This policy explains what personal data Lextra collects when you visit lextra.ai, use the application at app.lextra.ai or receive our emails; why we collect it; who processes it; how long we keep it; and the rights you have. It applies alongside our Terms of Service.
1. Who we are
Lextra.ai is provided by [To confirm: registered company name] (“Lextra”, “we”, “us”), a private limited company incorporated in the United Kingdom under company number [To confirm: company number], whose registered office is at [To confirm: registered office address]. Our registration number with the UK Information Commissioner’s Office is [To confirm: ICO registration number].
Our representative in the European Union is [To confirm: name and address of our EU representative in Malta].
For any question about this policy or your personal data, email support@lextra.ai.
2. Our role
We are the controller of the personal data we use to run Lextra for ourselves: accounts and sign-in, billing, visits to our website, the emails we send, support conversations, and the security of the Service.
The content an organisation and its users put into a workspace (questions and conversations, the company profile, confirmed facts and scenarios, documents and enquiries) is the organisation’s. We process it on the organisation’s behalf, as its processor, under our Data Processing Agreement [To confirm: Data Processing Agreement, to be published]. Where we use that content for purposes of our own, such as security and the answer-quality review described in section 5, we are its controller for that use. If you use Lextra through your employer, your employer is responsible for the content in its workspace, and you can also take questions about it to them.
3. What we collect
When you create an account and use the app:
- Account details: your name, email address and sign-in method, the organisations you belong to and your role in each, and whether your email address is verified.
- Workspace and company information: your organisation’s name and the company profile its members build, including licences, markets and products, confirmed facts and scenarios. This is mostly business information, but it can include names.
- What you ask and upload: your questions and the advisor’s answers, saved conversations, the feedback you give on answers and alerts, and the documents you upload, with the text we extract from them.
- Preferences: the jurisdictions and topics you follow, how often and through which channel you want notifications and summaries, and your product email setting.
- Enquiries to law firms: the material you choose to send to a firm, the firm’s responses, and the status of each enquiry.
- Law firms: a firm’s profile and logo, the lawyers it lists, the evidence it submits for verification (including its registration, its lawyers’ professional registrations and its insurance details), and its contact details.
- Billing: the billing contact, address and VAT number, your plan, number of seats and currency, and your payment history. Card details go directly to our payment provider; we never see or store full card numbers.
- Support: what you send to support@lextra.ai.
Automatically:
- Technical and log data: IP address, browser and device type, the pages and requests you make and when, and errors. Our error reports are set up to leave out personal details: they carry the error and where it happened, not your name, your email address or the text of your questions.
- Usage records: counts of questions asked, used to apply plan and fair-use limits.
- Email engagement: whether our summary and notification emails were delivered, opened or bounced, and which of their links were clicked (section 11).
From others: an owner or admin who invites you gives us your email address; a law firm gives us its responses to your enquiries; our payment provider tells us whether a payment succeeded.
4. Why we use it, and our legal bases
| What we do | Legal basis |
|---|---|
| Create and secure accounts, run workspaces, answer questions, show content, and send the notifications and summaries you choose | Performance of our contract with you or your organisation, and our legitimate interest in providing the Service to your organisation’s users |
| Take payments, issue invoices and keep accounting records | Performance of our contract, and our legal obligations |
| Keep the Service secure, prevent abuse, apply fair-use limits and fix errors | Our legitimate interests |
| Review a sample of answers for accuracy | Our legitimate interests |
| Measure whether summaries and notifications are read | Our legitimate interests (you can turn these emails off in Settings) |
| Send product news by email, if you turn it on in Settings | Your consent, which you can withdraw at any time in Settings or from any such email |
| Answer support requests | Performance of our contract, and our legitimate interests |
| Comply with the law, and establish or defend legal claims | Our legal obligations, and our legitimate interests |
We do not sell personal data, use it for advertising, or make decisions that have legal or similarly significant effects on you solely by automated means.
5. AI-generated answers
When you ask the advisor a question, we send the question, the relevant part of the conversation and relevant library and source content to Anthropic, our AI provider, which generates the answer. On paid plans, the answer can also use your company’s confirmed facts and scenarios and the text of documents you attach to the conversation, and these are sent with the question.
Anthropic processes this data to produce the answer. Under the terms on which we use its service, it does not use the data to train its models, and it keeps it only for a limited period [To confirm: Anthropic’s retention period for our account]. We do not use your content to train AI models either.
An answer built from your company’s information is never cached for, or shown to, another organisation. It is left out of our quality review unless you flag that answer for review, and then our staff see only that answer. To check accuracy, authorised Lextra staff review a sample of other questions and answers, and the answers users mark as not useful.
6. Who we share it with
We use the following service providers. Each processes personal data only on our instructions, to provide its part of the Service.
- Anthropic (United States): generates the advisor’s answers.
- Clerk (United States): sign-in, accounts and organisations.
