Privacy policy

When we decide how information is used. For information about website visitors, prospective customers and the people who manage customer accounts (for example, names, business contact details and billing records), Lodebridge decides why and how that information is used and is responsible for it under this Policy.

When we process information for a customer. For data that a customer uploads to or connects with the Services (for example, program, evaluation or operational datasets, or enquiries received through a customer's website), Lodebridge acts as a service provider on the customer's behalf. The customer controls that data and is responsible for giving notice to and obtaining consent from the individuals concerned. We use that data only to provide the Services to that customer, under our agreement with them. Questions about that data should go first to the customer that collected it; we will help them respond.

2.1 Information you give us

• Account and contact details: name, business name, job title, business email, phone number, business address.
• Booking and enquiry details: information you submit through forms, demo bookings and support requests.
• Billing details: billing contact, billing address, tax identifiers where applicable, plan and invoice history.
• Communications: emails, messages and call notes exchanged with us.

2.2 Payment card information

Lodebridge does not collect, store or process full payment card numbers. Card details are entered into secure payment fields hosted by our payment processor and are transmitted directly to that processor, which is certified as compliant with the Payment Card Industry Data Security Standard (PCI-DSS) at the highest level. The processor returns a token, and we store only that token together with limited, non-sensitive details (such as card brand, last four digits and expiry date) so that we can show you which card is on file and process authorized renewals. Card numbers and security codes never pass through or rest on Lodebridge's servers.

2.3 Information collected automatically

• Technical and usage metadata: IP address, browser and device type, operating system, referring page, pages viewed, features used, timestamps, and error and performance logs.
• Security and audit logs: sign-in events, permission changes and other actions inside the portal, kept to protect accounts and investigate misuse.
• Cookies and similar technologies: see Section 6.

2.4 Customer Data

Datasets, files, records and content that customers and their authorized users upload, connect or generate through the Services, including analytical datasets and, for WebStudio customers, enquiries, bookings and messages received through their websites. Customers are asked not to upload more personal information, including personal health information, than the Services require.

We use personal information to:

1. create and administer accounts, authenticate users and provide the Services;
2. process subscriptions, payments, renewals, invoices and taxes;
3. respond to enquiries, demo requests and support requests;
4. send service communications, such as billing reminders, trial-ending notices, security alerts and changes to our terms;
5. monitor, secure and troubleshoot the Services, and detect and prevent fraud and abuse;
6. understand how the Services are used, in aggregated form, so that we can improve them;
7. send marketing emails, only where we have your consent under Canada's Anti-Spam Legislation (CASL) — you can unsubscribe at any time using the link in each message; and
8. comply with legal, tax, accounting and regulatory obligations.

We do not sell personal information. We do not use Customer Data to train general-purpose AI models made available to other customers without that customer's express written consent.

We collect, use and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise. Consent may be express (for example, ticking a box) or implied (for example, providing a business card or submitting a support request for the purpose of receiving a response). You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; withdrawing consent may mean that we can no longer provide some or all of the Services.

Payments we receive are settled by our payment processor into our business bank account; our bank does not receive your card details.

We share personal information only with the service providers that are necessary to run the Services, and only to the extent each one needs it. Each is bound by contract to protect the information and use it only to provide services to us.

Category	Purpose	Provider
Hosting and infrastructure	Running the Services, databases, file storage and backups	Lodebridge-operated servers in Canada
Network delivery and security	Delivering pages, encrypting connections and blocking attacks	Cloudflare
Payment processing	Card payments, subscriptions, invoices and fraud prevention	Stripe
Transactional email	Account, billing and security emails	Resend
Scheduling	Booking calls and demos	Cal.com
Product analytics	Measuring site and portal usage	PostHog
AI model providers	Running AI-enabled features on content you submit to those features	OpenRouter and the model providers it routes requests to

We may also disclose information:

• where required by law, a court order or a lawful request from a public authority;
• to protect the rights, property or safety of Lodebridge, our customers or others, including to prevent fraud;
• to professional advisers (such as lawyers and accountants) under a duty of confidentiality; and
• to a successor or prospective successor in connection with a merger, financing, reorganization or sale of all or part of our business, subject to confidentiality obligations and this Policy.

We use:

• Strictly necessary cookies to sign you in, keep your session secure and remember your preferences. The Services cannot work without them.
• Analytics cookies and similar technologies to understand, in aggregate, how pages and features are used.
• Payment and fraud-prevention cookies set by our payment processor on checkout pages.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; blocking strictly necessary cookies will prevent you from signing in.

Customer Data is stored on servers in Canada. Some of the service providers listed in Section 5, including our payment processor, email, scheduling, analytics, network and AI providers, process information outside Canada, including in the United States. When information is transferred, it is subject to the laws of that jurisdiction and may be accessible to its courts, law-enforcement and national-security authorities. We use contractual and other measures to require a comparable level of protection.

We keep personal information only as long as needed for the purposes described in this Policy, then securely delete or de-identify it:

• Account information: for the life of the account and up to 24 months afterwards, unless you ask us to delete it sooner.
• Billing and tax records: for at least six (6) years, as required by Canadian tax law.
• Customer Data: available for export for thirty (30) days after an account ends, then deleted or de-identified within a reasonable period, except where retention is required by law. Backups are overwritten on a rolling schedule.
• Security logs: for as long as reasonably needed to protect the Services and investigate incidents.

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit, encryption at rest for databases and storage, single sign-on with role-based and organization-scoped access controls, audit logging, least-privilege access for staff, and regular backups. More detail is available at /trust. No method of transmission or storage is completely secure, but we work to protect your information and will notify affected individuals and the Office of the Privacy Commissioner of Canada of any breach of security safeguards that creates a real risk of significant harm, as required by PIPEDA.

Subject to limited exceptions under applicable law, you have the right to:

• request access to the personal information we hold about you;
• ask us to correct information that is inaccurate or incomplete;
• withdraw consent to our use of your information, as described in Section 4;
• ask us to delete your information where we no longer need it; and
• ask how your information has been used and to whom it has been disclosed.

To make a request, contact our privacy endpoint at [email protected] with the subject line "Privacy request". We may need to verify your identity before responding. We will respond within thirty (30) days, or tell you if we need more time as permitted by law. There is no charge for most requests.

If your request concerns data a customer has uploaded to the Services, we will refer it to, and assist, that customer.

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under the age of majority.

Lodebridge has designated a Privacy Officer who is accountable for our compliance with this Policy. Questions, requests and complaints can be sent to:

Privacy Officer, Lodebridge Suite M4, 726 Lakeshore Rd E Mississauga, ON L5G 1J6 Canada Email: [email protected] (subject: "Privacy request")

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or 1-800-282-1376.

We may update this Policy from time to time. We will post the updated version on this page with a new "Last updated" date and, for material changes, notify account holders by email or in the portal before the change takes effect.