Privacy Policy — kinetic-ops.app
v1.6 · Effective 2026-09-26
This website is operated by GoSafe. Since 2026-09-26 it describes GoSafe, AI-orchestrated escrow for person-to-person sales in South Africa, a proof of concept that is not open to the public. Before that date it described KIP ("Kinetic Ops"), a voice-first executive co-pilot app for the car, which is in build and not released. This policy tells you what personal information the website collects today — an interest list for GoSafe, and the earlier KIP waitlist — what the KIP app is designed to do with personal information once it exists in your hands, and the rights you hold. GoSafe itself processes no personal information from the public yet; before it does, an updated policy will be published first.
Our primary law is the Protection of Personal Information Act, 2013 (POPIA). Where the EU General Data Protection Regulation (GDPR) applies to you, section 7.2 explains how this policy maps to it.
1. Who we are
The responsible party under POPIA (and joint controllers under the GDPR, Article 26) is:
GoSafe, a South African venture of its two founders, Ian Groenewald and Charl le Roux, who are jointly responsible for the personal information described in this policy.
- Place of business (published in terms of section 43(1) of the Electronic Communications and Transactions Act, 2002): Stellenbosch, Western Cape, South Africa.
Privacy contact and Information Officer: Charl le Roux, charl@alteragro.com (section 8). General contact for this website: the same address.
2. What this policy covers
Two things, kept honestly apart:
- The website at https://kinetic-ops.app and its sign-up form — live now. The GoSafe interest list, and the KIP waitlist that preceded it, are the only personal information this website collects. Section 3 describes them in full.
- GoSafe — a proof of concept, not open to the public. It processes no personal information from the public. Before it does, an updated version of this policy will be published first.
- The KIP app — planned, not released. The app is not available to the public and holds no data about you today. Section 4 states its data practices as design commitments: the rules the app is being built to obey. We will publish an updated version of this policy before the app or its pilot programme processes personal information from anyone outside our own team.
3. What this website collects: the interest list (and the earlier waitlist)
If you register interest in GoSafe (or, before 2026-09-26, joined the KIP waitlist), we collect:
| Field | Required | Why |
|---|---|---|
| Email address | Yes | To contact you about the product you registered for |
| Name | Optional | To address you properly when we do |
| A free-text note | Optional | Aggregate demand research — understanding what people would want GoSafe (or KIP) for |
| Consent timestamp | Recorded automatically | Proof that you consented, and when |
| Source and UTM strings | Recorded automatically | To know which link brought you here, and which product the entry was given for (GoSafe entries are tagged `gosafe`) |
Purposes. For a GoSafe entry: contacting you about GoSafe (its pilot and launch), and aggregate demand research. For a KIP waitlist entry made before 2026-09-26: contacting KIP pilot-programme candidates, and aggregate demand research. Each entry is used only for the purposes it was given for: KIP waitlist entries are not used to contact you about GoSafe, and GoSafe entries are not used for KIP. We do not sell personal information, and we do not use either list for anything beyond these purposes.
Voluntary. Giving us any of this is voluntary. If you choose not to register, the only consequence is that we cannot contact you about the product — there is no other effect.
Lawful basis. Your consent (POPIA section 11(1)(a)). The consent checkbox is unticked by default; registering is your choice. You may withdraw consent at any time by writing to the privacy contact. Withdrawal does not affect processing that happened before it.
Storage. Entries are stored with Cloudflare (D1 database), our website host, in one table that holds both lists; the source tag keeps them apart.
Minimality. We store no IP address and no browser details with your entry. (Section 4 separately covers the site's aggregate, cookieless traffic measurement — it is not part of your entry and is never linked to it.)
Security. We protect your entry with our hosting provider's access controls and encryption in transit, and limit access to the people who need it to contact you (POPIA section 19).
Retention. We keep your entry until the purposes above are fulfilled, or until you ask us to delete it — whichever comes first. Deletion requests go to the privacy contact (section 8). We verify that a request comes from the holder of the email address on the entry, and complete deletion within 30 days of a verified request.
