Privacy Policy
1. Introduction
This Privacy Policy explains how Lornabridge (“we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use lornabridge.com and our online bridge mentoring services (the “Service”). Lornabridge is operated as a general partnership based in New Brunswick, Canada.
We respect your privacy and are committed to handling your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
By creating an account or using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.
2. Who We Are and How to Contact Us
Lornabridge is a partnership operating from New Brunswick, Canada. The partnership offers online bridge instruction, mentored play sessions, video lessons, and related services to adults and supervised teens across North America.
If you have questions about this Policy, your personal information, or wish to exercise any of your privacy rights, please contact us at: [email protected].
We will respond to verifiable requests within thirty (30) days, or sooner where required by law.
3. Scope and Who This Applies To
This Policy applies to all users of the Service, including:
Adults aged 18 and over who create accounts and use the Service;
Teen users aged 16 or 17, where their parent or legal guardian has reviewed this Policy and provided consent to participation, recording, and the other processing described below; and
Visitors to lornabridge.com who do not create accounts.
The Service is not directed at, and we do not knowingly collect personal information from, children under 16. If you are a parent or guardian and you believe your child under 16 has provided personal information to us, please contact us immediately and we will delete it.
4. Personal Information We Collect
4.1 Information You Provide to Us
When you register for an account or use the Service, we collect:
Account information: email address, password (stored as a one-way hash and never visible to us), display name, and time zone.
Profile information: optional avatar image, self-reported skill level (beginner, intermediate, advanced, expert), preferred partner, default seating preference, and email notification preferences.
Payment information: billing name and country. Full credit card or bank details are entered directly into Stripe’s payment forms and are never received or stored on our servers. We retain only a Stripe customer reference, the last four digits of the payment method, the amount, currency, and transaction status.
Communications: messages you send to us, support requests, and any feedback you provide.
Bridge content you upload: hand records, PBN files imported from BridgeWebs or similar systems, BWS files from Bridgemate scoring, and any notes or annotations you add to your bridge sessions.
4.2 Information Generated Through Your Use of the Service
Session participation data: which sessions you join, attendance, your seat at the table, and the partner and tablemates you played with.
Game play data: bidding sequences, cards played, scores, results, and other game state generated during live sessions and solo robot practice.
Video and audio recordings: by default, all live mentored sessions are recorded for instructional review, recap content, and library inclusion. See Section 7 for full details about recording.
Mentor observations: our instructors may join any breakout table during a session and observe play. Notes a mentor records about your play (for example, areas to improve) are linked to your account.
Help requests and chat: messages you send through in-session chat or mentor-summon features.
Friend connections and presence: when you follow another user (a one-way connection), we record that relationship and your online presence indicator (green, yellow, or red) is visible to people who follow you.
4.3 Information Collected Automatically
Device and connection data: IP address, browser type and version, operating system, device type, screen resolution, and approximate location derived from your IP address (city/region only).
Usage data: pages viewed, features used, time spent, click paths, referral sources, and error logs.
Cookies and similar technologies: see Section 9 for our cookie practices.
WebSocket and session telemetry: connection events, reconnection attempts, and latency, used for service reliability.
4.4 Information from Third Parties
We may receive limited information from Stripe (payment confirmations, fraud signals, and dispute notifications) and from email delivery services (bounce and complaint events) for the purposes of operating the Service.
5. Why We Collect Personal Information (Purposes)
We collect and use personal information for the following purposes:
To provide the Service: create and manage your account, deliver lessons, host live mentored sessions, run the bridge robot, process payments, send transactional emails (verification, receipts, session invitations, reminders, and recaps), and validate session access.
To improve learning outcomes: help mentors prepare for sessions, tailor instruction, and review your play to give better feedback.
To create instructional content: recordings of live sessions are used to produce recap segments and may be added to our video library, in line with Section 7.
To operate, secure, and improve the platform: monitor performance, prevent fraud and abuse, debug errors, and develop new features.
