Privacy Policy

1. Introduction

Gestivio Inc. ("Gestivio", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform at gestivio.ca and related services.

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private sector privacy law, as well as applicable provincial privacy laws including Québec's Law 25 (Act Respecting the Protection of Personal Information in the Private Sector).

2. Information We Collect

2.1 Information you provide directly:

• Account registration information: name, email address, password
• Business information: company name, address, phone number, service types
• Customer data you enter: names, emails, addresses, service history
• Financial information: invoice amounts, payment records (we do not store credit card numbers — payments are processed by Stripe)
• Communications you send through our platform

2.2 Information collected automatically:

• Log data: IP addresses, browser type, pages visited, timestamps
• Device information: device type, operating system
• Usage data: features used, clicks, session duration
• Cookies and similar tracking technologies (see our Cookie Policy)

3. How We Use Your Information

We use your information to:

• Provide, operate, and improve our services
• Process transactions and send billing communications
• Provide customer support
• Send service updates, security alerts, and administrative messages
• Send marketing communications (only with your explicit consent)
• Comply with legal obligations
• Analyze usage patterns to improve our platform
• Power AI features including our business intelligence and booking assistant

4. AI and Data Processing

Gestivio uses artificial intelligence features powered by Anthropic's Claude API. When you use AI features, your business data (job descriptions, customer names, invoice summaries) may be processed by these AI systems to generate responses. We do not use your data to train AI models. AI processing is subject to Anthropic's privacy policy.

5. Sharing Your Information

We do not sell your personal information. We share information only with:

• Service providers: Supabase (database hosting), Stripe (payments), Resend (email delivery), Anthropic (AI), Vercel (hosting)
• Legal requirements: When required by law, court order, or governmental authority
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you

All third-party service providers are contractually required to maintain appropriate data protection standards.

6. Data Storage and Security

Your data is stored on Supabase infrastructure, hosted on AWS in Canada or the United States. We implement industry-standard security measures including:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Row-level security ensuring users can only access their own data
• Regular automated backups
• Access controls and authentication requirements

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Upon account deletion, we delete your data within 30 days, except where retention is required by law (e.g., tax records may be retained for 7 years as required by the Canada Revenue Agency).

8. Your Rights Under PIPEDA

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Withdrawal of consent: Withdraw consent for optional processing at any time
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, contact us at privacy@gestivio.ca. We will respond within 30 days.

9. Cookies

We use essential cookies for authentication and session management, and optional analytics cookies to improve our service. See our Cookie Policy for details.

10. Children's Privacy

Gestivio is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or prominent notice on our platform at least 30 days before taking effect.

12. Contact Us

For privacy-related questions or to exercise your rights:

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.