Gesto Privacy Policy
Last Updated: 3 October 2026
1. Introduction
Gesto is operated by an individual sole operator in Nigeria. Gesto (“Gesto,” “we,” “us,” or “our”) provides software and related services designed to help businesses manage their operations, information, workflows, and related activities.
This Privacy Policy explains how we collect, use, disclose, protect, and otherwise process personal information when you use Gesto’s website, applications, services, and related features (collectively, the “Services”).
It also explains certain choices and rights you may have regarding your personal information.
By using the Services, you acknowledge that your personal information may be handled as described in this Privacy Policy and as otherwise permitted or required by applicable law.
2. Information We May Collect
The information we collect depends on how you interact with Gesto and which Services or features you use.
Account and Profile Information
When an account is created or administered, we may collect information such as:
- name;
- email address;
- telephone number;
- organization or business information;
- account and Workspace information;
- role or permissions within an organization; and
- other information provided when creating or managing an account.
Customer Data
Customers and their Authorized Users may submit, upload, create, import, store, or otherwise process information through Gesto.
This may include business records, customer or contact information, transaction or operational information, service listings, customer contact details, jobs, invoices and recorded payments, documents, and other information used with the Services.
Where Gesto processes personal information contained in Customer Data on behalf of a business customer, the customer generally determines the purposes for which that information is processed, subject to applicable law and the applicable agreement with Gesto.
Billing and Transaction Information
If you purchase paid Services, we may process information relating to your subscription, billing status, transaction history, payment references, plan, renewal, cancellation, refunds, and related payment information.
Payments may be processed through third-party payment providers. Those providers may independently collect and process payment information under their own privacy policies and terms.
Support and Communications
If you contact Gesto, we may collect your contact information and the contents of your communications, including support requests, complaints, feedback, and information you voluntarily provide to help us respond.
Technical and Usage Information
When you use the Services, certain technical information may be collected, such as:
- device and browser information;
- IP address;
- authentication and session information;
- timestamps;
- application events;
- security information;
- error or diagnostic information; and
- information about interactions with the Services.
The exact information collected may depend on the features, infrastructure, and technologies used to provide the Services.
3. How We Use Personal Information
Depending on the circumstances, we may process personal information to:
- provide, operate, maintain, and improve the Services;
- create and administer accounts and Workspaces;
- authenticate users and manage access;
- provide features requested by customers;
- process subscriptions and payments;
- communicate about accounts, subscriptions, transactions, or the Services;
- provide customer support;
- investigate and resolve complaints;
- maintain the security and integrity of the Services;
- detect, investigate, and prevent fraud, abuse, unauthorized access, and other harmful activity;
- diagnose technical problems;
- comply with applicable legal and regulatory obligations;
- establish, exercise, or defend legal rights;
- enforce applicable agreements and policies; and
- perform other processing disclosed at the time information is collected or otherwise permitted by applicable law.
We aim to limit processing to purposes that are appropriate for the relevant information and circumstances.
4. Gesto's Role and Customer-Controlled Data
Gesto may have different data-protection roles depending on the particular processing activity.
For certain activities, such as appropriate account administration, contracting, billing, security, legal compliance, and operation of Gesto's own business, Gesto may determine the relevant processing purposes.
For Customer Data processed by Gesto on behalf of a business customer, the customer may determine why and how the relevant personal information should be processed through the Services.
If your personal information has been provided to Gesto by one of our customers—for example, your employer, a business you interact with, or another organization—you may need to contact that organization regarding certain requests concerning that information.
Where appropriate, Gesto will assist customers with their applicable data-protection obligations.
5. Legal Bases for Processing
Where applicable law requires a legal basis for processing personal information, the appropriate basis depends on the particular processing activity.
Depending on the circumstances, processing may be based on:
- performance of a contract or steps connected with entering into a contract;
- compliance with a legal obligation;
- consent where consent is appropriate or legally required;
- legitimate interests recognized by applicable law; or
- another lawful basis available under applicable data-protection law.
Where Gesto processes Customer Data solely on behalf of a customer, the customer is generally responsible for determining the appropriate lawful basis for its underlying processing where required by law.
6. How We May Share Information
We may disclose personal information where reasonably necessary to operate the Services or where otherwise permitted or required by law.
Recipients may include:
- service providers supporting our infrastructure and operations;
- payment and billing providers;
- hosting, database, communications, security, monitoring, or support providers;
- professional advisers such as lawyers, accountants, auditors, or consultants where appropriate;
- third-party services that a customer chooses to connect to Gesto; and
- governmental, regulatory, judicial, or law-enforcement authorities where disclosure is lawfully required.
We may also disclose information in connection with a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable legal requirements.
We do not treat access to personal information as unlimited merely because a third party helps us provide the Services.
7. Third-Party Integrations
Customer-connected integrations are not currently active. We use Vercel for hosting, Supabase for authentication, database and logo storage, and Google Gmail SMTP for verification and password-reset emails. These providers process information necessary to deliver their services under their applicable terms and privacy policies.
8. Artificial Intelligence Features
Gesto does not currently offer AI features or send workspace records to AI providers as part of the Services. We will update this Policy before introducing such processing.
