Privacy, Security, Device & Transaction Evidence Policy

This Policy explains how LebPrime may collect and use personal and technical information for account administration, security, fraud prevention, contractual evidence, payment verification and dispute handling.

It is designed to complement, and where adopted by counsel may serve as part of, the LebPrime privacy framework. Final retention periods, controller details, regulatory declarations and cross-border processing arrangements should be confirmed before production launch.

1. Data Controller

Data Controller: [INSERT FULL LEGAL ENTITY NAME] Trading/Brand Name: LebPrime Signals Registered Address: [INSERT ADDRESS] Privacy Email: [INSERT PRIVACY EMAIL] Website: lebprimesignals.com

2. Information We May Collect

• Account information, including name, verified email, Telegram identity and internal user ID.
• Account-creation, login and authentication timestamps.
• IP addresses associated with registration, authentication, policy acceptance, payment, refund and security-sensitive events.
• User-agent, browser, operating-system and device information.
• A first-party persistent device identifier where implemented.
• A privacy-conscious device/browser fingerprint or derived hash where enabled and legally permissible.
• WebAuthn/passkey credential identifiers, public-key material, authentication counters and user-verification status.
• Versions of Terms, Risk Disclosure, Refund Policy and Privacy Policy accepted by the User.
• Consent checkbox records and timestamps.
• Payment/subscription identifiers, references, amounts, status and receipt information.
• Dashboard, Telegram and premium-access evidence reasonably necessary to administer subscriptions or resolve disputes.
• Security and anti-abuse events, including suspected account sharing, failed verification and fraud indicators.

3. Purposes of Processing

• Creating, administering and securing User accounts.
• Confirming that contractual terms and risk disclosures were accepted.
• Verifying payments and subscription entitlements.
• Preventing fraud, account sharing, impersonation and unauthorized access.
• Investigating suspicious activity and security incidents.
• Defending or resolving refunds, chargebacks and contractual disputes.
• Generating and reissuing receipts.
• Complying with applicable legal, accounting, regulatory and evidentiary obligations.
• Establishing, exercising or defending legal claims where permitted.

4. IP Address Evidence

LebPrime may record the public IP address presented to its trusted server infrastructure at account creation, login, Terms acceptance, payment submission, payment verification, refund requests and other security-sensitive events.

An IP address is supporting technical evidence and does not, by itself, conclusively identify a particular human being. IP addresses may be shared, dynamically assigned, routed through mobile carriers, proxies or VPNs.

LebPrime should configure trusted reverse proxies so that client-supplied forwarding headers cannot be accepted blindly as authoritative evidence.

5. Device Identifiers and Browser/Device Fingerprinting

Where implemented and disclosed, LebPrime may use a first-party device identifier and a privacy-conscious browser/device fingerprint or derived identifier for fraud prevention, account security and dispute evidence.

A fingerprint may be created from limited technical characteristics and stored as a hash or derived value rather than as a plain-text profile where reasonably practicable.

Device fingerprinting is not treated as conclusive proof of identity. Browsers, operating systems, privacy tools and hardware changes can alter fingerprint characteristics.

LebPrime should avoid collecting technical attributes that are unnecessary or disproportionate to the security purpose.

6. WebAuthn, Passkeys and Device Biometrics

LebPrime may support WebAuthn/passkeys for authentication or confirmation of security-sensitive actions, including payment authorization.

A User's device may permit local verification using fingerprint recognition, facial recognition, a device PIN or another authenticator method.

When standard WebAuthn/passkey technology is used, LebPrime does not need to receive or store the underlying fingerprint image, facial image or biometric template. Local biometric verification is performed by the authenticator/device, while LebPrime receives cryptographic authentication information and an indication that user verification occurred.

LebPrime may retain credential IDs, public keys, authentication counters, timestamps and user-verification results necessary to validate the authenticator.

7. Events That May Be Recorded

LebPrime may create append-only evidence records for events such as ACCOUNT_CREATED, EMAIL_VERIFIED, TERMS_ACCEPTED, RISK_ACKNOWLEDGED, PAYMENT_SUBMITTED, PAYMENT_VERIFIED, RECEIPT_ISSUED, REFUND_REQUESTED, REFUND_PROCESSED, CHARGEBACK_OPENED, CHARGEBACK_RESOLVED, DEVICE_REGISTERED and WEBAUTHN_VERIFIED.

8. Integrity of Evidence

Where implemented, LebPrime may protect evidence records with server-side integrity controls such as append-only storage, restricted database permissions, cryptographic hashes or HMAC values generated using secrets unavailable to ordinary Users.

Normal Users should not be permitted to edit or delete authoritative security-evidence records.

Integrity mechanisms are intended to detect unauthorized modification and support an auditable event history.

9. Sharing of Evidence

Where reasonably necessary and legally permitted, relevant records may be disclosed to payment processors, banks, card networks, dispute-resolution providers, auditors, professional advisers, courts, regulators, law-enforcement authorities or other competent authorities.

Only information reasonably relevant to the specific purpose or dispute should be shared.

10. Data Minimization and Accuracy

LebPrime should collect only information reasonably necessary for disclosed purposes and should avoid excessive collection.

Users may be permitted to request correction of inaccurate personal information subject to legal, security and evidentiary limitations. Authoritative transaction records should not be overwritten merely to alter historical evidence; corrections should be recorded in a traceable manner.

11. Retention

Personal and technical evidence should be retained only for as long as reasonably necessary for the purpose collected, applicable contractual limitation periods, accounting/tax requirements, fraud prevention, security, legal claims and mandatory regulatory obligations.

Final production retention periods should be documented in a retention schedule approved after legal review.

Where records are no longer necessary and no preservation obligation applies, they should be deleted, anonymized or otherwise disposed of securely.

12. Security Measures

LebPrime should implement reasonable administrative and technical safeguards, including access controls, server-side authorization, encrypted transport, restricted service-role credentials, logging, secure secret management, database policies and monitoring appropriate to the sensitivity of the information.

Sensitive credentials such as passwords, private keys and one-time verification codes must not be stored in readable form merely for evidentiary purposes.

13. User Rights and Contact

Users may have rights under applicable law concerning access, correction, objection or other processing matters.

Requests should be sent to [INSERT PRIVACY EMAIL]. LebPrime may require reasonable identity verification before responding to a request, particularly where disclosure could expose security records or another person's information.

14. Changes to This Policy

LebPrime may update this Policy for legal, regulatory, security, technology or operational reasons. The current version and effective date should be made available on the Website. Material changes will be handled in accordance with applicable notice or consent requirements.

Legal and Regulatory References

Reference note: These references are provided for legal review and do not constitute a representation that LebPrime is licensed, exempt, or otherwise authorized for any regulated activity.

• Lebanese Capital Markets Authority (CMA), public notice dated 18 February 2026 concerning unlicensed capital-markets activities, including investment advice/recommendations and promotion directed to the Lebanese market.
• Lebanese Capital Markets Law No. 161/2011 and applicable CMA regulations, as amended.
• Lebanese Consumer Protection Law No. 659 dated 4 February 2005, as amended.
• Lebanese Law No. 81/2018 on Electronic Transactions and Personal Data, as amended.