To communicate with you: respond to support requests, send service updates, and (if you opt in) send occasional product news.
To meet legal and accounting obligations: retain transaction records, respond to lawful requests, and enforce our Terms of Service.
6. Legal Basis for Processing
Under PIPEDA, we rely on your consent (express where required, implied where appropriate to the context) for our collection, use, and disclosure of personal information. For account creation, payment processing, and live session participation, your express consent is obtained at sign-up. Withdrawal of consent is available at any time as described in Section 13, subject to legal and contractual limits (for example, we must retain transaction records for tax purposes).
If you are a California resident, the legal bases applicable to you under the CCPA/CPRA are described in Section 14.
7. Recording of Live Sessions
Important: by default, all live mentored sessions on Lornabridge are recorded. This is a core part of how the Service works — recordings allow students to revisit lessons, support our recap content, and feed our instructional video library.
When you create an account, you will be asked to acknowledge and consent to this recording practice. If you do not consent to recording, you will not be able to participate in live mentored sessions; you may, however, still use other features of the Service that do not involve recording (such as the bridge robot for solo practice or the video library, where available).
7.1 What Is Recorded
Audio and video from your camera and microphone during the session;
Your display name and any chat messages you send within the session;
The mentor’s screen share, whiteboard, and instruction;
Game play at your table (cards, bids, scores).
7.2 How Recordings Are Used
To produce recap segments shown at the start of subsequent sessions;
To add content to our video library available to subscribers;
For instructor review and quality improvement;
For your own personal review through your account, where this feature is available.
7.3 Visible Indicators and Notice
When a session is being recorded, an on-screen indicator is visible. We will also remind participants verbally at the start of mentored sessions.
7.4 Your Rights Regarding Recordings
You may request that we delete recordings featuring you, that we remove a specific recording from our public video library, or that we mute or blur your participation in a recording where technically feasible. Requests should be sent to [email protected]. We will honour reasonable requests within thirty (30) days, except where retention is required by law or where the recording has already been distributed to subscribers in a way that cannot reasonably be recalled (for example, a video file already downloaded by other users). In such cases, we will stop further distribution and remove your participation from any future re-uses.
7.5 Mentor Observation
Our instructors may join any breakout room (table) at any time during a session, observe play, and provide guidance. This is part of how mentoring works on Lornabridge. Mentors who observe a table are subject to the same recording and confidentiality practices described here.
8. Special Provisions for Users Aged 16 and 17
Lornabridge welcomes teen players aged 16 and 17 who are accompanied by parental or guardian consent. If you are 16 or 17, you may use the Service only if your parent or legal guardian has:
Reviewed this Privacy Policy and our Terms of Service;
Consented to your account creation, the recording of sessions in which you appear, and our use of those recordings as described in Section 7;
Acknowledged that mentors and other adult participants may interact with you during sessions.
Parents and guardians may at any time review the personal information we hold about a teen user, request corrections, request deletion, or withdraw consent on the teen’s behalf by contacting [email protected]. We do not knowingly use teen users’ personal information for marketing or behavioural advertising.
9. Cookies and Similar Technologies
We use cookies and similar technologies to operate the Service and understand how it is used. The categories below describe what we use and why.
9.1 Strictly Necessary Cookies
These cookies are required to deliver the Service and cannot be turned off. They support sign-in, session security, payment processing, and the maintenance of your real-time game state. Disabling these cookies will prevent the Service from functioning.
9.2 Functional Cookies
These cookies remember preferences such as your time zone, default seating, video and audio device choices, and notification settings.
9.3 Analytics Cookies
We use Google Analytics 4 to understand how visitors use lornabridge.com. Google Analytics sets cookies that record an anonymized client identifier and information about your browsing behaviour on our site. We have configured Google Analytics with IP anonymization where available, and we do not enable Google Signals, advertising features, or cross-site advertising personalization. Google may process this data on servers located outside Canada.
