artecx

Goatavo Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how ARTECX LLC ("Goatavo," "we," "us," or "our") collects, uses, shares, and protects information when you use the Goatavo mobile apps, the website at goatavo.com, and related services (collectively, the "Service").

By using the Service, you agree to this Privacy Policy. It is incorporated into our Terms of Service.

The short version:

• We don't sell your personal information, and we don't share it with third parties for advertising.
• There are no third-party advertising or analytics SDKs in our apps. Analytics are collected first-party, on our own infrastructure.
• Sponsored posts on Goatavo are matched using data we hold ourselves — no ad networks, no advertising identifiers, no cross-app tracking.
• Location is used only while the app is open, only with your permission, and is not stored on our servers.
• You can export or delete your data from inside the app.

1. Information We Collect

1.1 Information you provide

• Account information. Email address, username, and password (stored only as a salted hash — we cannot see your password). If you sign in with Apple or Google (where offered), we receive your account identifier, email address, and email-verification status from that provider. If you sign in or verify by phone number (where offered), we collect that phone number.
• Profile information. Display name, bio, avatar image, locale, timezone, and unit preferences — all optional.
• Content you post. Deal submissions, posts, comments, reviews, price confirmations, photos and other images, saved lists, watch rules, and votes.
• Messages. Direct messages you send to other users, and messages and attachments you send to our support team.
• AI assistant conversations. Messages you exchange with the Goatavo assistant, and — if you enable AI personalization — the preferences and memories the assistant keeps about you (see Section 4).
• Security settings. If you enable two-factor authentication, we store your TOTP enrollment and recovery codes.
• Requests and consents. Records of your consent to our legal documents and of data-export and deletion requests you make.

1.2 Information collected automatically

• Device and app information. Device type and model, operating system, app version, and a random installation identifier we generate for your app install. We do not access your device's advertising identifier (IDFA/GAID).
• Usage information. First-party analytics events such as app opens, screens and deal cards viewed, searches, link clicks, and notification opens, along with your session identifier, plan tier, device type, and app version. App crashes and errors are reported through this same first-party pipeline — we do not use third-party crash-reporting services.
• Location (with your permission). If you grant location permission, we read your approximate device location only while you are using the app to show nearby deals and stores, and to display a city label. Coordinates are sent with those requests but are not saved to your profile or stored on our servers beyond ordinary short-lived server logs. We never access location in the background, and you can use the Service without granting location permission.
• Network information. Your IP address, which we record with active sign-in sessions, consent records, affiliate-link clicks, and staff audit logs, and use for security and rate limiting.
• Push token. If you enable notifications, a push token for your device.

1.3 Information from other sources

• Sign-in providers (Apple, Google), as described above, when you choose to use them.
• Merchants and deal sources. Deal, price, and product information we aggregate is about products, not about you.

We do not collect precise location in the background, contacts, calendars, microphone or camera audio/video (photos you attach are ones you choose), health data, or biometric data.

2. How We Use Information

We use the information above to:

• provide and operate the Service — accounts, feeds, search, saved deals, alerts, messaging, and support;
• show you relevant content, including personalizing your feed and matching sponsored posts to your interests using data we hold (see Section 5);
• provide the AI assistant (Section 4);
• send transactional communications — email verification, password resets, security alerts, and (where offered) SMS one-time passcodes;
• send push notifications and marketing emails you can opt out of;
• attribute affiliate-link clicks so we can be paid commissions by merchants;
• protect the Service — authentication, fraud and abuse prevention, rate limiting, enforcing bans, and investigating violations of our Terms;
• comply with legal obligations and enforce our agreements; and
• understand usage in aggregate to improve the Service.

3. Advertising — What We Don't Do

Goatavo shows sponsored posts from merchants and partners, matched to users by us using first-party data (for example, the kinds of deals you follow). Sponsored content is labeled.

We do not:

• run third-party advertising SDKs or ad networks in our apps or on our sites;
• use or share advertising identifiers (IDFA/GAID);
• track you across other companies' apps or websites; or
• sell your personal information, or share it with third parties for cross-context behavioral advertising.

Because sponsored-post matching uses only data from your activity on Goatavo itself, it does not constitute "targeted advertising" or a "sale" or "sharing" of personal data as those terms are defined under Virginia's Consumer Data Protection Act or the California Consumer Privacy Act.

4. AI Assistant

The Goatavo assistant is powered by third-party large-language-model providers — currently Anthropic (assistant responses) and Google (text embeddings) — which process your assistant conversations, and related profile context, on our behalf as service providers under contracts that restrict their use of the data.

If AI personalization is enabled in your settings, the assistant may keep memories and profile attributes about your preferences to give better answers. You are in control:

• Settings → AI lets you turn off AI personalization, memory, and proactive suggestions independently.
• The "What the assistant knows" screen shows every stored memory and profile attribute, and lets you delete them individually.
• Deleting your account permanently deletes all assistant memories, profiles, and tasks (Section 7).

