Privacy Policy

1. Information We Collect

Information you provide directly

When you fill out a contact form, request a consultation, or apply for a position, we collect:

• Name, email address, phone number
• Company name and country
• Service of interest and message content
• CV or application details (for job applicants)
• What you write to Legacy, the AI assistant on this website
• When you subscribe online: your name, business name, billing address, phone number, email address and, if you choose to give it, a tax ID. Your card details are entered on Stripe’s payment page; BMD does not receive your full card number.

Information collected automatically

When you visit our website, we may automatically collect:

• IP address and approximate geographic location
• The name of the network your visit comes from, which can be a company's name if it runs its own network
• When you chat with Legacy: the language, the page, the type of device, and your country and city
• Browser type and operating system
• Pages visited and time spent on pages
• Referring website or search query
• Advertising campaign tags in the address you arrive on (for example utm_source, utm_campaign or a Google Ads click identifier), kept in your browser for that visit and attached to an enquiry, booking request or online subscription you make during it

2. How We Use Your Information

We use the information we collect to:

• Respond to your consultation requests and service enquiries.
• Provide, operate, and improve our professional services
• Process job applications and communicate with candidates
• Send service-related communications (never unsolicited marketing)
• Comply with legal and regulatory obligations
• Maintain the security and integrity of our website
• See what visitors ask Legacy, so we can improve its answers and our website
• Understand who has contacted us: when you give us your email address, we may check public information about the company linked to it or the company you name, and see which pages you read during that visit

3. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in these limited circumstances:

• Service providers: We use Cloudflare for hosting and file storage, Google Firebase for accounts and records, Resend for website emails, Microsoft 365 for calendar appointments and Teams invitations, Stripe for online subscription payments, Google Gemini for the Legacy assistant and for company checks, Leadfeeder to see which companies visit this website, and, only if you accept it on our privacy banner, Google Ads to measure which of our ads lead to enquiries and booked calls. For a company check, Google receives only the company's name or website and the service you asked about, never your name, email address or message. Leadfeeder uses your IP address to match a visit to a company and shortens it so it can't single you out. It shows us the company and the pages read, never a person's name. Our delivery team works from Lebanon, so information may also be accessed or processed there, as well as in the locations of these providers. These services process information needed to operate the features you use.
• Legal requirements: If required by law, court order, or government authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections.

4. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Client engagement records are retained in accordance with applicable professional accounting regulations (typically 7 years in Lebanon). Conversations with Legacy are deleted after 90 days; if you ask Legacy to pass a request to our team, that conversation stays with your request. You may request deletion at any time by contacting us.

5. Data Security

We implement industry-standard security measures to protect your personal information, including encrypted transmission (HTTPS), restricted internal access on a need-to-know basis, and regular security reviews. However, no method of internet transmission is 100% secure, and we cannot guarantee absolute security.

6. Cookies

The website uses browser storage for sign-in and session functionality. Our own analytics records page visits, time on pages, scroll activity and basic browser information using a per-tab session identifier. If you send an enquiry, book a call or create an account, the record of that visit includes the email address you gave us, so we can see which pages you read. Blocking browser storage may affect account features. We do not use this analytics service to display advertising. Leadfeeder works without a cookie on this website.

Google Ads measurement. We advertise on Google Search. If you click “Accept” on our privacy banner, we load Google’s tag for Google Ads (account tag AW-18468552851). It sets Google advertising cookies (such as _gcl_au and _gcl_aw) and tells Google when a visit that started from one of our ads ends in an enquiry or a booked call, so that we can see which ads work. With that, Google receives the reference number of the enquiry or booking, never your name, email address, phone number or message. We do not use it for remarketing or personalised advertising. If you click “Decline”, or make no choice, Google’s tag is not loaded and no Google cookie is set. Your choice is kept in your browser for 12 months. You can change it at any time with “Privacy choices” at the bottom of every page of this website; withdrawing removes those cookies from this website.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict our processing of your data
• Receive your data in a portable format

To exercise any of these rights, contact us at info@bmdlegacy.com. We will respond within 30 days.

8. Third-Party Links

Our website may contain links to third-party websites (LinkedIn, Instagram, Facebook, WhatsApp). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal information.

9. Children's Privacy

Our services are intended for businesses and professionals. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected such information, we will delete it promptly. Enquiries about training for children or school groups should be made by a parent, guardian or the school.

10. Reviews, Photos and Work Plans

If you submit a review, we collect your name, email, rating, feedback and any optional company details and photos. Only approved reviews and photos appear publicly. Your email is not included in the public review. Photos are resized and JPEG camera metadata is removed. Please upload only images you have permission to share, without financial records or other private information. Contact info@bmdlegacy.com if you would like your review or photo removed.

Service-finder business ranges are carried into your booking when you submit it. Client work plans record checklist updates, agreed dates, delivered-file references and approval or revision decisions. These records are available to the client and authorized BMD staff; internal sales follow-up notes remain available only to staff.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: info@bmdlegacy.com
• WhatsApp (Lebanon): +961 79 090 061
• Phone: +1 724 909 0061 (USA) · +1 548 900 0061 (Canada)
• Website: bmdlegacy.com