Privacy Policy

1. Introduction

Goodtogoat Ltd (“we”, “us”, or “our”) trades as goodtogoat.ai and operates the goodtogoat.ai platform (the “Platform”), a B2B voice AI simulation service. We are a responsible party as defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”) and are committed to processing your personal information lawfully, fairly, and transparently.

This Privacy Policy explains what personal information we collect about you, why we collect it, how we use and protect it, and the rights you have under POPIA. It applies to all individuals who interact with the Platform, including business customers (“Customers”), end users (“Users”), website visitors, and job applicants.

Where we process personal information on behalf of a Customer, the Customer is the responsible party and we act as an operator. The Customer’s own privacy notice will also apply in those circumstances.

2. Who We Are

3. Personal Information We Collect

We collect the following categories of personal information:

3.1 Account and Contact Information

• Full name, email address, job title, employer, and location
• Login credentials (passwords are stored in hashed form only)
• Billing and payment contact details

3.2 Voice and Simulation Data

• Voice recordings and transcripts generated during AI simulations
• Prompts, scenarios, scripts, and other content uploaded or created by Customers and Users
• Feedback, ratings, and annotations provided on simulation outputs

3.3 Usage and Technical Data

• Log data including IP addresses, browser type, operating system, and device identifiers
• Pages visited, features used, session duration, and clickstream data
• Cookies and similar tracking technologies (see Section 9 below and our Cookie Consent Notice)
• Performance and error data to maintain and improve the Platform

3.4 Special Personal Information

POPIA affords heightened protection to “special personal information” (equivalent to sensitive data). We do not deliberately collect special personal information. However, voice recordings may incidentally reveal information about health, race, or other protected attributes. Where we become aware of such data, we apply additional security and access controls consistent with section 26–33 of POPIA.

4. Lawful Basis for Processing

POPIA requires that all processing of personal information satisfies at least one of the following conditions under section 11:

5. Voice Data and AI Simulations

Given the nature of our Platform, we are committed to transparency about how voice and simulation data is handled:

• Voice recordings and transcripts submitted during simulations are processed to deliver the simulation service and generate outputs for Customers and Users.
• We may use aggregated and anonymised simulation data to improve our AI models and Platform performance. Individual voice data is not used for model training without explicit, specific consent.
• Customers control which Users are invited to the Platform and are responsible for ensuring they have an appropriate lawful basis under POPIA to process their Users’ personal information through the Platform.
• Simulation data is retained in accordance with the Customer’s instructions and our data retention policy (see Section 8).
• Voice data may be processed by our third-party AI providers under operator agreements that comply with POPIA requirements (see Section 6).

6. Third Parties and Operators

We may share personal information with the following categories of recipients:

6.1 Operators (Sub-processors)

We engage the following categories of operators to process personal information on our behalf, under written operator agreements consistent with POPIA section 21:

6.2 Other Recipients

• Your Customer organisation: If you are a User, your simulation data and usage information may be accessible to your Customer’s administrators.
• Professional advisers: Lawyers, auditors, and insurers where necessary for the operation of our business.
• Law enforcement or regulators: Where required by POPIA or any other applicable law.
• Business transfers: In connection with any merger, acquisition, or sale of assets, subject to confidentiality obligations.

We do not sell personal information to third parties.

7. Cross-Border Transfers of Personal Information

The goodtogoat.ai Platform uses infrastructure and AI services hosted outside South Africa. Cross-border transfers of personal information are governed by POPIA section 72, which permits such transfers where:

• The recipient country provides an adequate level of protection substantially similar to POPIA;
• The data subject consents to the transfer; or
• The transfer is governed by a binding agreement with the recipient that upholds processing principles substantially equivalent to POPIA’s eight conditions.

We have entered into Data Processing Agreements with all operators receiving personal information outside South Africa, incorporating POPIA-compliant transfer provisions. A list of these operators and copies of the applicable agreements are available on request by contacting privacy@goodtogoat.ai.

8. Data Retention

We retain personal information only as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

When personal information is no longer required, we securely delete or anonymise it in accordance with our internal data management procedures.

9. Cookies and Similar Technologies

The Platform uses cookies and similar technologies. For full details, please refer to our separate Cookie Consent Notice. In summary:

• Essential cookies: Enable core functionality including authentication, security, and session management. These are strictly necessary.
• Analytics cookies: Help us understand Platform usage patterns so we can improve performance. Placed only with your consent.

You can manage cookie preferences through the banner displayed when you first visit the Platform, or by adjusting your browser settings.

10. Your Rights Under POPIA

Under POPIA sections 23–25, you have the following rights in relation to your personal information:

To exercise any of these rights, submit a request to privacy@goodtogoat.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Information Regulator of South Africa:

11. Security Safeguards

We implement appropriate technical and organisational security measures as required by POPIA section 19, including:

• Encryption of personal information in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and multi-factor authentication for system access
• Regular security assessments, penetration testing, and vulnerability scanning
• Incident response procedures including notification protocols
• Employee training on data protection and information security
• Vendor due diligence and operator agreements with security requirements

While we take all reasonable steps to protect your data, no method of transmission or storage is entirely secure. If you become aware of any security vulnerability, please notify us immediately at privacy@goodtogoat.ai.

12. Security Compromise Notification

In the event of a security compromise affecting your personal information, we will comply with POPIA section 22 and notify:

• The Information Regulator, as soon as reasonably possible after becoming aware of the compromise; and
• The affected data subjects, unless the Regulator directs otherwise, in a manner that allows them to take protective measures.

Notifications will include the nature of the compromise, the personal information involved, our contact details, and the steps we are taking to remedy the situation.

13. Children’s Personal Information

The Platform is designed for business use and is not directed at persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete it promptly and, where required, notify the Information Regulator.

14. The Eight Conditions for Lawful Processing

Our data practices are designed to comply with all eight conditions for lawful processing set out in Chapter 3 of POPIA:

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where changes are material, we will notify Customers and Users via the Platform or by email, and display the updated policy on our website. The date of the most recent update is shown at the top of this document.

16. Contact and Complaints

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact our Information Officer:

This Privacy Policy is governed by and construed in accordance with the Protection of Personal Information Act 4 of 2013 (South Africa).