9.4 Your Choices
Most browsers allow you to refuse or delete cookies through their settings. You may also opt out of Google Analytics specifically by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout. We do not currently respond to “Do Not Track” browser signals, but California residents are entitled to opt out of “sale” or “sharing” as described in Section 14.
9.5 Cookie Notice
On your first visit to lornabridge.com, we display a brief notice informing you of our cookie practices and linking to this Policy. Continued use of the site indicates acknowledgement of these practices.
10. How We Share Your Information
We do not sell your personal information. We share personal information only in the following circumstances:
10.1 With Service Providers (Sub-Processors)
We rely on the following service providers to operate the Service. Each is bound by contract to use your personal information only for the purposes for which we provide it.
Stripe, Inc. (payment processing) — processes card transactions, manages subscriptions, and runs fraud screening. Stripe receives your name, email, billing country, payment details, and transaction history. Stripe is headquartered in the United States and is PCI-DSS Level 1 certified.
8x8, Inc. (Jitsi as a Service) — powers our live video sessions. JaaS receives your display name, email, and the audio and video streams from your device during sessions, and processes them on servers in North America and Europe.
Bunny.net (video delivery) — hosts and streams our video library and recorded session content. Bunny receives the video files; viewers’ IP addresses and device information are processed for delivery and abuse prevention.
DigitalOcean, LLC (application hosting and managed PostgreSQL database) — hosts our application and stores account data, sessions, payments, and game results. DigitalOcean infrastructure is located in North America.
Email delivery providers (transactional email — currently Mailgun or comparable SMTP services routed through our Strapi backend) — deliver verification emails, receipts, session invitations, reminders, and recaps. They receive your name, email address, and the contents of the messages we send you.
Google LLC (Google Analytics 4) — receives anonymized usage data and IP-derived approximate location to help us understand how the site is used.
This list may change as the Service evolves. We will update this Policy when we add or change service providers.
10.2 With Other Users
Other participants in the Service can see certain information about you, including:
Your display name and avatar in sessions, the friend system, and game results;
Your preferred partner relationship (where you have set one), which is visible to other players;
Your online presence indicator (green/yellow/red) to people who follow you;
Your participation in recorded sessions, where the recording is shared with subscribers.
We do not share your email address, payment information, or other contact details with other users.
10.3 With Mentors
Our mentors have access to information about students they teach, including display name, email address (for invitations), session history, attendance, game results, recordings of sessions you took with them, and any notes mentors record about your play. Mentors are bound by our internal confidentiality requirements.
10.4 For Legal Reasons
We may disclose personal information when we believe in good faith that disclosure is necessary to comply with a legal obligation, lawful request, or court order; to protect our rights, property, or safety; to investigate fraud or security incidents; or to enforce our Terms of Service.
10.5 Business Transfers
If Lornabridge is reorganized, sold, or transfers substantially all of its assets, your personal information may be transferred to the successor entity, subject to this Policy or a successor policy with equivalent protections.
11. Cross-Border Data Transfers
Some of our service providers (notably Stripe, Google, JaaS/8x8, and Bunny.net) operate servers and processing facilities outside Canada, including in the United States and Europe. When personal information is transferred outside Canada, it may be accessible to foreign governments, courts, law enforcement, and regulatory agencies under the laws of those countries. By using the Service, you acknowledge this cross-border processing.
We use service providers that are widely adopted across the industry, are bound by written contracts, and offer protections we consider appropriate to the sensitivity of the information involved.
12. Data Retention
We keep personal information only as long as needed for the purposes described in this Policy, or as required by law:
Account data: retained for as long as your account is active. After account deletion, we retain a minimal record (email hash, deletion date) for up to 12 months to prevent re-registration abuse, then permanently delete it.
Payment and tax records: retained for at least seven (7) years from the date of the transaction to comply with Canadian tax law.
Session recordings: retained indefinitely as part of our instructional library, unless deletion is requested under Section 7.4.
