Privacy Policy

This Privacy Policy applies to the LexDraft AI website, hosted application, document-generation workflows, checkout and billing journeys, and related communications. In this policy, "LexDraft AI," "LexDraft," "we," "our," and "us" refer to the operator of the LexDraft AI service.

This policy is intended to provide a practical baseline for users in the United States, European Economic Area, United Kingdom, Canada, and Australia. It does not replace advice from qualified counsel about your particular legal obligations or ours.

• —Account and identity data: name, email address, authentication identifiers, and account settings.
• —Document and questionnaire data: information you enter when drafting documents, including information about yourself, counterparties, employees, contractors, customers, or other third parties that you choose to include.
• —Billing and transaction data: subscription status, plan selection, transaction metadata, and limited payment-related details supplied by our payment providers. Full payment card details are processed by Stripe and are not stored by LexDraft AI.
• —Usage and device data: log data, IP address, browser type, approximate location inferred from network signals, pages accessed, request metadata, and security events.
• —Support and communications data: feedback, support requests, waitlist submissions, and email correspondence.
• —Cookie and similar data: authentication, security, and other website storage technologies as described in our Cookie Policy.

We collect information directly from you, automatically from your device and browser, and from service providers involved in authentication, billing, hosting, or communications.

If you submit information about another person, you are responsible for ensuring you have an appropriate lawful basis and authority to share that information with us and to instruct us to process it for document drafting.

• —to create, maintain, secure, and improve your account and the LexDraft product;
• —to generate, revise, store, export, and share document drafts at your direction;
• —to process subscriptions, one-time purchases, invoices, refunds, and fraud-prevention checks;
• —to provide customer support, troubleshoot errors, and communicate service updates;
• —to enforce our terms, protect the service, investigate abuse, and comply with legal obligations;
• —to carry out internal analytics, product planning, and service reliability work; and
• —to send operational, legal, and transactional communications, and marketing communications where permitted by law and your choices.

If you are in the EEA or UK, we generally rely on one or more of the following legal bases: performance of a contract, legitimate interests, compliance with legal obligations, and consent where consent is required.

• —Contract: providing the service, managing accounts, generating requested documents, and processing paid plans.
• —Legitimate interests: service security, abuse prevention, diagnostics, internal product analytics, and business administration.
• —Legal obligation: tax, accounting, fraud-prevention, law-enforcement response, and regulatory compliance.
• —Consent: non-essential cookies, optional marketing, or other processing where consent is required by law.

We do not sell personal information for money. We may share information with service providers and other parties as reasonably necessary to operate the service.

• —Supabase: authentication, database hosting, and infrastructure supporting user accounts and document storage.
• —Anthropic: AI model processing used to generate or rewrite document content at your direction.
• —Stripe: payment processing, subscription billing, fraud controls, and customer billing portal services.
• —Resend and other communications providers: service emails, document-sharing emails, and support-related messages.
• —professional advisers, auditors, insurers, courts, regulators, law enforcement, or counterparties where disclosure is required or reasonably necessary; and
• —a buyer, investor, or successor in connection with a merger, financing, acquisition, restructuring, or sale of all or part of our business, subject to appropriate confidentiality measures.

If a U.S. state privacy law treats certain ad-tech or cross-context behavioral advertising disclosures as a "sale" or "sharing," we will honor applicable opt-out rights where those activities occur. Our current codebase does not show active advertising trackers, but we may update this policy if that changes.

LexDraft AI and its service providers may process information in the United States and other countries where privacy laws may differ from those in your home jurisdiction. Where applicable, we use reasonable contractual, technical, and organizational safeguards intended to support lawful cross-border transfers.

• —account information is generally retained while your account remains active and for a reasonable period afterward for security, support, and recordkeeping;
• —document content is retained until you delete it, close your account, or we no longer need it for legitimate business or legal purposes;
• —transaction, tax, and audit records may be retained for longer periods where required by law or accounting standards; and
• —logs, backups, and security records may persist for limited periods consistent with business continuity and abuse-prevention needs.

Retention periods can vary depending on the type of information, the services you use, disputes, legal holds, or regulatory requirements.

We use administrative, technical, and organizational measures designed to protect personal information, including access controls, encryption in transit, and service-provider safeguards. No system is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, or withdraw consent for certain processing of your personal information.

• —EEA and UK users may have GDPR and UK GDPR rights, including access, correction, deletion, portability, restriction, objection, and consent withdrawal.
• —Residents of California and other U.S. privacy-law states may have rights to know, access, delete, correct, and opt out of certain sales, sharing, or profiling activities where applicable.
• —Canadian and Australian users may request access to and correction of personal information and may have additional statutory complaint rights.
• —You can also manage certain information directly in your account or by contacting us.

To exercise privacy rights, contact privacy@lexdraft.co. We may need to verify your identity before completing a request. You may also have the right to complain to a privacy regulator in your home jurisdiction.

LexDraft AI uses large language model tooling to help create and revise legal-document drafts based on the information you submit. The quality of output depends on your inputs, template limitations, jurisdictional complexity, and the proper review of the resulting draft.

We do not intend for your document content to be used to train public AI models for third-party benefit. However, because AI and vendor terms can evolve, you should avoid submitting information that you are not authorized to share or that requires specialist handling unless and until the service is expressly designed for that purpose.

LexDraft AI is not intended for children. We do not knowingly solicit or target children under 18, and we ask that minors do not create accounts or submit personal information to the service without lawful authorization.

We may revise this Privacy Policy from time to time to reflect changes in the service, our practices, applicable law, or regulatory expectations. If we make material changes, we will update the effective date and may provide additional notice where required.

Privacy questions, rights requests, or regulator-related inquiries may be sent to privacy@lexdraft.co.

If you need legal advice about your own compliance obligations, you should contact qualified counsel in the jurisdictions relevant to your use of LexDraft AI.