Privacy policy

1. Who handles the data

GECI is responsible for the data needed to create and protect accounts, provide the service, deliver support, and manage the commercial relationship.

Each organization using a GECI workspace decides which operational data it enters about clients, teams, suppliers, participants, and guests. That organization must have a valid basis for handling it and sharing it with the users it grants access to.

2. Data we handle

• Account and profile data, such as phone number, name, email, photo, language, roles, and workspace memberships.
• Operational data entered by users: events, clients and contacts, including a tax identification number when provided, participants, teams, locations, roadbook, comments, budgets, documents, images, and public-access settings.
• Technical and security data, such as sessions, authentication and notification tokens, device, IP address, audit logs, errors, and events needed to protect and diagnose the service.
• Subscription and billing data needed to manage plans and payments. Full payment-method details are handled by the payment provider and are not stored by GECI.
• Preferences and local device data, including language, drafts, PWA installation state, and caches used for performance and offline operation.

3. Purposes and legal bases

• Provide the requested service: code-based authentication, workspace and event management, collaboration, files, public pages, GECIWall, reports, and support.
• Follow the instructions of the organization administering the workspace and apply the permissions configured for each profile.
• Protect accounts, prevent abuse, keep security records, resolve failures, and improve product reliability based on the legitimate interests of GECI and its users.
• Manage subscriptions, billing, and applicable legal obligations.
• Use external AI features only after explicit, revocable authorization tied to the version of the disclosure shown in the app.

4. AI features

Event chat, roadbook drafts, program-type suggestions, and automatic captions use OpenAI. Before the first share, the app identifies the provider, purposes, and data categories that may be sent.

Depending on the requested feature, account and permission context, operational event data visible to the user, prompt and conversation text, and selected files or images may be sent. Requests use store=false. Authorization can be revoked in “AI and data sharing”; revocation prevents new sharing.

5. Providers and recipients

GECI only uses providers needed for hosting and storage, SMS and email delivery, payments, push notifications, place search, weather, and AI. Each provider receives only the data needed for the requested function and is subject to its own processing terms.

The contact form on this website does not store or send the message itself: it prepares an email on the device, and it is only sent when you confirm it in your email app.

Data may also be shared where legally required, to protect rights and safety, or as part of a corporate transaction with appropriate safeguards. GECI does not sell personal data.

6. Public content and sharing

Administrators can publish event pages, GECIWall, QR codes, and information with public or filtered visibility. Content marked as public is accessible to anyone with the relevant link. The organization should review visibility, contacts, and files before publishing or sharing.

7. Retention and deletion

Data is kept while the account or workspace is active and for as long as needed to provide the service, resolve incidents, and meet legal obligations. Drafts, preferences, and local caches remain on the device until replaced, cleared, or the app is removed.

When an account is deleted, personal data, sessions, tokens, notifications, access, comments, reactions, and files uploaded by that person are removed from normal use. Workspaces with another active administrator are transferred; workspaces without a replacement are shown for explicit confirmation and deleted with all their content. References required to preserve operational history may remain in anonymized form. Backups are replaced according to the retention cycle and are not used to reactivate a deleted account.

Where content or an account has been reported or moderated, GECI may retain, even after the content or account is removed, a minimal snapshot, the reason for the report, the decision, and the related audit record, only for as long as needed for security, abuse prevention, the establishment or defense of legal claims, or compliance with a legal obligation. Access is restricted to authorized people, and identifying elements are deleted or anonymized when they are no longer needed for those purposes.

8. Rights and choices

• View and correct profile details and preferences in the app.
• Manage notifications and revoke AI authorization at any time.
• Request access, correction, erasure, restriction, objection, or portability where applicable.
• Delete the account through the authenticated SMS-confirmed flow, or contact GECI when account access is unavailable.
• Complain to the competent data protection supervisory authority.

9. Security and changes

GECI applies profile-based access control, code authentication, revocable sessions, request limits, and audit records. No system removes all risk; protect your device, received codes, and private links.

This policy may be updated when the product, providers, or legal requirements change. The date on this page identifies the current version. Material changes will be presented through appropriate channels.