Privacy Policy

1. Controller and Contact Details

The controller of your personal data is:

Nordic Learning Intelligence Oy (Business ID 3599307-3), Helsinki.

For all questions regarding this policy and to exercise your rights, please contact: privacy@gesento.ai.

2. What Data We Process, Why, and on What Legal Basis

We collect and process your personal data in two ways: data that you provide to us yourself, and data that our system generates or collects automatically in connection with your use of the service.

A. Data You Provide to Us Yourself

• Account Details: Name, email address, password (hashed), and other login credentials for account creation, authentication, customer support, and subscription management.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR).
• User-Provided Video Material: Uploaded presentation videos and their audio track (raw data) as input for analysis.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR).
• Profile and Onboarding Data:
  • Basic details: Name, preferred name, native language(s), feedback language, and voice range settings.
  • User background and self-assessment: Age group, professional role, typical presentation scenarios, coaching goals, self-assessment as a presenter, attitude toward presenting and performance anxiety, as well as strengths and challenges as a presenter.
  • Date and time the form was completed.
  • Purpose of use: The data is used to customize personal coaching, recommendations, and automated feedback, as well as for service development and statistics.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR) and legitimate interest (Art. 6.1(f) GDPR) regarding product development and aggregated statistics.
• Inquiries, Newsletters, and Marketing:
  • Information provided via website contact forms, demo requests, or newsletter subscriptions (name, email address, organization, and message content).
  • Contact details of organization decision-makers (name, title, organization, email address) collected from public sources (such as company websites, trade registers, or professional networks) for B2B direct marketing and sales.
  • Purpose of use: Responding to contact requests, customer communication, information, and B2B direct marketing.
  • Legal basis: Legitimate interest (Art. 6.1(f) GDPR) in B2B contacts and marketing; Consent (Art. 6.1(a) GDPR) for subscribing to newsletters. The data subject always has the right to object to direct marketing.
• Online Store Payments: Payment card and online transaction details and billing addresses are processed by our payment partner Paddle (see Section 6).
• Direct Corporate Invoicing: E-invoicing details, billing addresses, and the name and contact details of the company's billing contact person for corporate customers for invoicing, accounting, and customer relationship management.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR) and statutory accounting obligation (Art. 6.1(c) GDPR).

B. Data Collected Automatically and Generated by the Service

• Cookies and Site Analytics (Website):
  • Technical data collected on the use of the website (gesento.ai), such as IP address, browser type, operating system, page views, landing page, and content read.
  • We use essential cookies for basic website functionality (e.g., language selection and session management) and analytics cookies (Google Analytics) for website traffic statistics and improving user experience. Analytics are collected in an aggregated statistical form.
  • Legal basis: Legitimate interest (Art. 6.1(f) GDPR) regarding essential cookies; Consent (Art. 6.1(a) GDPR) regarding analytics cookies (managed via cookie banner).
• Form Spam Protection (Website): On pages with forms (contact and waitlist), reCAPTCHA Enterprise analyzes technical data such as IP address, browser details, and interaction with the page to detect automated abuse.
  • Legal basis: Our legitimate interest in protecting our forms and systems (Art. 6.1(f) GDPR).
• Audio Transcription: Automatic transcription generated from the video's audio track to present feedback and summary.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR).
• Presentation Analysis and Parameters: Computational parameters derived from video and audio (e.g., postures, gestures, eye contact, speech tempo, and word choice) to form a presentation profile.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR).
• Coaching Feedback and History: Verbal feedback and instructions generated by the system to support personal development.
  • Legal basis: Performance of a contract (Art. 6.1(b) GDPR).
• Emotional Expression Analysis (Optional): Expression parameters derived from facial expressions (see Section 4).
  • Legal basis: Your explicit separate consent (Art. 6.1(a) GDPR).
• Corporate Customer Administrative Data: Your name, work email address, activation status, and number of uploaded videos, reported to your employer (see Section 12).
  • Role: We process this data on behalf of your employer, who acts as the controller and determines the legal basis for the processing.
• Quality Control Access Logs: Maintenance access logs to coaching data for quality assurance and troubleshooting (see Section 5).
  • Legal basis: Our legitimate interest (Art. 6.1(f) GDPR).
• Technical Logs and Device Information: IP address, browser type, operating system, and session identifiers for data security, maintenance, and prevention of misuse.
  • Legal basis: Our legitimate interest (Art. 6.1(f) GDPR).

Important clarification on AI processing restrictions:

The Service does not create biometric identifiers from your face or voice, nor is it used to identify or authenticate you. Your videos, audio track, transcription, or derived analysis data are never used to train AI models, nor are they sold or rented to third parties.

3. How Your Videos Are Analyzed

Presentation analysis is based on a multi-stage process utilizing our proprietary algorithms, computer vision, acoustic speech analysis, and AI models. The AI models we use are Google's Gemini models, run on Google Cloud's Gemini Enterprise Agent Platform.

Videos and audio tracks are always processed within the EU/EEA. We do not train AI models with your data, and our contract with Google prohibits using it to train Google's models.

4. Automated Analysis, Profiling, and Expression Analysis

The feedback you receive is an automated evaluation of your performance, which constitutes profiling as defined in the GDPR. The Service does not make automated decisions under GDPR Article 22 that produce legal effects or similarly significantly affect the data subject: feedback is provided solely for your personal use as a learning tool. The feedback does not constitute medical, psychological, or therapeutic advice.

