Your Data, Your Control

1. Our Commitment to Your Privacy

LexAI Technologies s.r.o. ("LexAI," "we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, process, and protect your information when you use our legal AI platform and services.

2. Data Controller Information

Company

LexAI Technologies s.r.o.

IČO

23589825

DIČ

CZ23589825

Address

Školská 660/3, Nové Město, 110 00 Praha 1, Czech Republic

Email

support@lexaitechnologies.com

3. Information We Collect

Account Information

• Name, email address, and contact details
• Professional information (law firm, practice area)
• Billing and payment information
• Account preferences and settings

Usage Data

• Platform interaction and usage patterns
• Feature usage statistics
• Performance and error logs (anonymized)
• Device and browser information

Legal Content (Zero-Knowledge)

• Documents you upload for analysis
• Legal queries and research requests
• Case notes and annotations

4. How We Use Your Information

Service Provision

• Provide and maintain LexAI services
• Process legal queries and document analysis
• Enable collaboration features for team plans
• Provide customer support

Account Management

• Create and maintain your account
• Process billing and subscriptions
• Send important service updates
• Enforce our terms of service

Service Improvement (Anonymized Data Only)

• Analyze usage patterns to improve features
• Monitor system performance and security
• Develop new features and capabilities

5. Data Sharing and Disclosure

We Do Not Sell Your Data

LexAI will never sell, rent, or trade your personal data or legal content to third parties for marketing or commercial purposes.

Limited Sharing Scenarios

• Service Providers: Trusted vendors who help us operate our services (hosting, payment processing) under strict confidentiality agreements
• Legal Requirements: When required by law or court order, limited to the minimum necessary
• Business Transfers: In the event of a merger or acquisition, with equivalent privacy protections
• Security Incidents: To protect users' rights and safety when necessary

6. Data Security Measures

Technical Safeguards

• AES-256-GCM encryption for all data at rest and in transit
• Zero-knowledge architecture - we cannot decrypt your legal content
• Multi-factor authentication and access controls
• Regular security audits and penetration testing
• ISO 27001 and SOC 2 Type II compliance

Operational Security

• Employee background checks and security training
• Principle of least privilege access
• Incident response and breach notification procedures
• Regular security updates and patch management

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

Access and Portability

• Right to access your personal data
• Right to data portability - Export all your data instantly through self-service tools in account settings. Available in PDF format with password verification for security.
• Right to be informed about data processing

Control and Correction

• Right to rectify inaccurate data
• Right to restrict processing
• Right to object to processing

Deletion

• Right to erasure ("right to be forgotten")
• Account deletion tools in your settings
• Secure data destruction procedures

8. Data Retention

Account Data

• Maintained while your account is active
• Deleted within 90 days of account closure
• Some billing records retained for legal compliance (7 years)

Legal Content

• Under your complete control
• Can be deleted at any time through your account
• Automatically deleted when account is closed
• Secure deletion from all systems and backups

Usage Analytics

• Anonymized data retained for service improvement
• Cannot be linked back to individual users
• Aggregated statistics may be retained indefinitely

9. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our privacy team:

You also have the right to lodge a complaint with the Czech data protection authority (Úřad pro ochranu osobních údajů - ÚOOÚ) if you believe your privacy rights have been violated.