← Back to Lwazi AI

Privacy Policy

Lwazi AI is a product of Avolvia (Pty) Ltd, a company registered in the Republic of South Africa. This Privacy Policy explains how we collect, process, store, protect, and share personal information when you use our website, the Lwazi AI voice agent product, or any related service (collectively, the "Services"). This policy complies with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who we are

Avolvia (Pty) Ltd is the Responsible Party as defined by POPIA.

• Registered name: Avolvia (Pty) Ltd
• Registered address: Republic of South Africa
• Information Officer: Bruce Steyn
• Contact for privacy matters: privacy@avolvia.app

2. What personal information we collect

2.1 From website visitors

• Technical data: IP address, browser type, device type, pages visited, time on site (via standard web logs)
• Contact form submissions: name, phone number, email, company, industry, notes you enter
• Consent records for marketing and voice call follow-up

2.2 From voice demo users

• Audio of your voice during the live browser demo
• Transcripts of what you say (generated in real time by our speech-to-text)
• Session metadata: session id, duration, browser, IP

Demo sessions are ephemeral. We do not retain the audio after the session ends. A short transcript fragment may be kept for 30 days for quality monitoring and abuse prevention, after which it is deleted.

2.3 From customers using the Services (post-purchase)

• Account details: name, role, business email, workspace membership
• Billing details: company name, VAT number, billing address. Payment card data is handled by PayFast, not stored by us.
• Your own customers' data that you choose to have Lwazi AI process: phone numbers, call recordings (with consent), transcripts, pipeline context
• Integration credentials (OAuth tokens, webhooks) you authorise

3. Why we collect it (lawful basis)

Purpose	Lawful basis
Responding to your enquiry (form submission)	Your consent + legitimate interest
Calling you back after form submission	Your explicit consent (consent checkbox on form)
Running the live voice demo	Your consent (mic permission + session start)
Providing paid Services to customer workspaces	Contract performance
Billing, fraud detection, financial record keeping	Legal obligation (SA Companies Act, SARS)
Improving our Services (aggregated analytics only)	Legitimate interest
Security and abuse prevention	Legitimate interest

4. How long we keep it

• Website analytics logs: 90 days
• Contact form submissions: 12 months after last contact, or until deletion requested
• Voice demo audio: not retained
• Voice demo transcripts: 30 days
• Customer call recordings and transcripts: as configured in the customer workspace (default 90 days)
• Billing records: 5 years (SA legal requirement)
• Account records: duration of contract plus 3 years

5. Who we share it with

We share personal information only with trusted Operators (as defined by POPIA) who process data on our behalf under written agreement:

• Google Cloud Platform (Ireland, EU data region where possible): hosting, storage, compute
• OpenAI (United States): voice model inference for the voice agent. Transcripts sent to OpenAI are not used to train their models.
• Twilio (United States): voice telephony, only when customers place calls
• PayFast (South Africa): payment processing for SA customers
• SendGrid / Mailgun (transactional email delivery)

We do not sell personal information. We do not share it with advertisers.

6. Cross-border transfers

Some Operators listed above process data outside South Africa (in the EU or US). Where this happens:

• The Operator is subject to laws that provide adequate protection comparable to POPIA
• We have written contracts requiring POPIA-level safeguards
• You consent to these transfers by using the Services

7. Your rights under POPIA

As a data subject you have the right to:

• Know what personal information we hold about you
• Request a copy of your personal information
• Request correction of inaccurate personal information
• Request deletion of your personal information (subject to legal retention requirements)
• Object to direct marketing
• Withdraw consent at any time (does not affect processing already done)
• Lodge a complaint with the Information Regulator

To exercise any of these rights, email privacy@avolvia.app or use our data deletion request form. We will respond within 30 days.

8. Security

We protect personal information with:

• TLS 1.2+ encryption in transit
• AES-256 encryption at rest in Google Cloud Storage and Firestore
• Role-based access control, every staff action logged
• Multi-factor authentication on all admin accounts
• Regular security reviews and dependency patching
• Workspace isolation for customer data (no cross-tenant access)

9. Cookies and similar technologies

We use a small number of cookies:

• Strictly necessary: session cookies for site functionality (no consent required under POPIA)
• Analytics: minimal, aggregated, no cross-site tracking. You can decline via the consent banner.

We do not use advertising cookies. We do not track you across other websites.

10. Voice recordings and AI processing

When Lwazi AI makes or receives a call on your or your customers' behalf:

• The call may be recorded only with explicit consent captured at call start
• Audio is transcribed for qualification, summarisation and writeback into your CRM
• AI models process the audio and transcript to generate responses and extract structured data
• Audio and transcripts are stored in your customer workspace under your control
• You (as the customer workspace owner) are the Responsible Party for your own customers' data. Avolvia is the Operator.

11. Complaints

If you are unhappy with how we handle your personal information, please contact us first at privacy@avolvia.app. You also have the right to complain to:

• Information Regulator of South Africa
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• POPIAComplaints@inforegulator.org.za
• inforegulator.org.za

12. Changes to this policy

We may update this policy as our Services or the law evolves. Material changes will be notified to you by email (if you are a customer) or by prominent notice on our website. The "Effective date" above shows the latest revision.