Game results and PBN/BWS files: retained indefinitely as part of your bridge history, unless you request deletion.
Server logs and analytics: retained for up to 24 months in identifiable form, then aggregated.
Backups: encrypted database backups are retained on a rolling 30-day schedule. Information removed from production systems may persist in backups for that period.
13. Your Privacy Rights
Subject to applicable law and reasonable verification, you have the following rights regarding your personal information:
Access: request a copy of the personal information we hold about you.
Correction: ask us to correct inaccurate or incomplete information. You can update most profile fields directly in your account settings.
Deletion: request deletion of your account and personal information. We will delete or anonymize your data, except where retention is required (for example, transaction records).
Withdrawal of consent: withdraw consent to specific uses, including recording. Withdrawing consent for recording will end your access to live mentored sessions but does not affect lawful processing already carried out.
Objection: object to specific uses of your information, particularly direct marketing.
Portability: request a copy of your account data in a structured, commonly used format.
Complaint: contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial privacy commissioner if applicable, if you are not satisfied with how we have handled a privacy concern.
To exercise any right, email [email protected]. We will verify your request through the email address on file or another reasonable method, and respond within thirty (30) days.
14. California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
14.1 Categories of Personal Information
In the past 12 months we have collected personal information falling within the following CCPA categories: identifiers (name, email, IP address, account ID); commercial information (transaction history); internet activity (browsing and usage data); audio and visual information (session recordings); inferences drawn from the above (skill level signals); and, where applicable, sensitive personal information (account credentials).
14.2 “Sale” and “Sharing”
We do not sell your personal information for monetary consideration. We do not engage in cross-context behavioural advertising. We do, however, use Google Analytics 4, which under California law may be considered “sharing” in certain configurations. We have disabled advertising features in Google Analytics; if California regulators take the view that our use of Google Analytics nonetheless constitutes “sharing,” you may opt out by emailing [email protected] or by using a Global Privacy Control signal in your browser, which we will honour.
14.3 Your Rights Under CCPA/CPRA
Right to know what categories and specific pieces of personal information we have collected about you;
Right to delete personal information, subject to exceptions;
Right to correct inaccurate personal information;
Right to opt out of “sale” or “sharing”;
Right to limit use and disclosure of sensitive personal information;
Right to non-discrimination for exercising your rights.
California residents may also designate an authorized agent to make a request on their behalf. To exercise any of these rights, contact [email protected] with “California privacy request” in the subject line.
15. Security
We use administrative, technical, and physical safeguards designed to protect personal information, including:
TLS encryption for data in transit;
Encryption at rest for our managed PostgreSQL database;
Hashed and salted passwords (we never store passwords in plain text);
Token-based session authentication with short-lived JWTs for video access;
Role-based access controls limiting which staff can view which categories of data;
Webhook signature verification for payment events;
Regular dependency scanning and security review.
No system is perfectly secure. If we ever experience a security incident affecting your personal information, we will notify you and applicable regulators in accordance with our legal obligations.
16. Automated Decision-Making
We use a bridge robot to provide opponents and partners during solo practice, and we use automated tools to evaluate play quality for instructional feedback. These tools assist mentors but do not make decisions that produce legal or similarly significant effects on you. Subscription billing decisions and access entitlements are determined by your selections and payment status, not by automated profiling.
17. Links to Third-Party Sites
Our Service may contain links to third-party websites (for example, Stripe’s checkout pages or external bridge resources). This Policy does not apply to those sites. Please review the privacy policies of any third party you interact with through Lornabridge.
18. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will notify you by email and post a prominent notice on lornabridge.com at least thirty (30) days before the change takes effect, unless a shorter period is required by law. The “Last updated” date at the top of this Policy reflects the most recent revision.
19. Contact Us
Questions, comments, or requests regarding this Privacy Policy can be sent to:
Email: [email protected]
Operating jurisdiction: New Brunswick, Canada