Privacy Policy

Who we are

LB Store is a marketplace app for Lebanon run by Carto AI Inc, a United States company. Customers buy from Lebanese brands and stores, order food, and book guesthouses, hotels, apartments, activities, events and cars. Brands, hosts, stores and organizers ("Partners") use the vendor portal, the LB Vendor app and the register to run their business. Carto AI Inc decides how personal data is used across all of these and is the data controller. Contact: support@trycarto.com.

What we collect, and why

Customers (LB Store app)

Data	Why
Name, phone number, email	Your account, order and booking confirmations, support.
Delivery address and a map pin	Delivering your orders. The app asks for your location once, only if you choose, to place the pin; you can type the address instead.
Orders, bookings, returns, points	Fulfilling and tracking what you bought, refunds, rewards.
Payment	Card payments are handled by Stripe. Your card number goes to Stripe, never to our servers; we keep only the last four digits, the card brand and Stripe's payment reference so we can issue refunds and show you your receipts.
Stay and trip details	Dates, guests, special requests and messages with the host, so the host can prepare and so we can resolve problems. Hosts and hotels may collect ID at check-in under Lebanese regulations; that is their record, not ours.
Messages	Chats with brands, stores and hosts are stored so both sides have a record. They may be reviewed when a dispute is raised and are filtered for payment details.
Designs and photos	Stitch-studio designs and any photo you choose to upload. We only access the photos you pick.
Reviews	Shown publicly with your first name and the month, after a completed order or stay.
Device and push token	To send order, booking and message notifications if you turn them on; basic device type and app version to fix bugs.
City you browse in Explore	Used only to show results for that city. It is not tracked across sessions unless you save it.

Partners (vendor portal, LB Vendor app, register)

Data	Why
Name, email, phone, business name and address	Your account, your public shop or listing page, orders and bookings.
Payout details	The account we pay you to (for example a Whish or Purpl account or a bank account) and your payout history.
Tax self-certification	Hosts and vendors paid by Carto AI Inc confirm their tax status (US person or not, country of residence) so we can issue the right tax form. We keep the answers and the version you signed; we do not keep copies of passports or IDs unless you send one for a review we asked for.
Listings, products, photos, calendars	Shown to customers. Calendar feeds you connect (iCal) are read to block dates and are not shared.
Property address and access details	The exact address, door code or key instructions are shown to a guest only after their booking is confirmed and paid.
Staff accounts and register activity	Who rang up each sale, till counts and Z reports, so your books and ours match.
Agreement acceptance	The date, time and version of the Vendor & Host Agreement you accepted.

What we do not do

• We do not sell personal data.
• We do not use your data for third-party advertising and we do not track you across other companies' apps or websites.
• We do not store full card numbers.
• We do not share your data with any government unless a valid legal order requires us to, in which case we share the minimum required.

Who we share data with

• The Partner fulfilling your order or booking — a brand, store, host, organizer or agency — receives your name, phone number and, for deliveries, your address; for a stay, your booking dates, guest count and messages. They may use it only to fulfil your order or booking, under our agreement with them.
• Delivery partners (for example Aramex and partner-store drivers) receive what they need to deliver: name, phone, address, pin.
• Stripe processes card payments and checks for fraud. Stripe's own privacy policy applies to the card data it receives.
• Payout and transfer providers (for example Purpl, Remitly, Whish or a bank) receive a Partner's payout details to send their money.
• Service providers that host our servers and database, send email and push notifications, and store photos, acting on our instructions.
• Carto AI Inc's own tools for accounting, tax forms and support.

Where data is kept and international transfers

Carto AI Inc is in the United States and our hosting and database providers run outside Lebanon. If you are in Lebanon or elsewhere, your data is transferred to and processed in the United States and in the regions our providers use. We apply the same protections wherever it is processed.

How long we keep it

• Your account and profile: while your account is open.
• Orders, bookings, payments, refunds and payouts: 7 years after the transaction, for accounting and tax records, then deleted.
• Messages and reviews: while the related account exists, or earlier on request where no dispute is open.
• Tax self-certifications: as long as the law requires us to keep the related payment records.
• Push tokens and device data: until you log out, uninstall or turn notifications off.

Your rights and choices

• Access, correct, delete. You can edit your details in the app. To get a copy of your data or have it deleted, email us from the address or phone number on the account, or follow lbconnectapp.com/delete-account. We respond within 30 days. Records we must keep by law (section above) are kept but no longer used for anything else.
• Notifications. Turn push notifications off in your phone settings or in Profile at any time. We still send essential emails about orders and bookings you placed.
• Location. The app only asks for your location when you tap the pin button; you can deny it and type the address.
• If you are in the EU/EEA, the UK or another place with data-protection law, you also have the right to object to or restrict processing, to data portability, and to complain to your local supervisory authority. Our legal bases are performance of our contract with you, our legitimate interest in running and securing the service, and consent where we ask for it.

Security

Data is encrypted in transit and at rest. Access inside Carto AI Inc is limited to the people who need it for support, operations and accounting, and admin changes to money, fees and listings are logged. No system is perfectly secure; if a breach affects you we will tell you and the relevant authorities as the law requires.

Children

LB Store is not directed at children under 13, and you must be 18 to order or book. We delete any account we learn belongs to a child under 13.

Changes

We update this page when our practices change and show the date at the top. Material changes are announced in the app before they take effect.

Contact

Carto AI Inc (operating LB Store)
[MAILING ADDRESS — Carto AI Inc], United States
support@trycarto.com