Privacy Policy

Last updated: 22 October 2026

gestes is the internal business-development platform of Gribon & Company ("we", "us"). This policy explains what personal data gestes processes, why, and your rights. It covers two groups of people: members of our team who sign in to gestes, and business contacts whom we research and contact through it.

1. Who is responsible

Gribon & Company is the controller of the personal data described here. For any privacy question or request, email benjamin@gribonconsulting.com.

2. Data about business contacts

We process professional information about people we may contact for business purposes:

• name, job title, employer, work location and professional profile URLs;
• business email address and, where available, business phone number;
• publicly available information about the person's company and professional activity;
• our correspondence with the person, including replies, and our notes about the relationship.

We obtain this from business data providers (such as Apollo.io), public websites and public professional profiles, and from the person directly. We rely on our legitimate interest in contacting relevant businesses about services that may be useful to them. Every cold email we send includes a way to opt out; if you opt out, reply asking us to stop, or your email bounces, we add your address to a suppression list and stop contacting you.

3. Data about gestes users

For team members who sign in, we process your name, email address, sign-in records and the actions you take in gestes, to provide and secure the service.

4. Google user data

Team members may connect a Google account so gestes can send email and track replies on their behalf. With your permission, gestes requests these Google scopes:

• gmail.send: to send the emails you approve in gestes from your mailbox;
• gmail.readonly: to read threads gestes is involved in, so it can detect replies, bounces and opt-out requests and stop further emails to that person;
• calendar.readonly and calendar.events (only if you connect a calendar): to show and book meetings;
• userinfo.email and openid: to identify which account you connected.

We use the OAuth tokens only for these purposes. We do not sell Google user data, use it for advertising, or let people read it except where you ask us to, where it is needed for security or to comply with the law, or where the data has been aggregated and anonymised.

gestes's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train generalised AI or machine-learning models.

You can disconnect your Google account at any time in gestes, or revoke access at myaccount.google.com/permissions. Once you disconnect, gestes stops using the account; revoking access at Google invalidates the stored tokens immediately, and we will delete them on request.

5. Service providers

We use these providers to run gestes. Each processes data only on our instructions:

• Supabase (database and authentication, hosted in the EU);
• Vercel (application hosting);
• Google (email sending and reading, calendar);
• Anthropic (AI used to research companies and draft emails for human review);
• Apollo.io (business contact data);
• Tavily and Apify (gathering public web and professional-profile information);
• VoIPstudio (business phone calls, where used).

Some providers are outside the UK and EEA. Where data is transferred, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

6. How long we keep data

We keep business contact data while it is useful for an active or potential business relationship, and review it periodically. Suppression-list entries are kept so we can honour opt-outs. User account data is kept while the account is active.

7. Your rights

Under UK and EU data-protection law you can ask to access, correct or delete your data, object to or restrict its processing, and receive a copy of it. You can object to direct marketing at any time. Email benjamin@gribonconsulting.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data-protection authority.

8. Security

Access to gestes is restricted to invited team members. Data is encrypted in transit, and OAuth tokens are held in an access-restricted database that only the gestes server can read.

9. Changes

We may update this policy. The date at the top shows the latest version.