9. Sensitive, Restricted and Prohibited Information
The technical ability to enter, upload, or import information into Gesto does not necessarily mean that every type of information is approved for processing through the Services.
Certain categories of information may be restricted or prohibited depending on the relevant Gesto feature, applicable law, security requirements, and the infrastructure used to provide that feature.
Customers are responsible for ensuring that information submitted to Gesto is lawful and appropriate for the relevant Services and that they have the necessary rights, permissions, notices, or other legal basis for processing it.
Where Gesto identifies specific restrictions for a feature or category of information, customers and users must comply with those restrictions.
10. Data Security
We take the security of personal information seriously and seek to maintain technical and organizational safeguards appropriate to the nature of the Services and the risks associated with the processing.
No internet-based service, storage system, or method of electronic transmission can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security.
Users are also responsible for protecting their account credentials and for promptly notifying Gesto if they believe an account or Workspace has been compromised.
11. Data Retention and Deletion
We retain active account and workspace records to provide the Services. Account deletion removes your access and all workspaces you own immediately. A restricted recovery copy of your account email, workspace details, memberships and business records remains for 30 days. Automated hourly cleanup removes expired recovery copies. Contact mail.ventor.org@gmail.com within 30 days to request recovery. Support requires identity verification.
Data Reset is permanent and does not create a recovery copy. Owners may reset all company data or supported sections, including Services. A Services reset clears service listings, customers, jobs, invoices and recorded payments. Inventory reset also clears Sales and returns because these depend on products. Sales reset leaves current stock quantities unchanged. Full reset keeps the workspace name and owner access, but clears operational records, invitations and staff access, and resets displayed branding.
Uploaded logo files, provider logs and infrastructure backups are separate and may remain under provider retention arrangements. The 30-day period applies to Gesto's account recovery records, not every provider backup or previously public logo. Records legally required to be retained may remain for the applicable period.
Paid subscriptions and cancellation are not active. We will explain their retention arrangements before introducing them.
12. International Processing
Gesto may use service providers or infrastructure that involves processing information in countries other than the country in which the information was originally collected.
Where personal information is transferred internationally, we will handle such transfers in accordance with applicable data-protection requirements and use legally appropriate transfer arrangements where required.
13. Your Privacy Rights
Depending on applicable law and the circumstances of the processing, you may have rights concerning your personal information.
These may include rights to:
- obtain information about the processing of your personal information;
- request access to personal information;
- request correction of inaccurate or incomplete information;
- request deletion where legally applicable;
- request restriction of certain processing;
- object to certain processing;
- withdraw consent where processing depends on consent;
- request portability where applicable; and
- make a complaint to an appropriate data-protection authority.
These rights are subject to applicable legal conditions and exceptions.
If Gesto processes the relevant information solely on behalf of one of our customers, we may direct your request to that customer or assist the customer in responding.
14. Children's Privacy and Age Restrictions
Gesto is primarily designed as a business service.
A person who personally enters into a Gesto subscription or accepts contractual terms on behalf of an organization must be at least 18 years old and legally capable of entering into the applicable agreement.
Gesto is not designed as a service directed toward children.
If we become aware that personal information has been processed in circumstances requiring additional protections under applicable law, we will take appropriate steps.
15. Cookies and Similar Technologies
Gesto uses authentication/session storage and interface preferences, including browser local storage and necessary cookies where used by the application or its providers. We do not currently operate advertising cookies or customer-connected analytics integrations.
Where applicable law requires consent or additional information concerning non-essential cookies or similar technologies, appropriate choices or notices will be provided.
16. Payment Processing
Gesto does not currently accept subscription payments or collect payment-card details. Payment-method labels entered for business sales and expenses are operational records; they do not transfer money. We will update this Policy before enabling subscription payments.
17. Business Transfers
If Gesto undergoes or considers a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be disclosed or transferred as part of that process where legally permitted.
Any recipient will remain subject to applicable data-protection requirements regarding personal information it receives.
18. Legal and Regulatory Disclosures
Gesto may preserve, access, or disclose information where reasonably necessary to comply with applicable law, a valid legal process, regulatory requirement, or lawful governmental request.
We may also process information where reasonably necessary to investigate unlawful activity, protect users or the Services, establish or defend legal claims, or protect the rights, property, and security of Gesto or others.
19. Changes to this Privacy Policy
We may update this Privacy Policy as Gesto, our Services, or applicable legal requirements change.
When we update the Policy, we will update the “Last Updated” date.
Where an update materially changes how personal information is processed or where applicable law requires additional notice or consent, we will take appropriate steps before or when the change takes effect.
20. Complaints
If you have a privacy concern or complaint regarding Gesto, please contact us using the contact information provided below.
We will review privacy complaints and take appropriate steps to investigate and respond.
Nothing in this Policy is intended to prevent you from exercising any right to contact the Nigeria Data Protection Commission or another competent authority where that right is available under applicable law.
21. Contact Gesto
For questions, privacy requests, complaints, or concerns regarding this Privacy Policy or Gesto's handling of personal information, please contact:
Gesto
Email: mail.ventor.org@gmail.com
Contact us by email for privacy requests and operator identification details.
If your request concerns information that Gesto processes on behalf of a Gesto customer, please identify the relevant organization or Workspace where possible so that the request can be handled appropriately.