Privacy Policy

Note: This policy is provided as a starting template and reflects standard POPIA-compliant practices. Before launching publicly or onboarding paying clients, have it reviewed by a qualified South African attorney specialising in data protection / POPIA.

1. Who we are

Receva ("we", "us", "our") is a sole proprietorship operating in South Africa, providing AI voice receptionist services to businesses. Contact: hello@receva.co.za.

We are committed to compliance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"), and to handling your personal information lawfully, fairly, and transparently.

2. What information we collect

We collect:

• Account information. when you sign up: name, email, phone, business name, billing address.
• Call data. when our AI handles calls on your behalf: call recordings, transcripts, caller phone numbers, timestamps, call duration.
• Booking / order data. names, contact details, special requests submitted by your customers via our voice agent.
• Usage data. how you interact with our dashboard and APIs (IP address, browser type, pages viewed).
• Communications. messages you send us via email, WhatsApp, or our contact form.

3. How we use your information

We use personal information to:

• Provide and improve the voice agent service.
• Train and tune your specific AI agent (using only your own data, never another client's).
• Send service-related communications (invoices, downtime alerts, product updates).
• Comply with legal obligations (tax, accounting, lawful information requests).
• Investigate and prevent fraud or abuse of the service.

4. Lawful basis for processing

We process personal information only when one of the lawful bases under POPIA applies. typically:

• Performance of a contract with you.
• Compliance with a legal obligation.
• Your consent (which you may withdraw at any time).
• Our legitimate interest in operating and securing the service.

5. Sharing with third parties

We share data only with operators (sub-processors) strictly necessary to deliver the service. As of the last update, these include:

• Vapi. voice agent infrastructure
• OpenAI. language model processing of call transcripts
• ElevenLabs. text-to-speech voice generation
• Telnyx. telephony / phone number provider
• Vercel. website hosting
• Cal.com / Google. calendar booking integrations (only if you enable them)

Some of these operators are based outside South Africa. We use them only where they meet POPIA's cross-border transfer requirements (binding contractual safeguards or adequate protection in the destination country).

We do not sell, rent, or trade personal information to advertisers or data brokers.

6. Data retention

• Call recordings: 90 days by default, configurable per client.
• Transcripts: 12 months for service quality and dispute resolution.
• Account information: while your account is active, plus 5 years for tax/accounting compliance after closure.
• You can request earlier deletion at any time (see Section 8).

7. Security

We use industry-standard technical and organisational measures to protect personal information, including encryption in transit and at rest, role-based access controls, and regular review of our sub-processors' security posture. No system is 100% secure; if a breach occurs, we will notify the Information Regulator and affected data subjects as required by POPIA.

8. Your rights

Under POPIA you have the right to:

• Be notified that we hold your information.
• Access the information we hold about you.
• Request correction or deletion.
• Object to processing.
• Lodge a complaint with the Information Regulator.

To exercise any right, email hello@receva.co.za. We will respond within 30 days.

9. Cookies

Our website uses essential cookies only. for session management and basic analytics. We do not use advertising or tracking cookies.

10. Information Officer

Our Information Officer (as required by POPIA) is Ruan Grobler, contactable at hello@receva.co.za.

11. Information Regulator

You may contact the Information Regulator of South Africa at:

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• complaints.IR@justice.gov.za
• inforegulator.org.za

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified to active clients by email at least 14 days before taking effect.