Cookies and tracking. This website sets no advertising cookies and does no cross-site tracking. Unless you allow Google Analytics (described below), the only cookies are those of Cloudflare's essential infrastructure — serving and protecting the site, including the bot check on the sign-up form. For traffic measurement we use Cloudflare Web Analytics, which is cookieless: it sets no cookie, stores nothing on your device, and does not fingerprint you. Your IP address is read momentarily by Cloudflare — already our host — to compute aggregates (it is where the country-level figure comes from), then discarded: it is not stored with the measurements and never linked to your entry. What we see is only those aggregates — pages viewed, referrers, country-level location, performance timings — never who you are. We rely on our legitimate interest in understanding site traffic for this processing (POPIA section 11(1)(f)); see section 7.1 to object. Because the measurement keeps no record tied to you, there is no per-visitor entry to remove on request — if you would prefer not to be measured even in aggregate, a content blocker will block the analytics script, and the privacy contact will gladly discuss it. These measurements are not used for advertising.
Google Analytics — only with your consent. On the site's main pages (home, story, FAQ and support) a banner asks whether we may also use Google Analytics. It is off by default and stays off unless you choose Allow: until then no request is made to Google and no analytics cookie is set. Declining has no effect on your use of this site — every page works the same either way. If you allow it, Google Analytics sets cookies (names beginning _ga) and processes usage and device data — pages viewed, approximate location, browser and device details — with Google LLC acting as our processor. We configure it with Google signals and ad personalization disabled, and we do not use it for advertising. The lawful basis is your consent (POPIA section 11(1)(a)), and you may withdraw it at any time via the Analytics choices link in the footer — declining removes the Google Analytics cookies this site set and stops any further Google requests from this device. Retention on Google's side is set to the shortest period Google Analytics offers: two months, for both event-level and user-level data. Legal pages never load Google Analytics regardless of your choice.
4. The app's data practices, as designed
These are design commitments, not live features. The app is in build. If the build changes any commitment below, this policy changes first, with a change-log entry.
- Transcript-only sessions. A KIP session is recorded as text. Voice is processed into a transcript, and the transcript is the record.
- No raw audio retention. Raw audio is never persisted. Audio exists only in transit while a session runs.
- Transcript retention: 90-day target. Transcripts are designed to be retained for 90 days, then deleted.
- A recording notice opens every session. Audible and visible, every time. There is no silent open microphone. The notice is there for everyone in the cabin, not only the account holder, and a pause command is part of the design.
- A one-time consent screen before the first session. Before the app streams any in-cabin audio to a voice provider for the first time, it shows a plain-language consent screen — what is processed (the audio in your cabin), why (to run the assistant), and how (streamed to our voice providers in the United States, turned into a transcript, and not retained by them) — with a real accept-or-decline choice. Declining means the assistant does not run. This is separate from, and additional to, the recording notice that opens every session.
- A control to flag any answer. You can report an AI response you find wrong or objectionable from inside the app, without leaving it. Flagged items go to a quarantined review queue; they are not added to the knowledge base.
- In-app account deletion. You can delete your account and its data from inside the app itself, with the email route on the Data Deletion page always available as well.
- Safety by design. While the vehicle is moving, interaction is voice-only. Approvals, and anything that needs your hands or eyes, wait until you are parked. This is enforced in the product.
- Data residency. The canon — the knowledge base KIP answers from — resides in Google Cloud's africa-south1 region (Johannesburg, South Africa). Section 5 explains what does and does not leave South Africa.
5. Cross-border transfers (POPIA section 72)
POPIA restricts sending personal information outside South Africa. Here is our position, stated plainly:
- The canon stays in South Africa. The residency claim scopes to the canon: it resides in Google Cloud's africa-south1 region. It is not a claim about every byte in every path.
- Live voice transits the United States. As designed, live voice audio in an app session transits the US edges of our voice providers — xAI (Grok, primary) and OpenAI (fallback). These transfers rest on provider data processing agreements that include no-training and zero-data-retention commitments: the providers may not train on the audio and may not retain it.
- Report drafting transits the United States. As designed, when you ask KIP to draft a report or message, the relevant text is processed by our drafting provider (Anthropic) in the United States under the same no-training and zero-data-retention terms. KIP prepares drafts only; it never sends them for you.
- Dispatch transits GitHub. As designed, approved tasks are carried to our build systems through GitHub (United States).
- The interest list and waitlist are hosted with Cloudflare, a US-headquartered provider with a global network, under its data processing terms. Cloudflare also performs the site's cookieless, aggregate-only traffic measurement (Cloudflare Web Analytics) across the same global edge; no personal identifier is stored or transferred in those measurements.
- Google Analytics data — only if you consent — is processed by Google LLC, a US-headquartered provider, on its global infrastructure under Google's Data Processing Terms, which incorporate the EU Standard Contractual Clauses as the transfer safeguard. If you never choose Allow on the analytics banner, nothing is sent to Google.
