Privacy Policy.
Plain English, worldwide.

1. Who we are

LexVio.ai is a product of Global Synapse Technologies, a private limited company incorporated in Delhi, India. For the personal data described in this notice — your account, billing, usage and communications data — we are the controller. Contact: info@globalsynapsetech.com · privacy and data-protection matters: dpo@lexai.in.

For the documents your organisation uploads and the meetings it records — contracts and their contents, recordings and their transcripts, which may include personal data about people your organisation deals with — your organisation is the controller and we are its processor, acting under our Data Processing Agreement. Requests about personal data inside a customer's documents should go to that customer; we assist them as the DPA describes.

We are not established in the EU or the UK. Details of our EU and UK representatives under Article 27 will be published here on appointment; until then, direct any enquiry to dpo@lexai.in.

2. What personal data we collect

• Account data — name, work email, organisation, role, country selected at signup.
• Authentication data — password hashes, OAuth tokens (Google sign-in), one-time sign-in codes sent to your email, session identifiers.
• Billing data — invoicing name, billing address, VAT / tax registration number where you provide one, payment method tokens (we do not store full card numbers — these are handled by Stripe).
• Document content — contracts, agreements, and other legal documents you upload, paste, or generate within LexVio for analysis, review, or storage in your vault (processed on your organisation's behalf — see §1).
• Meeting recordings — audio you record or upload for Meeting Intelligence, the transcript produced from it, and the minutes generated from the transcript (processed on your organisation's behalf — see §1). Speaker labels in a transcript are inferred by a model (“Speaker 1”, “Speaker 2”), not identities; your organisation can rename them.
• Voice input — audio you record or upload for voice dictation, in full. Dictated audio is transcribed and not stored; the transcript is the only record.
• Usage data — pages visited, features used, search queries, clicks, IP address, user agent, device identifiers, referral URL, timestamps.
• Communications — messages you send via our contact form, support tickets, or email; testimonials you submit.
• Cookies and similar technologies — see our Cookies Policy. Analytics runs only with your consent, and we honour Do-Not-Track and Global Privacy Control signals.

3. Why we process it, and the legal basis

• To provide the service — analyse contracts, run reviews, store documents in your vault, manage your account. Basis: performance of a contract (GDPR Art. 6(1)(b)).
• To transcribe and summarise meetings you record — meeting audio is sent to OpenAI's speech-to-text model and the transcript is returned to us; minutes are then generated from the transcript. The recording, transcript and minutes are stored with your organisation's account (see §4). Speakers are labelled by inference, never identified. Basis: performance of a contract (Art. 6(1)(b)); your organisation is responsible for any consent or notice the law of the place of recording requires.
• To bill you and issue invoices — process payments, raise invoices, recover dues, meet tax and accounting obligations. Basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• To support you — respond to queries, troubleshoot, send transactional emails (password resets, billing receipts, deadline alerts). Basis: contract (Art. 6(1)(b)).
• To improve LexVio — analyse aggregated, de-identified usage patterns to fix bugs and prioritise features. We do not train AI models on your document content without your explicit consent. Basis: legitimate interests (Art. 6(1)(f)); consent (Art. 6(1)(a)) for anything beyond that.
• To detect abuse — prevent fraud, account takeover, spam, and other malicious activity. Basis: legitimate interests (Art. 6(1)(f)).
• To comply with law — respond to binding requests from courts and authorities with jurisdiction over us. Basis: legal obligation (Art. 6(1)(c)).
• Marketing communications — product news, only if you opt in, and you can opt out in every message. Basis: consent (Art. 6(1)(a)).

4. How long we keep it

• Account data — for the duration of your subscription plus 30 days after cancellation (to permit reinstatement). Then deleted, unless retention is required by law.
• Document content — a stored document is kept until your organisation deletes it or, where your organisation has set a retention period for its category, until that period ends, when the stored file is purged automatically. Deleted within 30 days of vault deletion. Documents classified as identity documents are never sent to an AI model and never indexed for retrieval.
• Meeting recordings, transcripts and minutes — stored with your organisation's account. A meeting's stored audio can be deleted on request by the meeting's creator or an organisation admin, and is deleted automatically when the organisation sets a retention period; the transcript and minutes are retained as the organisation's business record. Cancelling a meeting does not delete them.
• Billing data — retained for 8 years from the end of the relevant financial year, a statutory record-keeping obligation that applies to us.
• Usage logs — retained for 12 months for security and audit, then aggregated and anonymised.
• Audit logs — append-only, and retained for at least seven years.