5. How We Share Information

We do not sell personal information. We share it only:

• With other users, at your direction. Content you post publicly is visible to others; direct messages are visible to their recipients.
• With service providers (processors) who process it on our behalf under contract, currently including: cloud object storage for images and export archives (Cloudflare R2), AI model providers (Anthropic, Google), the push-notification relay for our app platform (Expo), and an email delivery provider for transactional email. Our search, analytics, messaging-queue, and database infrastructure is self-hosted.
• With merchants and affiliate networks, when you click out. When you follow a deal link, we log the click for commission attribution, and you leave the Service — the merchant's site receives your IP address and browser information directly, under the merchant's own privacy policy.
• For legal reasons. To comply with law or legal process, enforce our Terms, or protect the rights, safety, or property of Goatavo, our users, or others.
• In a business transfer. If Goatavo is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

6. Cookies

Our apps do not use cookies. Our websites use only strictly necessary cookies (for example, session and security cookies); we do not use third-party tracking cookies or analytics scripts. If that changes, we will update this Policy and provide any legally required consent mechanism.

7. Data Retention and Deletion

• Account data is kept while your account is active.
• Analytics events are retained for up to 2 years, then automatically deleted.
• Expired sign-in sessions (including their IP and device records) are deleted 30 days after expiry; expired security tokens are purged daily.
• Data-export archives you request are available for 7 days, then deleted.
• Abandoned image uploads are deleted after 24 hours.

When you delete your account (Settings, or info@artecx.com): your profile is scrubbed; your saved lists, alerts, follows, votes, preferences, notification settings, and all AI assistant memories and profiles are permanently deleted; your direct-message contents are removed; and your posts, comments, and deal submissions are anonymized so they are no longer associated with you. We retain a minimal record of the deletion request itself as required for legal compliance, your consent records, and — where needed to prevent abuse — entries on our suppression and enforcement lists (for example, so a banned account cannot immediately re-register). Residual copies in backups are deleted on our normal backup cycle.

8. Your Rights and Choices

Available to every Goatavo user, in-app:

• Export your data — Settings → request a data export; you'll receive a downloadable archive of your information.
• Delete your account and data — Settings → delete account.
• Correct your profile information at any time in Settings.
• Location — grant or revoke location permission in your device settings; the app works without it.
• Push notifications — disable in your device or in-app notification settings.
• Marketing email — unsubscribe links in each message; transactional messages (security, account) are sent regardless.
• AI controls — Settings → AI (see Section 4).

8.1 Virginia residents (VCDPA)

If you are a Virginia resident, you have the right to confirm whether we process your personal data; to access, correct, delete, and obtain a portable copy of it; and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not sell personal data, engage in targeted advertising as defined by the VCDPA, or conduct such profiling. To exercise your rights, use the in-app tools above or email privacy@artecx.com. We will respond within 45 days (extendable once by 45 days where reasonably necessary, with notice).

Appeals: if we decline to act on your request, you may appeal within a reasonable period by emailing privacy@artecx.com with the subject "Privacy Appeal." We will respond within 60 days. If your appeal is denied, you may contact the Virginia Attorney General at https://www.oag.state.va.us.

8.2 California residents (CCPA/CPRA)

If you are a California resident, you have the right to know/access, correct, and delete personal information we hold about you; the right to opt out of "sale" or "sharing" of personal information; the right to limit use of sensitive personal information; and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA, and we do not use sensitive personal information for purposes requiring a right to limit. In the preceding 12 months we have collected the categories of information described in Section 1 (identifiers; account and profile information; commercial/usage information; approximate geolocation; user content and communications; and inferences used for in-app personalization) for the purposes in Section 2, and disclosed them only to the service providers in Section 5.

Exercise your rights via the in-app tools or privacy@artecx.com. You may use an authorized agent; we will verify requests using information associated with your account. Because we do not sell or share personal information and use no third-party web tracking, there is no opt-out to signal, but we honor the Global Privacy Control where it applies.

8.3 Other U.S. states

Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Texas, and Utah) have similar rights of access, correction, deletion, portability, and opt-out. We extend the rights described above to all Goatavo users regardless of state, using the same contact methods.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has provided us personal information, contact us at privacy@artecx.com. Users aged 13–17 may use the Service only with parental consent, as described in our Terms of Service.

10. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, salted password hashing (Argon2), encrypted storage of third-party sign-in tokens, optional two-factor authentication for your account, mandatory multi-factor authentication for our staff tools, staff-access audit logging, rate limiting, and abuse-prevention systems. No system is perfectly secure; please use a strong, unique password and enable two-factor authentication.

11. Where Your Data Is Processed

Goatavo is based in the United States, and your information is processed and stored in the United States. If you access the Service from outside the U.S., you understand that your information will be transferred to and processed in the U.S., where privacy laws may differ from those of your jurisdiction. The Service is currently offered to users in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you (for example, in-app or by email) before the changes take effect and update the "Last updated" date above. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

13. Contact Us

• Home
• Terms of Service
• End User License Agreement