myLBC
Legal & Privacy
This Privacy Notice explains how LBC Mundial Corporation and its affiliated entities ("LBC," "we," "us," or "our") collect, use, share, and protect your personal data when you use the myLBC mobile application, our website at mylbc.app, and our cargo and money remittance services (collectively, the "Services").
For plain-language answers to common questions, visit our Privacy Help Center. This Notice, together with our User Agreement and E-Sign Disclosure, apply to your use of our Services.
This Notice applies to all individuals who use myLBC, including senders, recipients of remittances or shipments, website visitors, and prospective customers. Where additional rights apply based on your state of residence, we describe those in the US Consumer Privacy Notice section.
The data controller for personal data collected through the Services is LBC Mundial Corporation, 14340 Catalina Street, San Leandro, CA 94577. The applicable affiliated entity for money remittance depends on your state — see Section 3.
Only what we need to provide our Services and meet legal obligations — your name, contact information, date of birth, government-issued ID, SSN/ITIN, transaction details, and device information. See Section 4.
Federal Bank Secrecy Act and Customer Identification Program (CIP) rules require us to verify your identity before processing money remittance. State money transmitter laws impose similar requirements. Your SSN is used only for identity verification, tax reporting, and fraud prevention — never for marketing.
Service providers who help us operate — Signzy (identity verification), TabaPay (remittance payments), Tunel (cargo payments), Twilio (SMS), SendGrid (email), Google Firebase (auth, push notifications), and Meta/Facebook (if you use Facebook Login) — plus regulators when required by law. We do not sell your data. See Section 7.
Generally 5 years from your last transaction date, as required by federal anti-money laundering laws. Some data is deleted sooner; some retained longer if a legal hold applies. See Section 13.
Yes. From the app go to Profile → Account → Close My Profile, or email privacy@lbcusa.net. See our Close My Profile page for full details.
For money remittance, the licensed entity responsible for your data depends on your state of residence:
| Your state | Licensed entity | FinCEN MSB # | NMLS # |
|---|---|---|---|
| California, Virginia, Oregon | LBC Mundial Corporation | 31000286118865 | 1550435 |
| Hawaii | LBC Mabuhay Hawaii Corporation | 31000286118868 | 1218616 |
| Washington, New Jersey | LBC Mabuhay North America Corporation | 31000286118871 | 1130400 |
| Nevada | LBC Mundial Nevada Corporation | 31000315745294 | 2327864 |
For cargo services, the contracting entity is LBC Mundial Corporation regardless of state. See our State Disclosures for license numbers and regulator contacts.
Full name, residential address, email, phone number, date of birth, and an internal customer ID.
Government-issued photo ID (driver's license, passport, or state ID), a selfie or video for biometric identity matching, your SSN or ITIN, and proof of address when required.
Biometric data — face-scan information derived from your identity verification photos and videos — processed on our behalf by Signzy. SSN/ITIN is also treated as sensitive personal data under California law.
Payment instrument details (debit card, credit card, or bank account). We do not store full card numbers or bank account numbers on our systems. Payment data is processed by:
Remittance: amount, destination, exchange rate, fees, recipient information, and transfer purpose. Cargo: declared contents, dimensions, weight, origin and destination, tracking number, and delivery confirmation.
Your recipient's name, address, phone number, and (for remittances) bank account, mobile wallet, or pickup location. See Section 9.
Call recordings (for quality and compliance), chat transcripts, and email correspondence.
Device model, OS, OS version, device identifier, IP address, network type, and app version — used to deliver the Services, secure your account, and diagnose problems.
We use ipstack (ipstack.com) to derive your approximate location (country, state/region) from your IP address. This is used solely to verify that you are accessing the Services from a state where we are licensed, as required by state money transmitter laws. We do not use this data for marketing, profiling, or any purpose other than licensing compliance and fraud prevention.
IP geolocation is approximate and does not identify your precise location. If the Services are unavailable to you and you believe this is a geolocation error, contact support@lbcusa.net.
Screens viewed, features used, and timestamps — for security and fraud detection. We do not use third-party analytics providers.
If you sign in with Facebook, we receive your name, email, and Facebook profile ID based on the permissions you grant. See Section 5.3.
When you create an account, complete identity verification, initiate a transaction, contact support, or respond to a survey.
Technical, device, and usage data when you use the app. We use a minimal set of session and security cookies on mylbc.app only — no cross-site tracking.
| Purpose | Legal basis |
|---|---|
| Create and maintain your account | Contract |
| Verify identity (KYC), screen against OFAC, comply with AML/BSA law | Legal obligation (BSA, USA PATRIOT Act, state MTL laws) |
| Process cargo bookings and remittance transactions | Contract |
| Send transaction confirmations, receipts, and Regulation E disclosures | Legal obligation (CFPB Reg E) |
| Send marketing communications (SMS, MMS, email, push) | Your consent — opt out at any time |
| Detect, prevent, and investigate fraud and security incidents | Legitimate interests |
| Respond to legal requests, court orders, and regulatory requirements | Legal obligation |
| Improve our Services and develop new features | Legitimate interests |
| Enforce our User Agreement | Legitimate interests |
We do not sell your personal data. We do not share it with advertising networks. We share only as follows:
| Provider | Purpose | Data shared |
|---|---|---|
| Meta Platforms (Facebook Login) | Account authentication | Account identifiers, login events |
| Google Firebase | Authentication, push notifications, crash reporting | Account identifiers, device data, crash logs |
| Signzy | Identity verification, biometric face match | Government ID images, selfie/video, name, date of birth |
| TabaPay | Remittance payment processing | Payment instrument data, transaction amount, compliance identifiers |
| Tunel | Cargo payment processing | Payment instrument data, transaction amount |
| Twilio | SMS and MMS delivery | Phone number, message content |
| SendGrid (Twilio) | Email delivery | Email address, message content |
| ipstack | IP address geolocation — to verify you are in a state where we are licensed | Your IP address; returns approximate country and state/region |
To complete cross-border remittances and shipments, we share necessary data with LBC affiliated entities and disbursement partners in the Philippines, including banks, GCash, cash pickup networks, and door-to-door delivery partners.
In connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
We process sensitive personal data — including your SSN/ITIN and biometric data — only for:
We do not use sensitive personal data for marketing or profiling. Biometric data is processed by Signzy on our behalf under contractual obligations to protect it and use it only as described above. Biometric data is deleted within 1 year of verification, unless subject to an ongoing fraud investigation.
When you send a remittance or schedule a shipment, we collect information about your recipient: name, address, phone number, and (for remittances) bank account, mobile wallet, or pickup details. We process recipient data only to complete your transaction, comply with AML/KYC obligations, and notify the recipient that funds or a shipment are available.
We do not use recipient data for marketing. If you are a recipient with questions about your data, contact privacy@lbcusa.net.
Subject to applicable law, you have the right to: know what data we hold and why; access a copy; correct inaccuracies; delete data (subject to legal retention); opt out of marketing and of any sale or sharing of data (we do not sell); limit use of sensitive data; receive a portable copy; not be discriminated against; designate an authorized agent; and appeal a denied request.
If we experience a breach affecting your personal data, we will notify you in accordance with applicable breach notification laws. Fraud or unauthorized account activity: contact fraud@lbcusa.net (24/7) or call 800-338-5424.
To complete cross-border remittances and shipments, your personal data may be transferred to the Philippines and other destination countries. We use contractual safeguards including LBC Group intra-company data protection agreements and require Philippine disbursement partners to comply with the Philippine Data Privacy Act of 2012 (RA 10173).
| Type of data | Retention period | Legal basis |
|---|---|---|
| Money remittance transaction records | 5 years from transaction date | 31 CFR § 1010.430 (BSA); state MTL laws |
| Cargo shipment transaction records | 5 years from transaction date | Tax and accounting (IRC § 6001) |
| Customer Identification Program (CIP) records | 5 years after account closure | 31 CFR § 1022.220 |
| Suspicious Activity Reports (SARs) & supporting records | 5 years from filing | 31 CFR § 1022.320 |
| Currency Transaction Reports (CTRs) & supporting records | 5 years from filing | 31 CFR § 1010.306 |
| Account profile (name, contact info, preferences) | Duration of relationship + 5 years | Compliance retention |
| Marketing preferences and opt-outs | Indefinitely | To honor your choices |
| Customer support communications | Up to 3 years from last contact | Quality and dispute resolution |
| Device and diagnostic data | Up to 12 months | Operational and security purposes |
| Biometric data (face scan) | Deleted within 1 year of verification | Data minimization; state biometric privacy laws |
You can close your account at any time. See our Close My Profile page for full instructions. Upon closure, we delete or anonymize data not subject to a legal retention requirement. Data subject to legal retention (transaction records, KYC records, SAR/CTR records) is moved to restricted-access storage accessible only to authorized compliance personnel and securely deleted when the retention period expires. If you signed in using Facebook Login, we remove the link between your Facebook account and myLBC.
When we make material changes, we will notify you through the app, by email, and by posting a prominent notice on mylbc.app at least 30 days before changes take effect. Continued use of the Services after the effective date constitutes acceptance.
Tagalog version coming soon. Malapit nang maging available ang bersyong Tagalog.
If you are not satisfied with our response, California residents may file a complaint with the California Privacy Protection Agency at cppa.ca.gov. Residents of other states may contact their state attorney general or the applicable state financial regulator listed in our State Disclosures.
This section provides additional disclosures required by the California Consumer Privacy Act (CCPA/CPRA) and equivalent laws in our other licensed states.
| Category | Examples | Sources | Purpose | Sold or shared? |
|---|---|---|---|---|
| Identifiers | Name, email, phone, address, IP address, device ID | You, Facebook Login | Service provision, fraud prevention, compliance | No |
| Customer records (§ 1798.80(e)) | SSN/ITIN, financial account info (via processors) | You | KYC, tax reporting, compliance | No |
| Protected classifications | Age (date of birth) | You | Eligibility verification (18+ requirement) | No |
| Commercial information | Transaction history, purchase records | You, TabaPay, Tunel | Service provision, compliance retention | No |
| Internet / network activity | App interactions, crash logs, device events | Automatic | Security, operational | No |
| Geolocation data (approximate) | State/region derived from IP address via ipstack | Automatic (IP address) | Licensing compliance — verify access from licensed state only | No |
| Sensitive personal information | SSN/ITIN, government ID, biometric data | You, Signzy | KYC, fraud prevention, compliance only | No |
We do not sell personal information and we do not "share" personal information for cross-context behavioral advertising, as defined under California law. We have not engaged in either practice in the past 12 months.
We use Sensitive Personal Information only for purposes permitted by California Civil Code § 1798.121(a) — identity verification, fraud prevention, security, and legal compliance. No action is required to limit use; we already limit it as described. We do not use Sensitive Personal Information to infer characteristics for marketing or profiling.
Email privacy@lbcusa.net or visit Your Privacy Choices. You may designate an authorized agent by providing written authorization signed by you along with agent identity verification.
If we deny your privacy request, appeal by replying to our denial email or writing to the Privacy Officer above. We respond to appeals within 60 days.
We do not disclose personal information for third-party direct marketing purposes.
Residents of Washington, Hawaii, New Jersey, Oregon, Virginia, and Nevada have additional or overlapping rights. See our State Disclosures for state-specific regulator contacts and privacy rights.