Privacy Policy

Last updated: 22 April 2026

Gestio is a business CRM and sales-pipeline tool operated by Infinity Developments FZ-LLC ("Gestio", "we", "us", "our"), registered in the United Arab Emirates. This policy explains what data we collect when you use the Gestio web app (gestio.dev) and the Gestio iOS app, how we use it, how long we keep it, who else sees it, and how you can delete it.

If you only remember two things: (1) the customer records you put into Gestio are yours; we process them on your behalf, not ours. (2) You can delete your account from inside the iOS app at any time — see the "Deletion & data retention" section below.

1. Who is the data controller?

Infinity Developments FZ-LLC, Dubai, United Arab Emirates. Contact: support@gestio.dev.

2. What data we collect

a. Account data (from you, directly)

• Email address and password (passwords are hashed; we never see plaintext).
• Your name, preferred language, time zone.
• Phone number, if you choose to add one.
• Workspace / tenant name, billing address, tax ID (if you pay us).

b. Customer data (you upload it, we store it)

Gestio is a CRM, so you inevitably store personal data about your own leads, contacts, and customers: names, phone numbers, email addresses, company information, deal values, notes, call logs, WhatsApp and email threads you route through the product, uploaded files.

We are the processor, not the controller, for this data. You decide what to collect, how long to keep it, and whom to share it with. You are responsible for having a lawful basis (consent, contract, legitimate interest, etc.) to process it in the first place.

c. Usage data (automatically, when you use the app)

• Device information needed to run the app: OS version, device model (iPhone / iPad), app version, a crash log if something goes wrong.
• IP address and approximate location (country-level) for security, rate limiting, and fraud prevention.
• Aggregated, non-identifying product-usage metrics (how often a screen is loaded, how long API calls take).

We do not use any advertising SDKs, we do not build an ad profile, and we do not sell your data.

3. How we use the data

• To run the product: sign you in, load your pipeline, send your messages, and keep your workspace in sync across devices.
• To secure the product: detect suspicious sign-ins, enforce tenant isolation, and investigate abuse.
• To improve the product: diagnose crashes, fix bugs, understand which features are useful.
• To communicate with you: answer support emails, send essential service notices (security alerts, policy changes). We will not send marketing email to the address in your Gestio profile without a separate opt-in.
• To comply with the law: respond to lawful requests, keep financial records where we are legally required to.

4. Who we share data with (sub-processors)

We keep the list short and audit it. Every sub-processor below has a data-processing agreement with us, stores data only in encrypted form, and is contractually bound to protection standards equal to or greater than our own.

We do not sell data to advertisers or data brokers. We do not share customer data between tenants.

5. Deletion & data retention

Deleting your account in the app

In the iOS app, open the "More" tab → "Delete account". Type DELETE to confirm. The app will immediately remove your sign-in (email + password), your Gestio profile, and every active session on every device. You will not be able to log back in with that email afterwards.

What we keep after you delete your account: the customer records that live in your workspace (contacts, deals, activities, WhatsApp / email threads) stay with the workspace so other team members can keep working, and so we don't accidentally wipe out third-party data about your leads. If your workspace has no other members, the records remain but are inaccessible without a new sign-in.

Deleting your workspace data too

If you also want the workspace records purged, email support@gestio.dev from the address on your account. We will purge the workspace within 7 days and confirm by email.

What we keep regardless

• Invoices and tax records we are legally required to retain (UAE law: 5 years; EU VAT: 10 years). These are kept in anonymised form where possible.
• Aggregated, non-identifying usage logs used for capacity planning.
• Minimal security logs (sign-in timestamps, IP) for 90 days for fraud investigation.

Retention during active use

While the account is active, we keep data for as long as you use the product plus 30 days of rolling backups.

6. Your rights

Depending on your jurisdiction (UAE PDPL, EU GDPR, UK GDPR, California CCPA, etc.) you may have the right to:

• Access a copy of the data we hold on you.
• Correct inaccurate data.
• Delete your account (see above — the app does this without asking us).
• Object to certain processing or withdraw consent.
• Export your data in a machine-readable format.
• Lodge a complaint with your local data-protection authority.

Email support@gestio.dev for any of the above — we respond within 7 business days.

7. Security

• All traffic is encrypted in transit (TLS 1.2+).
• Data at rest is encrypted by our hosting providers.
• Tenant isolation is enforced at the database layer via Postgres row-level security.
• Passwords are hashed with bcrypt via Supabase's GoTrue.
• We follow the principle of least privilege for internal access.

No system is perfectly secure. If you think your account has been compromised, email us and we will investigate.

8. Children

Gestio is a business CRM. We do not direct the product at children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.

9. International transfers

Your data may be stored or processed outside your country — primarily Singapore (our primary database region) and the United States (AI features, WhatsApp Cloud, Apple). We rely on standard contractual clauses (SCCs) or equivalent safeguards for transfers out of the EU / UK.

10. Changes to this policy

If we make a material change we will update the "Last updated" date at the top of this page and, for significant changes, post a notice inside the app. Continued use of Gestio after a change means you accept the updated policy.

11. Contact

Questions, concerns, or a data-protection request: support@gestio.dev. We read every email and we respond within 7 business days.