Where personal information crosses the border, we rely on POPIA section 72(1)(a): the recipient is bound by an agreement that upholds protections substantially similar to POPIA's conditions for lawful processing. The provider agreements above are that mechanism.
6. Subprocessors
| Provider | What it does | Status |
|---|---|---|
| Cloudflare | Website and sign-up (interest list and waitlist) hosting (D1 storage), and traffic measurement (Cloudflare Web Analytics — cookieless, aggregate-only) | In use now |
| Google LLC | Website analytics (Google Analytics 4) — runs only after you choose Allow on the analytics banner; Google signals and ad personalization disabled | In use only with your consent |
| xAI | Realtime voice (Grok, primary) | Planned — app, in build |
| OpenAI | Voice (fallback) | Planned — app, in build |
| Anthropic | Report and message drafting | Planned — app, in build |
| Google Cloud | Canon storage, africa-south1 | Planned — app, in build |
| GitHub | Dispatch of approved tasks | Planned — app, in build |
We will update this list before any new subprocessor processes personal information.
7. Your rights
7.1 Under POPIA
You may, at any time and free of charge:
- Access — ask whether we hold personal information about you, and ask for the record (section 23).
- Correction — ask us to correct information that is inaccurate or misleading (section 24).
- Deletion — ask us to delete your information (section 24). For the interest list or waitlist, this means your entry is removed.
- Objection — object to processing on reasonable grounds (section 11(3)).
- Withdraw consent — where processing rests on consent, withdraw it (section 11(2)(b)).
Send any request to the privacy contact (section 8). We verify that a request comes from the holder of the email address on the entry. We will respond without undue delay, and complete deletion within 30 days of a verified request.
If you are not satisfied with our response, you may complain to the Information Regulator (South Africa): https://inforegulator.org.za, POPIAComplaints@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
7.2 If the GDPR applies to you
If you are in the European Economic Area, our basis for the interest list and waitlist is your consent (Article 6(1)(a)), which you may withdraw at any time. You hold rights of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with your local supervisory authority. Exercise these rights through the privacy contact. Where your personal information is transferred outside the EEA — for your entry, to Cloudflare in the United States — the transfer is protected by the European Commission's Standard Contractual Clauses, and, where the provider is certified, the EU–US Data Privacy Framework. Ask the privacy contact for a copy of the safeguard in place.
8. Information Officer
Charl le Roux, a founder, is the Information Officer for GoSafe under POPIA section 55, and its privacy contact, reachable at charl@alteragro.com. This is the address for privacy questions, rights requests, and deletion requests.
General contact for this website: charl@alteragro.com.
9. Governing law
This policy is governed by the law of South Africa.
10. Changes to this policy
This policy will change as GoSafe and KIP move from build to pilot to release. Material changes receive a new version number, a new effective date, and a change-log entry below. The version in force is always the one published at https://kinetic-ops.app/legal/privacy. Before either product processes personal information from anyone outside our own team, an updated policy will be published first.
Change log
- v1.6 (2026-09-26) — Responsible party restated as GoSafe, the venture of its founders Ian Groenewald and Charl le Roux; the previous company identity, registration number and registered office removed; Charl le Roux is the Information Officer (POPIA s55) and privacy contact.
- v1.5 (2026-09-26) — The website now hosts the GoSafe pitch. Added the GoSafe interest list as a purpose-limited second list alongside the KIP waitlist; stated that entries are tagged by product and never cross-used; added the GoSafe scope statement in section 2; contact address updated to charl@alteragro.com. KIP app design commitments unchanged.
- v1.4 (2026-08-29) — Stated the Google Analytics retention setting: two months (the shortest available), for both event and user data.
- v1.3 (2026-08-29) — Added consent-gated Google Analytics: deny-by-default banner, loads only after an explicit Allow, Google signals and ad personalization disabled, withdrawal via the footer's Analytics choices link.
- v1.2 (2026-08-29) — Added Cloudflare Web Analytics: cookieless, aggregate-only traffic measurement; no cookies, no device storage, no link to waitlist entries.
- v1.1 (2026-08-28) — Added the pre-first-session consent screen, the in-app control to flag a response, in-app account deletion, the report-drafting provider (Anthropic), and a note that joining the waitlist is voluntary.
- v1.0 (2026-08-28) — First published version. Covers the website and waitlist; records the app's data practices as design commitments.