 10 023 5200 / 0800 017 160 · inforegulator.org.za.

12. Cookies & analytics

We use essential cookies to run the site and app and limited analytics to understand usage. You can control cookies through your browser; disabling some may affect functionality.

13. Children

The Services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18, and we do not knowingly process the personal information of a child as defined under POPIA except where a specific POPIA section 35 ground applies. If you believe a minor has provided information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The "last updated" date reflects the latest version. We will provide notice of material changes through the Services or by email where appropriate.

15. Contact

Privacy questions or requests: privacy@gostartr.com · Bruce T. Steyn, Information Officer · +27 82 233 3529 · The Colab, 194 Bancor Avenue, Menlyn Maine, Pretoria, 0081, South Africa.

See also our Terms & Conditions and Data Retention Policy.