Privacy & data handling

In short

LEX stores the records, documents and conversations a law firm puts into its workspace, and sends the relevant parts to an AI model to do the work the firm asked for. Each firm's data is walled off from every other firm. We do not sell data, we do not show ads, and we do not train models on your content. The firm can get its data out, and can have it deleted.

1. What LEX stores

Depending on how the Firm uses the service:

• Account details: email address, the name you choose to display, your role, and sign-in records.
• Firm details: the firm's name, plan and settings.
• Case and client records: names, contact details, case descriptions, tasks, follow-ups and notes your team enters.
• Documents you upload, the text and page images extracted from them, and the classification, facts, drafts, summaries and compliance flags generated from them.
• Conversations with Lex, including documents attached in chat.
• Client portal accounts, when a firm invites a client: the client's email address, when they were invited and accepted, and the messages exchanged between the client and the firm.
• Case values, fees and related notes entered by administrators.
• Usage records: which feature ran, when, and how many AI tokens it used. These never contain document text.
• Technical logs (such as IP address and browser type) kept for security and troubleshooting.

2. What it is used for

To provide the service the Firm asked for, to generate AI output, to keep the service secure, to support you, and to apply usage allowances and billing. We do not use Firm Content to train our own or anyone else's models, we do not sell it, and we do not use it for advertising.

3. AI processing

To read a document or answer a question, LEX sends the necessary text (and, when scanned-page reading is on, images of scanned pages) together with case context and your chat messages to Anthropic's Claude API and receives the result. We send only what the task needs.

Scanned pages (pages with no text layer) can be read with an OCR service, Microsoft Azure AI Document Intelligence, when it is enabled: the page images, or a link to the stored file limited to those pages, go to Azure and the recognised text comes back. Azure does not use this data to train models; it is processed to return the result and not kept beyond the operation's result window.

Under Anthropic's commercial terms, data submitted through the API is not used to train Anthropic's models. Anthropic may retain API data for a limited period for abuse and safety monitoring, as described in its policies. AI output is stored in the Firm's workspace like any other record.

4. Where data lives and who processes it

INFYNITY LINK runs LEX on the following providers ("subprocessors"). Each is bound by its own terms and security commitments; we choose providers that encrypt data in transit and at rest.

5. How data is protected

The main safeguards, in plain terms:

• Firm isolation: every record is tagged with the firm it belongs to and the database enforces that a signed-in person can only read their own firm's records. This isolation is tested.
• Documents live in a private storage bucket that browsers cannot read; the application serves each file only to a signed-in member of the owning firm, through a short-lived link.
• Lex, the AI assistant, can only see what the signed-in person can see, and the only change it can make to records (filing a document to a case) requires a human to click Approve.
• Administrator-only areas (team management, case values and fees) are enforced in the database, not just hidden in the interface.
• Data is encrypted in transit (HTTPS) and at rest by our providers. Passwords are never stored in readable form.
• AI usage records hold token counts, never document text.

6. How long data is kept

Firm Content is kept for as long as the Firm's workspace is active, or until the Firm deletes it. Sign-in and technical logs are kept for a short period for security. Usage records are kept for accounting. Our providers' backups expire on their own schedules, typically within thirty days.

7. Getting your data out, and deleting it

A Firm administrator can ask for an export of the Firm's clients, cases, notes and stored documents by writing to service@asklex.legal. A self-service export inside LEX is on our roadmap.

A Firm administrator can ask us to close the workspace. We delete the Firm's content 30 days after a verified request, except what we must keep by law or for accounting, and we confirm in writing when it is done. Administrators can remove individual team members at any time from Settings; a person can ask for their own account to be deleted at the same address.

8. The Firm's responsibilities

For its clients' information, the Firm is the party that decides what is collected and why; INFYNITY LINK processes it on the Firm's instructions. The Firm is responsible for its professional confidentiality and ethics rules, for any client notices or consents those rules require, and for not uploading material it may not share with a service provider.

8a. Requesting early access

If you request early access on our public site we store what you send (firm, your name, email, firm size, practice areas, message), the page you sent it from, your browser type and a hashed form of your network address used only to block abuse, and we email ourselves a copy. We use it only to contact you about LEX, and we delete it on request.

8b. Client portal

A firm may invite one of its clients to a client portal. The client signs in with a link sent to the email address the firm has on file plus a code from an authenticator app. The portal shows only what the firm chose to share: the stages of that client's case, when each stage was reached, and a message thread with the firm. Everyone on the firm's team can read that thread, and whoever replies is named. The portal never shows the firm's internal notes, documents, AI output or other clients. Notification emails say that something happened and link to the portal; they never contain the message itself. A firm can stop sharing a case or suspend a client's access at any time, and a client can ask the firm to delete their portal account. When the firm turns it on, a client can also ask Lex, LEX's assistant, about their own portal: Lex answers only from what the portal already shows that client — shared stages, appointments, document requests and messages — and gives no legal advice; the client's questions and Lex's answers go to our AI provider under the same terms as the firm's own use and are not used to train models, and the firm's team can read those conversations.

8c. Find a Firm directory and inquiries

Find a Firm is a public advertising directory on our site; firms pay a flat monthly fee to be listed, never a fee per inquiry or per case. A firm's administrator writes the listing (firm name, description, practice areas, offices, contact details, languages, and the names and bar or licence numbers of its attorneys — in South Africa, their Legal Practice Council numbers), attests that it is accurate and that the lawyers are licensed or admitted, and publishes it; everything in a published listing is shown to anyone on the internet. We do not verify listings, we do not rank or recommend firms, and INFYNITY LINK may hide a listing at any time.

If you send a firm an inquiry through a listing we store your name, email, phone (if given), message, the page you sent it from, your browser type and a hashed form of your network address used only to block abuse. The inquiry is emailed to the address the firm chose, with your email as the reply-to, and kept in that firm's LEX workspace, where the firm is responsible for it. LEX is not a lawyer referral service, does not take part in the conversation and charges nothing per inquiry; sending an inquiry does not create an attorney-client relationship.

8d. Firms outside the United States

Whatever country a firm is in, all processing happens in the United States with the providers in the table above; we do not host LEX anywhere else. A firm outside the United States should satisfy itself that this fits its own rules before it uploads anything.

For a firm in South Africa, INFYNITY LINK is the firm's operator under the Protection of Personal Information Act (POPIA) and the firm is the responsible party. People whose information appears in a firm's documents exercise their rights of access and correction through that firm, which can ask us for help, and they may complain to South Africa's Information Regulator. Identity numbers and other personal information inside uploaded documents are processed like any other document content: used only to do the work the firm asked for, and never used to train our own or anyone else's models.

9. Cookies

LEX uses only the cookies needed to keep you signed in, plus a setting stored on your device for your chosen appearance. There are no advertising or tracking cookies.

Where a page of the website embeds a product demo video, the video is served by YouTube and loads only after you press play; until then nothing is requested from YouTube. Once you play it, YouTube's own privacy terms apply to that player.

10. Age

LEX is for professionals and is not intended for anyone under 18.

11. Changes and contact

We will post updates to this page at https://asklex.legal/privacy with a new effective date and email workspace administrators about material changes. Questions or requests: service@asklex.legal.