Privacy Policy
This Privacy Policy explains how Gestrato accesses, uses, stores, protects, shares and deletes personal information, including information received through Google Sign-In and Google APIs.
This policy applies to the Gestrato website and applications and services operated by Gestrato. If a specific Gestrato application processes additional categories of data, that application may present supplemental privacy disclosures describing those features and permissions.
1. About Gestrato
Gestrato develops business applications, process-automation solutions, cloud integrations and technology consulting services. In this policy, “Gestrato”, “we”, “us” and “our” refer to Gestrato as the organization responsible for the applicable Gestrato-operated service.
Website: https://www.gestrato.com.br/
Privacy contact: contato@gestrato.com.br
Country: Brazil
2. Information we collect
The information collected depends on the Gestrato service and the features you use. It may include:
- Account information: name, email address, account identifier, profile details and authentication information.
- Information you provide: information submitted through forms, support requests, application features or business workflows.
- Technical and security information: IP address, browser and device information, authentication events, diagnostic logs, error information and security events.
- Google user data: information made available through Google Sign-In or another Google API only after the user authorizes the relevant permissions, as described below.
3. Google Sign-In and Google user data
Certain Gestrato applications may allow users to authenticate with a Google Account. When you choose Google Sign-In, the application may receive the Google account information authorized for sign-in, such as your name, email address, profile picture and Google Account identifier. We use this information to authenticate you, create or associate your Gestrato application account, display your account identity, administer access and help protect the service from unauthorized use.
Gestrato does not receive your Google Account password through Google Sign-In.
Additional Google API permissions
Google Sign-In by itself does not provide access to content in services such as Gmail, Google Drive or Google Calendar. If a Gestrato application offers a feature that requires additional Google data, the application requests the required OAuth permission separately through Google's consent screen. The user can approve or decline that permission.
When additional Google API permissions are requested, Gestrato accesses only the Google user data covered by the scopes shown to the user and only for the user-facing feature for which the permission is requested. Application-specific notices may identify the exact Google service, data category and purpose when such integrations are enabled.
| Google data category | How it is used |
|---|---|
| Basic Google identity information (for example, name, email address, profile picture and Google Account identifier) | User authentication, account creation or matching, access control and account display. |
| Additional Google API data, if a specific application explicitly requests and the user authorizes additional scopes | Only to provide the disclosed application feature associated with those scopes. The requested permissions are shown during Google's authorization flow. |
4. How we use personal information
We use personal information only for legitimate, disclosed purposes, including to:
- provide, operate and maintain the requested service;
- authenticate users and manage accounts and permissions;
- perform user-requested integrations and workflows;
- respond to support requests and service communications;
- maintain reliability, diagnose faults and improve security;
- prevent fraud, abuse and unauthorized access; and
- comply with applicable legal obligations.
5. Google API Services User Data Policy and Limited Use
Gestrato's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide or improve user-facing functionality that is visible and relevant to the requesting application. In particular:
- We do not sell Google user data.
- We do not use Google user data for advertising, retargeting, personalized advertising or interest-based advertising.
- We do not provide Google user data to data brokers or information resellers.
- We do not use Google user data to determine creditworthiness or for lending purposes.
- We do not use Google Workspace API data to develop, improve or train generalized/non-personalized artificial-intelligence or machine-learning models.
6. Sharing, transfer and disclosure
We do not sell personal information. We may use service providers for infrastructure, hosting, authentication, database, monitoring, communications or security functions when reasonably necessary to operate the service. These providers may process information only for the purposes for which they are engaged and subject to appropriate contractual and security safeguards.
Google user data is not transferred or disclosed to third parties except when necessary to provide or improve a user-facing feature with appropriate user consent, for security purposes, to comply with applicable law, or in another circumstance expressly permitted by the Google API Services User Data Policy.
7. Human access to Google user data
Gestrato personnel do not access Google user data except when access is necessary and permitted, such as with the user's affirmative consent for support, to investigate abuse or a security incident, to comply with applicable law, or when appropriately limited data is used for internal operations in accordance with applicable privacy requirements.
8. Storage and security
Information may be stored in controlled application databases, infrastructure logs and other systems required to provide the service. If an authorized Google integration requires OAuth tokens to remain connected, access or refresh tokens may be stored for that purpose.
We use reasonable administrative, organizational and technical safeguards appropriate to the service, which may include HTTPS/TLS encryption in transit, access controls, credential and secret management, authentication controls, security logging, software updates and restricted access to production systems. No internet-based service can guarantee absolute security.
9. Data retention
We retain personal information only for as long as reasonably necessary to provide the relevant service, maintain an account or user-authorized integration, satisfy legitimate operational requirements and comply with legal obligations. Retention periods may vary by application and category of information.
When information is no longer required for these purposes, it is deleted or anonymized as appropriate, subject to lawful retention requirements.
10. Data deletion and revoking Google access
You may request access to or deletion of personal information held by Gestrato by emailing contato@gestrato.com.br. Please identify the relevant application and account so that we can process the request. We may take reasonable steps to verify your identity before acting on a request.
You can also review and revoke a Gestrato application's access to your Google Account through Google Account third-party connections. Revoking authorization stops future access under that authorization. Revocation does not necessarily delete information that was previously obtained and legitimately retained; a separate deletion request can be sent to Gestrato.
11. Legal bases and privacy rights
Where applicable, Gestrato processes personal information on a legal basis such as performance of a contract, consent, compliance with legal obligations or legitimate interests. Depending on applicable law, including Brazil's LGPD and the GDPR where relevant, users may have rights to confirmation of processing, access, correction, deletion, anonymization, portability, information about sharing, objection and withdrawal of consent.
Requests can be submitted to contato@gestrato.com.br.
12. International data processing
Gestrato or its technology providers may process information outside Brazil when necessary to provide the service. Where applicable, international transfers are handled using safeguards required by applicable data-protection law.
13. Cookies and similar technologies
Our website and applications may use cookies, local storage or similar technologies that are necessary for authentication, session management, security and application functionality. If optional analytics or tracking technologies are used, required disclosures and choices will be provided where applicable.
14. Children's privacy
Gestrato's general business and technology services are not directed to children. If a specific application is designed for minors, Gestrato will provide additional notices and obtain any authorization required by applicable law.
15. Changes to this Privacy Policy
We may update this Privacy Policy when our services, legal obligations or data practices change. We will update the “Last updated” date and provide additional notice when required. Material changes to the way a Gestrato application uses Google user data will be reflected in this policy or in an applicable product-specific privacy notice before the new practice is implemented where required.
16. Contact
Gestrato — Business and Technology Solutions
Website: https://www.gestrato.com.br/
Email: contato@gestrato.com.br
Privacy Policy: https://www.gestrato.com.br/privacy.html
Terms of Service: https://www.gestrato.com.br/tos.html
Country: Brazil