Privacy Policy

Lex AI ("we", "us", "our") operates the Lex Transaction AI platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read it carefully.

Account Information: When you register, we collect your name, email address, brokerage name, and password (stored as a bcrypt hash — we never store plaintext passwords).

Transaction Data: Files, documents, contacts, deadlines, notes, and other content you upload or create within the Service.

Usage Data: Log data including IP address, browser type, pages visited, and timestamps to operate and improve the Service.

Communications: Emails you send through the Service's automated email features and any support correspondence with us.

Documents you upload are processed by our AI systems to extract transaction data, identify parties, and summarize key terms. This processing occurs on our secure infrastructure. Document contents are not used to train AI models without your explicit consent.

We do not sell your personal information. We may share information with:

Service Providers: Third-party vendors who assist in operating the Service (cloud hosting, email delivery, analytics) under strict data processing agreements.

Portal Recipients: Lenders and clients you invite to transaction portals receive only the specific transaction data you choose to share with them.

Legal Requirements: When required by law, court order, or to protect the rights, property, or safety of Lex AI, our users, or the public.

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• Encrypted storage for sensitive data at rest
• JWT-based authentication with signed access tokens
• Bcrypt password hashing with per-user salt
• Rate limiting and bot detection (Cloudflare Turnstile) on authentication endpoints
• Access controls ensuring users can only access their own data

No system is 100% secure. We encourage you to use a strong, unique password and to notify us immediately of any suspected unauthorized access.

We retain your account and transaction data for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or legitimate business interests (e.g., fraud prevention).

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise these rights, contact us at privacy@lexai.com.

We use minimal cookies necessary to operate the Service, including authentication session tokens. We do not use third-party advertising cookies. You may disable cookies in your browser, but this may affect Service functionality.

The Service integrates with third-party providers including cloud storage, email delivery services, and AI processing providers. These providers have their own privacy policies, and we encourage you to review them. We are not responsible for third-party privacy practices.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided personal information, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on the Service. The updated policy will be effective upon posting with the revised date.

For privacy-related inquiries or to exercise your rights, contact:

Lex AI
Miami, Florida
privacy@lexai.com