The Service includes an optional emotional expression analysis feature that evaluates facial expressions (emotion recognition as defined under the EU AI Act):

• The feature is always disabled in corporate customer and educational institution packages and is not used in workplaces.
• In consumer use, the feature is optional. It is explained separately before uploading a video and is activated only with your explicit consent.
• The analysis is neither psychological profiling nor a health assessment.

5. Quality Control

To ensure the quality and accuracy of AI evaluations, authorized maintenance personnel may inspect individual videos and generated feedback when necessary. Access logs are maintained for views conducted during quality control to prevent misuse. Data is not copied or disclosed outside the company.

The legal basis for processing is our legitimate interest in providing reliable coaching feedback (Art. 6.1(f) GDPR), and you may object to this processing by contacting privacy@gesento.ai.

6. To Whom Your Data Is Disclosed

We use the following service providers (data processors) who process your data on our behalf under a written processing agreement:

• Google Cloud EMEA Limited (EU): Video analysis (including Gemini models on Gemini Enterprise Agent Platform), data storage, server hosting, infrastructure, and form spam protection (reCAPTCHA Enterprise). The contract prohibits training AI models on customer data.
• Google Ireland Limited (Google Analytics): Website traffic statistics, only if you have consented to analytics cookies.
• Postmark (AC PM LLC, a subsidiary of ActiveCampaign, United States): Transactional email delivery, authentication emails, and system notifications.
• Paddle (Payment Partner): For online payments, Paddle acts under the Merchant of Record model and is an independent controller (Art. 4(7) GDPR) regarding payment data. Paddle is independently responsible for processing payment data, billing, fraud prevention, and tax obligations in accordance with its own privacy policy.
• Accounting and Accounting Firm: Invoicing and accounting materials generated from direct corporate invoicing are processed by the Company and disclosed, as required by law, to our accounting firm and auditor when necessary.

We do not sell your data or disclose it to third parties for marketing purposes.

7. Where Your Data Is Processed and International Transfers

Your videos, coaching data, and account details are processed and stored within the EU/EEA. Payment data is processed by Paddle in the United Kingdom, which has been granted an Adequacy Decision by the European Commission. We do not transfer your video or coaching data outside the EU/EEA.

Google Analytics and reCAPTCHA Enterprise on our website may involve transfers of technical data to Google LLC in the United States. These transfers are based on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, under which Google LLC is certified. Our email service provider Postmark (AC PM LLC) processes email addresses and message content in the United States. Transfers of personal data to the United States are primarily based on the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, under which Postmark is certified, and secondarily on the European Commission's Standard Contractual Clauses.

8. How Long We Retain Your Data

We retain personal data only for as long as necessary for the purposes described in this policy. Videos and coaching data are kept for 90 days after your subscription ends so you can return to the Service without losing your progress. Retention periods by data category:

You may delete your account and data yourself at any time in the application settings. When you delete your data, it is erased from our active production systems and our sub-processors' storage without delay. Copies remaining in automated system backups are overwritten within 30 days and are not subjected to active processing in the meantime.

Statistical Data: After account deletion, an anonymized compilation of onboarding survey responses may be retained for product development and statistical purposes in a form that cannot be linked to an individual.

Our payment partner Paddle retains payment and billing information in its possession as an independent controller in accordance with its own statutory accounting obligations.

9. Data Security

We protect your personal data using appropriate technical and organizational security measures. These include data encryption at rest (AES-256) and in transit (TLS 1.2 or higher), strict access control, and role-based access rights.

10. Your Rights

Under the GDPR, you have the following rights:

• Right to access your data and receive a copy of the personal data being processed.
• Right to request rectification of inaccurate or incomplete data.
• Right to request erasure of your data (“right to be forgotten”).
• Right to restrict processing or object to processing (including processing based on legitimate interest).
• Right to data portability.
• Right to withdraw your consent at any time.

You may exercise your rights by contacting privacy@gesento.ai. Exercising your rights is free of charge. Please note that if you request the erasure, restriction, or object to the processing of data necessary for providing the Service, the provision of those functions or the entire Service to you may be prevented.

11. What You Receive When Requesting a Copy of Your Data

You have the right to access all personal data we hold about you. Upon receiving a request, we will provide a copy of your account details, profile data, uploaded videos, transcripts, analysis results, and coaching feedback, as well as any other personal data we hold about you. For data portability, we provide the data you have provided yourself and the feedback generated for you in a machine-readable format.

The right of access does not extend to the Company's trade secrets, proprietary educational content of the application, or the protected internal operation of algorithms (Art. 15(4) GDPR and Recital 63).

12. Corporate Customers

When you use the Service provided by your employer, the Company is an independent controller of your coaching data (videos, analysis, and feedback). Your employer does not have access to your videos or coaching results.

The only data reported to your employer is whether you have activated the Service and how many videos you have uploaded. For this limited administrative data, your employer acts as the controller and the Company as its processor. Results from the Service may not be used in any employment-related decision-making.

13. Age

The Service is intended for persons who are 18 years of age or older. We do not knowingly process personal data of individuals under 18 years of age.

14. Complaints

If you consider that the processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with a competent supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).

15. Changes to This Policy

We may update this Privacy Policy as our Service or legislation changes. The up-to-date version is always available in our Service. If we make material changes to this policy, we will notify you, as appropriate, in the Service or by email before the changes take effect.