Privacy Policy

LBC Network Inc. ("LBC," "we," "us," or "our") is a Canadian company based in Ottawa, Ontario. We operate LBC Auto (AI-powered auto shop management software), LBC Hub, LBC AI tools, and associated services (the "Services").

We serve customers across Canada, including Ontario and Québec (Gatineau), and internationally. This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Act 25 (formerly Bill 64), and other applicable Canadian privacy laws.

We may collect the following categories of personal information:

• Identity and Contact Information: Name, email address, phone number, physical address.
• Customer and Vehicle Information (via LBC Auto): Customer profiles, vehicle details (make, model, year, trim, engine, VIN, license plate, color), 4-angle exterior photos and dashboard condition photos, repair orders, estimates, invoices, appointments, service history.
• Account and Access Information: Shop administrator details, technician PINs, customer activation codes (6-digit, 10-minute expiry), salted and hashed passcodes created by customers for the Customer Portal. We do not store, log, or transmit plaintext passcodes.
• Transactional and Financial Information: Payment records, billing details, and Solana / $LBC token transactions (wallet addresses, transaction hashes, amounts). Note: On-chain Solana transactions are publicly visible on the blockchain by design and cannot be reversed, deleted, or modified.
• Technical and Usage Data: IP address, device information, log data, browser type, interactions with our websites, portals, and AI features.
• Communications: Messages between shops and customers, chat conversations through LBC AI, support inquiries, booking pipeline messages from shop websites.
• AI Interaction Data: Inputs provided to LBC AI features (booking requests, pricing inquiries, diagnostic descriptions), AI-generated responses, and usage patterns used to improve AI quality and relevance.

We do not intentionally collect sensitive personal information (e.g., health data, biometric data, or government ID numbers) beyond what is necessary for vehicle service records unless required by law or explicitly provided. We do not knowingly collect personal information from individuals under 18 without parental or guardian consent.

• Directly from you or your authorized representatives when you create an account, use the Customer Portal, book services through a shop's website, or contact us.
• From auto shops using LBC Auto (shop-scoped customer and vehicle data, tenant-isolated per shop).
• Automatically through cookies, logs, and similar technologies when you use our websites or Services.
• From third-party service providers (e.g., payment processors, hosting providers, Solana blockchain) as needed to deliver the Services.

Customer Portal access uses a shop-issued secure activation code followed by a customer-created salted and hashed passcode. We do not store plaintext passcodes. After 5 failed login attempts, the account is locked.

We collect and use personal information only for purposes that a reasonable person would consider appropriate, including:

• Providing and operating the Services (shop management, appointments, estimates, invoices, AI assistance, Customer Portal).
• Authenticating users and enforcing strict per-shop (tenant) data isolation. One shop's customer data is never accessible to another shop.
• Processing payments, including Solana-based $LBC token transactions.
• Operating AI features: booking pipeline automation, pricing suggestions, diagnostic support, and chat assistance. AI processing occurs server-side with appropriate safeguards. Personal data is not used to train external AI models. You may opt out of AI-assisted features by contacting us — this may limit some functionality.
• Communicating with you about your account, services, or support.
• Improving our Services, user experience, and AI quality (with data processed under appropriate safeguards, never sold or shared with third-party model providers).
• Ensuring security, preventing fraud, and complying with legal obligations.
• Other purposes with your consent or as permitted/required by law.

We obtain consent for the collection, use, and disclosure of personal information, except where PIPEDA or Québec's Act 25 permits otherwise (e.g., legal requirements or certain emergencies).

For sensitive personal information, we obtain express consent. For less sensitive information, consent may be implied from your use of the Services.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may affect our ability to provide certain Services.

Note for Québec residents (Act 25 compliance): We have designated a Privacy Officer (see Section 12). We conduct privacy impact assessments for new projects or technologies that involve personal information. We do not use personal information for automated decision-making without appropriate safeguards and your knowledge.

We do not sell personal information. We may disclose personal information only:

• To service providers who assist us (hosting, payment processing, analytics, support) under contractual obligations to protect the information.
• Within a shop's isolated environment to authorized shop staff and technicians as needed to deliver services.
• When required or permitted by law (e.g., court order, regulatory request).
• In connection with a business transaction (e.g., merger or sale), with appropriate protections.
• With your consent.

We maintain strict multi-tenant isolation so that one shop's customer data is not accessible to other shops. All service providers are bound by contractual obligations to protect personal information and are prohibited from using it for their own purposes.

Personal information may be processed or stored outside Canada (including by cloud infrastructure providers in the United States). When we transfer personal information outside Canada, we use contractual or other means to provide a comparable level of protection. Information stored or processed outside Canada may be subject to the laws of those jurisdictions.

On-chain Solana / $LBC transactions are publicly visible on the blockchain by design. Wallet addresses, transaction amounts, and timestamps are permanently recorded on the Solana blockchain and cannot be deleted or modified. We do not store private keys or seed phrases on our servers.

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to meet legal or regulatory requirements, or to resolve disputes. When no longer needed, we securely destroy, anonymize, or aggregate the information.

Vehicle service records (repair orders, estimates, invoices, photos) are retained for the duration of the shop's active subscription plus 7 years for legal/audit purposes, unless a longer period is required by law.

On-chain blockchain data (Solana / $LBC transactions) cannot be deleted by nature of blockchain technology — this is a fundamental limitation. We do not control or modify blockchain data once a transaction is confirmed.

We implement physical, organizational, and technical safeguards appropriate to the sensitivity of the information, including:

• Encryption in transit and at rest.
• Salted and hashed passcodes (never stored in plaintext).
• Strict per-shop data isolation and role-based access controls.
• Server-side AI processing with permissions, audit trails, and rate limiting.
• Regular security reviews and access monitoring.
• 5-attempt lockout for Customer Portal access.
• Short-lived, revocable customer sessions with per-request validation.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

In the event of a privacy breach involving personal information that poses a real risk of significant harm to affected individuals, we will:

• Assess and contain the breach promptly.
• Notify affected individuals and the appropriate regulatory authorities (including the Office of the Privacy Commissioner of Canada and the Commission d'accès à l'information du Québec) as required by PIPEDA and Québec's Act 25.
• Document the breach, remediation steps, and preventive measures.

Subject to limited exceptions under PIPEDA and Québec's Act 25, you have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Withdraw consent (where applicable).
• Challenge our compliance with this Policy.
• Request information about how your personal information has been used or disclosed.

To exercise these rights, contact us using the details in Section 12. We will respond within the timeframes required by law (generally 30 days under PIPEDA, 30 days under Act 25).

We are responsible for personal information under our control.

We also serve customers in the National Capital Region, including Gatineau, Québec, and comply with Québec's Act 25 privacy requirements.

We use cookies and similar technologies on our websites to operate and improve our Services. We use:

• Essential cookies (required for the Services to function).
• Analytics cookies (to understand how visitors use our websites).
• Preference cookies (remember your settings).

You can manage cookie preferences through your browser settings. We do not use cookies for targeted advertising or sell cookie-derived data to third parties.

We may update this Privacy Policy from time to time. The "Last Updated" date will reflect changes. Material changes will be communicated through our website or directly to affected users. Continued use of the Services after changes constitutes acceptance of the updated Policy where permitted by law.

If you have concerns about our privacy practices, please contact us first. You may also file a complaint with the appropriate privacy authority:

For questions about this Privacy Policy or our privacy practices:

• For customer portal support: HTTPS://LBC-HUB.COM/SERVICES
• For LBC Auto inquiries: HTTPS://LBCHUB.TECH
• For general inquiries: HTTPS://LBC.NETWORK