Privacy policy

1. Controller and contact

The controller for processing described here is:

Company

Ajay Vaidhyanathan Swaminathan

Address

Karl-Marx-Ring 90
81735 München
Germany

Data protection contact

hello@getlexora.de

Full provider details are in our legal notice.

2. Data protection officer

We are not required to appoint a data protection officer under Article 37 GDPR or section 38 of the German Federal Data Protection Act (BDSG), and have not appointed one voluntarily. For any data protection matter, contact us using the details in section 1.

3. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access your personal data (Article 15);
• rectification of inaccurate data (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• object to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time to processing for direct marketing (Article 21); and
• withdraw consent at any time, with effect for the future, where processing is based on your consent (Article 7(3)).

To exercise any of these rights, write to the data protection contact above. You also have the right to lodge a complaint with a supervisory authority (see section 18).

4. Visiting the website

When you open our website, your browser sends technical data that our hosting provider processes to deliver the pages and keep the service secure: your IP address, the date and time of the request, the page requested, the referring page, and your browser and operating system identifiers. This data is kept in server log files.

Purpose

delivering the website, ensuring stability and security, diagnosing faults

Legal basis

Article 6(1)(f) GDPR (our legitimate interest in a secure, working website)

Retention

7 days, then deletion or anonymisation

Recipients

Railway Corp. as our processor

5. Cookies and local storage

Lexora uses only cookies and browser storage that are necessary for the site to function: a theme preference, a dismissed-banner flag for this consent notice, and the session and security cookies set by our authentication provider when you sign in. These are used on the basis of section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), because they are strictly necessary to provide the service you requested, and Article 6(1)(f) GDPR.

We do not use analytics, advertising, or tracking cookies. If that ever changes, we will ask for your consent (section 25(1) TDDDG, Article 6(1)(a) GDPR) through the banner before any such cookie is set, and you will be able to withdraw that consent at any time.

6. Creating and managing an account

To create an account you provide an email address and a password, or you sign in through a third-party identity provider. Our authentication provider (Clerk) processes your email address, your name if you give one, authentication credentials or federated identifiers, session tokens, and the IP address and device information tied to each sign-in, so that we can create and secure your account.

Purpose

account creation, authentication, account security, support

Legal basis

Article 6(1)(b) GDPR (performance of the contract of use), and Article 6(1)(f) GDPR for account security

Retention

for the life of the account, then deletion (see section 15)

7. Analysing your contracts

When you upload a document, the following happens:

• the file is transmitted to our text-extraction provider (Unstract, via an EU processing endpoint), which returns the plain text;
• the extracted text is split into clauses and sent to our AI provider (the Google Gemini API) to produce risk flags and suggested wording;
• the extracted text, the analysis, and any edits you make are stored in our database so you can return to them.

By default the uploaded original file is not retained. Only the extracted text is kept, unless an administrator of your workspace enables original-file storage.

Our AI provider states that content submitted through its API is not used to train its general models. Contract text is processed only to generate the analysis you asked for.

Purpose

providing the contract analysis, suggested wording, versioning, and portfolio views you use the product for

Legal basis

Article 6(1)(b) GDPR where the document concerns you as account holder. Where the document contains other people's personal data, see section 8.

Retention

until you delete the document, or until your account is closed (see section 15)

8. Personal data of third parties in your documents

Contracts you upload often contain the personal data of other people, such as counterparties, signatories, or employees. For that data you (or your organisation) are the controller and Lexora acts as your processor under Article 28 GDPR. Our data processing agreement governs that processing and forms part of your contract with us.

Because that data reaches us from you rather than from the individuals concerned, the information duty under Article 14 GDPR rests with you as controller. You are responsible for having a legal basis to upload the document and, where required, for informing those individuals.

9. Automated processing

Lexora analyses contract text automatically and proposes wording. These are suggestions for your review. The product does not take decisions that produce legal effects concerning a person, or similarly significantly affect a person, based solely on automated processing within the meaning of Article 22 GDPR. A human, namely you, decides what to do with every finding.

10. Billing

Paid plans are not offered yet, so no billing data is processed today. This section describes what will happen once billing goes live. We will update this policy, and name the payment provider, before any charge is taken.

If you take a paid plan, we process your billing name and address, your VAT identification number where applicable, the plan and amount, and payment metadata returned by our payment provider. We do not receive or store full card numbers.

Purpose

processing payments, invoicing, meeting tax and accounting duties

Legal basis

Article 6(1)(b) GDPR (the paid contract) and Article 6(1)(c) GDPR (statutory retention duties)

Recipients

the payment provider named at checkout, our tax advisers, and the tax authorities where required

Retention

invoices and accounting records for up to 10 years under section 147 of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB)

11. Support and messages

If you contact us by email or through a support channel, we process the content of your message and your contact details to answer it and, if relevant, to follow up.

If you use the contact form on our website, we process the name, email address, and message you enter. Each submission is stored in our database (Neon, see section 13) and a copy is delivered by email to our own mailbox over an encrypted connection; the message therefore also passes through the provider that hosts that mailbox. We also record the IP address the submission was sent from, for the abuse prevention described in section 12.

Legal basis

Article 6(1)(b) GDPR where the request relates to the contract, otherwise Article 6(1)(f) GDPR (our interest in answering enquiries and keeping the form free of abuse)

Retention

for as long as needed to handle the request and any follow-up, and in any case deleted within 12 months of the matter being closed, subject to statutory retention duties

12. Security and rate limiting

To protect the service against abuse and overload, we count requests against a key derived from your IP address and, when you are signed in, your user ID, and we log blocked requests. This data is short-lived and is used only for abuse prevention and capacity planning.

Legal basis

Article 6(1)(f) GDPR (our legitimate interest in a secure, available service)

Retention

counters expire within their time window; block logs are kept for a short period, then deleted

13. Recipients and sub-processors

We use the following processors. Each is bound by a data processing agreement that meets Article 28 GDPR. This list is also an annex to our data processing agreement.

Transactional email tied to your account (for example sign-in links and security notices) is sent by our authentication provider, Clerk, listed above. We do not currently use a separate email-marketing provider. Paid plans are not yet available; when billing goes live we will add the payment provider to this list and to the data processing agreement before any charge is taken.

14. Transfers outside the EEA

Some of the processors above are located in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR, together with additional technical and organisational measures where needed, or on an adequacy decision where one applies. You can request a copy of the relevant safeguards from the data protection contact above.

15. Retention

We keep personal data only as long as needed for the purpose it was collected for, or as long as a statutory retention period requires.

• Account data is deleted within 30 days after you close your account.
• Documents and their extracted text are deleted when you delete them, or when your account is closed.
• Backups are rotated and overwritten within 30 days.
• Invoices and accounting records are kept for the statutory periods described in section 10.

16. Is provision required

Providing an email address and password is necessary to create an account; without it we cannot provide the service. Uploading a document is voluntary, but the analysis features cannot work without one. Billing data is required only for paid plans.

17. Changes to this policy

We may update this policy as the product or the law changes. The version and effective date are shown at the top of the page. For changes that affect you, we will give notice through the product or by email before the new version takes effect.

18. Complaints to a supervisory authority

If you believe our processing of your personal data infringes the GDPR, you can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority competent for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.