← Back to Lexitio

Privacy Policy

Effective date: April 23, 2026  ·  Last updated: October 8, 2026

Security, Compliance & Data Privacy

Your data is encrypted in transit (TLS 1.2 or higher), our database provider encrypts the database at rest, and each firm’s data is isolated in the application and by PostgreSQL row-level security. Our hosting, database and storage providers maintain their own SOC 2 reports; Lexitio’s own SOC 2 audit is in preparation.

TLS 1.2+Encryption at rest (database)Row-level securityRole-based accessTwo-factor authentication available

Full details on our Security page.

1. What Data We Collect

We collect the following categories of data:

  • Account data: Your name, email address, firm name, and password hash (we never store plaintext passwords).
  • Matter and client data: Case files, client names and contact information, documents, notes, and other data you create or upload within the Service.
  • Evidence and research uploads: Documents, images, and other files you upload for analysis or investigation.
  • Usage data: Feature usage, query counts, session duration, and performance metrics, used to operate, meter and improve the Service.
  • Technical data: IP address, browser type, device type, and access timestamps, collected for security and audit purposes.

2. How We Use Your Data

We use the data we collect to:

  • Provide, maintain, and improve the Service.
  • Process AI queries on your behalf using third-party LLM providers (see Section 4).
  • Send transactional emails (account notifications, billing receipts, export links).
  • Enforce our Terms of Service and prevent abuse.
  • Comply with legal obligations, including responding to lawful requests from authorities.

3. AI Providers and Your Content

When you use Lexi or other AI features, the content you send (the text of your messages, including any matter or client details you type or paste, and audio you dictate for transcription) is sent through business APIs to these AI providers: Anthropic, Voyage AI, OpenAI and Fireworks. We collect this content when you submit it, and use it only to generate your answers and run the features you use. Providers act under their business API terms.

In the mobile app you are asked for permission before any content is sent, and you can turn Lexi off in Settings. You can delete your account in the app under Settings > Delete account, or by emailing privacy@lexitio.com.

4. Third-Party Subprocessors

We rely on a small set of providers to run the Service — cloud hosting and CDN, a managed database, offsite backup storage, AI model providers, a payment processor, transactional email, and error monitoring. Each receives the data needed for its function. The AI providers are named in Section 3. A current list of all subprocessors is available on request at privacy@lexitio.com.

5. Data Retention

Active account data is retained for the duration of your subscription. When you cancel, your data is retained for 30 days to allow for export, then deleted.

Audit log records are append-only: the database rejects any change to or deletion of them.

6. Your Rights

You have the right to:

  • Access all data we hold about you and your firm via the audit log and data export features.
  • Export all your firm’s data at any time using Settings → Export. Exports include matters, clients, evidence records, documents, invoices, and time entries as a ZIP archive; a download link is sent to your email.
  • Delete your account by contacting privacy@lexitio.com. We will delete your data within 30 days, subject to legal hold requirements and applicable law.
  • Correct inaccurate personal data by updating your account settings.
  • Portability: Export your data in machine-readable JSON format using the export feature described above.

7. Security Measures

  • Our managed PostgreSQL database is encrypted at rest by our database provider, and database backups are encrypted at rest by our storage provider.
  • Each firm’s files are stored privately under that firm’s own storage path and served only through firm-scoped checks.
  • All data in transit is protected by TLS 1.2 or higher.
  • Passwords are hashed using bcrypt with a unique salt per password.
  • Sign-ins, permission changes, matter events and AI queries are recorded in an append-only audit log.
  • Each firm’s data is isolated in the application and by PostgreSQL row-level security in the database.
  • Two-factor authentication is available to every user. Sign-in attempts are rate-limited, and repeated failed attempts trigger a temporary lockout.

8. Cookies and Tracking

The Service uses secure, HTTP-only cookies to keep you signed in. These necessary cookies are always on. With your consent, we also use third-party analytics cookies (such as Google Analytics) to understand how the Service is used and improve it; this data is aggregate and not linked to individual clients or matters. You can decline non-essential cookies at any time using the cookie banner (“Necessary only”), and analytics will not load unless you accept.

9. Children’s Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, contact us at privacy@lexitio.com and we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice in the application at least 30 days before changes take effect.

11. Contact

For privacy-related requests or questions, contact our privacy team at privacy@lexitio.com.

HomeTerms of ServiceDo Not Share My Personal Informationprivacy@lexitio.com