Privacy Policy

1) Who We Are & Contact

Controller: LIS
Registered Address: Jounieh
Email: support@lis-lb.com
Data Protection Officer (if applicable): 18 October 2025

2) Scope

This Policy applies to the SoftStation mobile apps (iOS/Android), web dashboard/portal, websites, and APIs that link to it. By using the Service, you agree to the practices described here.

3) Data We Collect

A. Information You Provide

• Account & Profile: name, email, phone, business details, role, password (hashed), settings.
• Transactions/Wallet (if enabled): top-ups, purchases, timestamps, amounts, station IDs, invoice details.
• Support & Communications: messages, attachments, feedback, and timestamps.

B. Information Collected Automatically

• Usage & Diagnostics: app interactions, feature clicks, performance logs, crash data.
• Device & Network: device model, OS version, app version, unique device identifiers, IP address, language, time zone.
• Location (only if you grant permission): approximate or precise location for features like nearby stations, navigation, analytics, or fraud/risk checks.
• Notifications Token: push tokens (e.g., FCM/APNs) to send alerts you opt into.

C. Information from Third Parties

• Authentication & Single Sign-On (if used): limited profile data from identity providers.
• Payment Providers (if used): payment status, masked card details, transaction results.
• Maps & Geolocation Services: location lookups, geocoding, and routing results.
• Business Accounts: if you are invited by an organization, administrators may provide your email or role.

D. Examples Matrix

4) How We Use Data

• Provide, maintain, and improve the Service, including real-time station/nozzle dashboards and histories.
• Authenticate users, prevent fraud/abuse, secure accounts, and enforce policies.
• Enable features you request (e.g., alerts, location-based features, wallet/transactions, analytics).
• Communicate with you about service updates, security notices, and support.
• Comply with legal obligations and respond to lawful requests.
• Aggregate/ de-identify data for insights that do not identify you.

5) When We Share Data

We do not sell personal data. We may share:

• Service Providers: cloud hosting, analytics, crash reporting, messaging/FCM, maps/geolocation, payment processors, email/SMS providers—bound by contracts and confidentiality.
• Business Account Admins: user name, role, activity relevant to the organization that manages your workspace.
• Legal/Compliance: when required by law or to protect rights, safety, and the integrity of our Service.
• Business Transfers: in a merger, acquisition, or sale of assets, subject to this Policy.

Third-party SDKs We may integrate SDKs/APIs such as Firebase Cloud Messaging for push notifications and Google Maps Platform for location services. Each provider processes data pursuant to its own terms and policies.

6) Legal Bases (GDPR/UK GDPR)

• Contract: to provide the Service you requested.
• Legitimate Interests: improve, secure, and operate the Service in balanced ways.
• Consent: where required (e.g., precise location, certain analytics, marketing communications). You can withdraw consent at any time.
• Legal Obligation: to meet regulatory and tax requirements.

7) Data Retention

We keep personal data only as long as necessary for the purposes described above, unless a longer period is required by law, to resolve disputes, or to enforce agreements. When no longer needed, we de-identify or securely delete data.

8) Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data we process (e.g., encryption in transit, access controls, least-privilege). No method of transmission or storage is 100% secure, but we work continually to protect your information.

9) Your Privacy Rights

Depending on your location (e.g., EEA/UK, certain U.S. states), you may have rights to:

• Access, correct, or delete personal data;
• Port your data; object to or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with your local data protection authority.

To exercise rights, contact us at support@lis-lb.com. We may verify your identity before responding.

CCPA/CPRA (California)

• We do not “sell” or “share” personal information for cross-context behavioral advertising as defined by CPRA.
• You may request access or deletion of your personal information, and to limit use of sensitive personal information, subject to exceptions.

10) International Transfers

We may process data in countries outside your own. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) to protect personal data transferred internationally.

11) Children’s Privacy

The Service is not directed to children under 13 (or the age required by local law). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to remove it.

12) Cookies & Tracking

Our websites may use cookies and similar technologies for essential functions, analytics, and (where applicable) personalization. You can manage cookies via our cookie banner and your browser settings. Some features may not work correctly without certain cookies.

13) Your Choices & Controls

• Account: You can review/update certain profile information in the app or web portal.
• Location: Enable/disable in your device OS settings. Disabling may affect location-based features.
• Push Notifications: Manage in-app settings and your device OS notifications settings.
• Marketing Emails: Use “unsubscribe” links or contact us.
• Access/Deletion: Email support@lis-lb.com.

14) Changes to This Policy

We may update this Policy from time to time. We will post the revised version with a new “Last updated” date and, if changes are material, provide additional notice as required.

15) How to Contact Us

Jurisdiction/Governing Law: Unless otherwise stated in your contract with us, disputes related to privacy are governed by the laws of Lebanon.

Service-Specific Notes

• Real-time Station/Nozzle Data: Operational telemetry may be linked to your business account & device for auditing and safety.
• AR/Camera (if used): If features use the camera (e.g., AR), imagery remains on-device unless you explicitly upload/share it.
• Payments (if enabled): Payment processing is handled by third-party providers. We do not store full card numbers.
• APIs & Integrations: Google Maps Platform, Firebase Cloud Messaging, analytics, and other providers process data under their own terms.