- Fly.io (United States): runs our API and hosts our database, in Amsterdam, the Netherlands, and stores files, including uploaded documents, in its Tigris storage [To confirm: Tigris storage region].
- Vercel (United States): hosts lextra.ai and app.lextra.ai.
- Stripe (United States): payments, invoices and tax.
- Resend (United States): sends our emails and records their delivery, opens and clicks.
- Sentry (United States): error reports, which are stored in its United States region.
- [To confirm: provider of the support@lextra.ai mailbox]: our support email.
We also share personal data:
- with law firms, only through an enquiry you choose to send, or a question you put to a firm’s advisor. A firm that receives an enquiry is responsible for how it uses what it receives;
- within your organisation, where a workspace’s content is visible to its members, and its owners and admins can export it;
- with our professional advisers, auditors and insurers, where they need it;
- with authorities, where the law requires it, or to protect our rights or someone’s safety;
- with a successor to our business, or a company we establish to carry it on, including in another country. We will tell you before your personal data becomes subject to a different policy.
7. International transfers
We are based in the United Kingdom, and our database is hosted in the European Union. Several of our providers are based in the United States and process personal data there. Where personal data leaves the UK or the European Economic Area, we rely on an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension, where the provider is certified under them) or on standard contractual clauses with the UK addendum, with additional safeguards where they are needed. You can ask us for details.
8. How long we keep it
- Conversations and documents are kept while the account they belong to is active, and deleted 90 days after it closes. You can delete any conversation or document yourself at any time, and deleting your account or your organisation, as described below, removes them straight away.
- Your account is kept until you delete it. Deleting it removes it from our sign-in provider, along with your conversations, followed topics and notifications. Documents and facts you added to an organisation stay with that organisation, no longer linked to your name. You cannot delete your account while you are the only owner or admin of an organisation; delete the organisation or hand it over first.
- Deleting a document, in Settings → Company, removes the file and the text extracted from it, and takes it out of every future answer. A record that it existed is kept, so that answers which used it can still say so.
- An organisation is kept until an owner or admin deletes it. Deleting it removes its files, its documents, its company information, the conversations asked in its workspace and its membership records. Its members keep their own accounts.
- Billing records are kept for as long as tax and accounting law requires.
- Email engagement data, logs and error reports are kept for a limited period, then deleted [To confirm: retention periods for email engagement data, logs and error reports].
- Backups can hold deleted data until they expire [To confirm: backup retention period].
9. Security
- Everything is encrypted in transit.
- Uploaded documents are kept in storage of their own, separate from our other files and with their own access keys, and can be downloaded only through links that expire.
- Each organisation’s company information, documents and conversations are kept apart from every other organisation’s, and automated tests check that separation for each kind of data.
- We do not write the text of your documents or your company’s facts to our logs.
- Only Lextra staff who need access to personal data have it.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the regulator where the law requires us to.
10. Your rights
Data protection law, including the UK GDPR and, where it applies, the EU GDPR, gives you the right to:
- access the personal data we hold about you;
- have it corrected if it is inaccurate;
- have it deleted;
- restrict how we use it;
- object to our using it where we rely on legitimate interests;
- receive it in a portable format;
- withdraw any consent you have given.
You can do much of this yourself. In Settings → Profile you can export your data and delete your account. In Settings → Organisation, an owner or admin can export the organisation’s data and delete the organisation. For anything else, email support@lextra.ai. We reply within the time the law allows, normally one month.
Where we hold content as your organisation’s processor, we may pass your request to the organisation and help it respond.
If you are unhappy with how we have handled your personal data, please tell us first. You can also complain to the Information Commissioner’s Office in the UK (ico.org.uk), or to the data protection authority where you live or work in the European Union.
11. Cookies and similar technologies
lextra.ai sets no cookies and uses no analytics or advertising trackers. It stores your light or dark theme choice in your browser’s local storage, which stays on your device. Some pages fetch live information from our API, such as which jurisdictions we cover and whether Early Bird places remain, so our API receives your IP address with those requests. Our fonts are served from our own website.
app.lextra.ai uses cookies set by our sign-in provider, Clerk, to keep you signed in and to protect your session. They are strictly necessary: the app cannot work without them. The app also stores your theme choice on your device. It uses no analytics or advertising cookies. If we add analytics, we will update this policy first and ask for your consent where it is required.
Our emails. Summary and notification emails contain a small image and tracked links, which tell us whether an email was opened and which links were clicked. We use this to see whether summaries are read. You can turn these emails off in Settings, or block images in your email program to prevent open tracking.
12. Children
Lextra is a service for businesses. It is not directed at anyone under 18, and we do not knowingly collect their personal data.
13. Changes to this policy
We will update this page when our practices change. The date at the top shows when it last changed. If a change is material, we will tell you by email or in the app before it takes effect.
14. Contact
Questions about this policy or your personal data: support@lextra.ai. In the European Union, you can also contact our representative, named in section 1.