Three roles. Per-location access.
Owner, Manager, Staff — that is the entire access model. Each role has a clear, server-enforced set of permissions. Team membership is managed per location, so a single user can hold different roles at different locations in the same business.
The three roles
- Owner. The person who created the business. Full access to everything: billing, plan changes, account deletion, all locations, all inboxes, all settings, all integrations. One owner per business. Ownership is not transferable through the dashboard yet — email the founder for owner transfers.
- Manager. Can read and reply to reviews for the location(s) they are assigned to. Can generate AI replies. Can edit reply templates for those locations. Cannot change billing, cannot connect or disconnect Google Business Profile, cannot invite new members, cannot delete the location.
- Staff. Read-only access to the inbox for their assigned location(s). They can read reviews and see customer profiles. They cannot reply, cannot generate AI drafts, and cannot change any settings. Useful for front-of-house staff who should know about feedback but should not respond on the business's behalf.
Permission matrix
| Action | Owner | Manager | Staff |
|---|---|---|---|
| Read Inbox | Yes | Yes (assigned locations) | Yes (assigned locations) |
| Reply to a review (manual) | Yes | Yes | No |
| Generate AI reply | Yes | Yes | No |
| Edit reply templates | Yes | Yes | No |
| Connect / disconnect Google Business Profile | Yes | No | No |
| Add / remove locations | Yes | No | No |
| Invite / remove team members | Yes | No | No |
| Change plan or billing | Yes | No | No |
| Delete the business | Yes | No | No |
| Export customer CSV | Yes | Yes | No |
Permissions are server-enforced. The dashboard hides what a role cannot do, and the API rejects the request even if a malicious client tries to call it directly. See lib/accessControl.ts if you want to audit the source.
Plan requirement
Inviting team members requires the Pro plan or above. On Free and Starter, the Team Members panel is visible but the Invite button shows an upgrade prompt.
| Plan | Team members |
|---|---|
| Free | Just you (the owner) |
| Starter | Just you (the owner) |
| Pro | Unlimited Managers and Staff across up to 3 locations |
| Pro Max | Unlimited Managers and Staff across up to 10 locations |
Inviting members
1. Be on Pro or above
Inviting team members requires the Pro plan or above. Free and Starter are single-user.
2. Open Dashboard → Locations
Team membership is managed per-location. A user can be a Manager at Location A and Staff at Location B in the same business.
3. Click the location, then Team Members
The Team Members panel lists current members and a button to invite new ones.
4. Click Invite
Enter the new member's email and pick a role: Manager or Staff. Owner cannot be invited — there is only one owner per business.
5. They receive an invite email
The email contains a one-click link to claim the invite. They sign up (or sign in if they already have a Starvo account) and the access is live.
alice@example.com, only that email can claim it. If Alice signs up with a different address, the invite stays unclaimed until you cancel it or resend to her real address.Managing existing members
From the Team Members panel of any location, you can:
- Change a member's role from Manager to Staff or vice versa. Click the role next to their name and pick the new one. Takes effect immediately.
- Resend an invite if the member hasn't claimed it yet. Useful if the original email was lost in spam. Invites expire 7 days after the most recent send.
- Cancel a pending invite before it's claimed.
- Remove a member who has already joined. Their access ends immediately on the next request.
Removing members
When you remove a member:
- Their dashboard access to that location ends immediately.
- Any reply drafts they were working on are discarded.
- Replies they had already sent stay sent (they were sent “by your business”, not “by them” — Starvo replies are not attributed to individual users on Google or in customer emails).
- Their Starvo account itself is not deleted. They can still be a member of other Starvo businesses.
Multi-location specifics
Roles are scoped per-location. A user invited as Manager at Location A is not automatically a Manager at Location B in the same business. This is deliberate — a restaurant chain might want the head chef to be a Manager at every location, but a front-of-house lead at just one.
To add the same user to multiple locations, repeat the invite flow at each location. They use the same Starvo account; the access is additive.
Troubleshooting
The Invite button is greyed out / shows an upgrade prompt
You are on Free or Starter. Inviting team members requires Pro or above. Upgrade from Dashboard → Billing and the button activates immediately.
The invitee never received the email
Check three things in order:
- Spam folder on their end — most common cause.
- Email typo — invites are bound to the exact email entered.
- Their corporate mail provider may be blocking our sender. As a fallback, the dashboard shows the invite link directly — copy it and share via your preferred channel.
The invitee clicked the link but got an error
Almost always one of two things:
- The invite expired (7-day window). Resend the invite.
- They are signed in to a different Starvo account than the email the invite was sent to. They should sign out and re-click the link.
I removed a member but they say they can still see things
Their browser may have a cached page. Their access on the server is gone — the next API request they make returns 403. They should refresh.
I want to transfer ownership of the business
Ownership transfer is not in the dashboard yet. Email support@starvo.app from the current owner's account with the new owner's email. The transfer is done manually for safety.