5. Where your data is stored, and international transfers

Uploaded documents, data exports and database backups are stored in Amazon S3 in the ap-south-1 region (Mumbai, India), written with server-side encryption. There is no per-organisation region routing. Document, prompt and meeting-audio content is also transmitted to the AI sub-processors listed in §6 — located in the United States — to perform the analysis you request.

India does not hold an EU or UK adequacy decision. If you are in the EEA, the UK or Switzerland, personal data you send us is a restricted international transfer. For customer content, transfers are made under the Standard Contractual Clauses (and the UK Addendum / Swiss amendments) incorporated into our Data Processing Agreement; our sub-processors are bound by equivalent terms, except where the DPA's sub-processor list marks a safeguard as being confirmed. We will provide reasonable information to support a customer's own transfer risk assessment on request. The transfer position for your country is also served, generated from the running configuration, by the policy endpoint with your ISO country code — for example /api/v1/privacy/policy?jurisdiction=DE.

6. Who we share it with

• Cloud storage and email — Amazon Web Services (ap-south-1, Mumbai): object storage for uploaded documents, exports and backups; transactional email.
• AI processing — Anthropic (United States): model inference for contract analysis, redlining and the copilot; receives document text and prompts. OpenAI (United States): text embeddings for search over uploaded documents (never identity documents); multi-agent analysis when Deep Audit is used; speech-to-text transcription of meeting recordings and of voice dictation. Google (United States): multi-agent analysis when Deep Audit is used. LlamaParse (United States): document parsing and text extraction; receives uploaded files. Under each vendor's API terms, your content is not used to train its models.
• Voice and messaging — Deepgram: speech-to-text for voice input; receives the raw audio in full, and our integration does not select a processing region. Twilio: WhatsApp delivery of notifications and assistant replies; receives message bodies and phone numbers. The processing location and transfer safeguard for both are being confirmed, and the register below says so.
• Channels your organisation connects itself — if your organisation's administrator connects its own email relay (SMTP), SMS account (Twilio) or WhatsApp Business account, that vendor works for your organisation under your organisation's own agreement with it; it is your organisation's processor, not our sub-processor.
• Payments — Stripe. Receives billing details; never document content.
• Monitoring — Sentry (error monitoring, scrubbed of personal data) and PostHog (product analytics, consent-gated). Both are switched off on an air-gapped deployment.
• The current machine-readable list, including any sub-processor that the India edition reaches and the global edition does not, is published at /api/v1/privacy/subprocessors and in DPA §7.
• Authorised users in your organisation — anyone you add to your LexVio workspace as a team member, administrator, or guest.
• Compelled disclosure — to authorities, courts, or regulators where a request is legally binding on us, after notifying you where legally permissible.
• Business transfer — in connection with a merger, acquisition, or sale of all/part of our business, after binding the recipient to terms equivalent to this policy.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not share document content with third parties for marketing.

7. Your rights

If the GDPR or UK GDPR applies to you, you have the right to:

• Access your personal data and information about how it is processed (Art. 15).
• Correct inaccurate data and complete incomplete data (Art. 16).
• Erasure (Art. 17) and restriction of processing (Art. 18).
• Data portability — receive your data in a structured, commonly used, machine-readable format (Art. 20). Self-service export lives in Settings → Privacy; what it contains is described below.
• Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21).
• Withdraw consent at any time, without affecting processing before withdrawal (Art. 7(3)).
• Not be subject to a decision based solely on automated processing with legal or similarly significant effect (Art. 22). LexVio's AI output is decision support; it takes no such decision about you.
• Complain to a supervisory authority — in the EEA, the authority of your member state; in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to resolve your concern first via dpo@lexai.in, but you do not need our permission to complain.

Exporting your data.From Settings → Privacy you can request a copy of your personal data. We assemble a ZIP archive of JSON files — your profile, your consent records, the audit trail of your own actions, and your export and deletion history — with a manifest listing what it contains and anything that could not be collected. The archive is stored encrypted and is available to download from the app for 7 days through a short-lived link minted on each download; we do not email the archive. It is your personal data, not a copy of your organisation's vault: documents, meetings and other org-owned material belong to the organisation and are not included.

Deleting your account.From Settings → Privacy you can ask us to delete your account. We schedule the erasure 30 days out and your account stays fully active in the meantime; the pending request is visible, and can be cancelled, from any device you sign in on until the scheduled date. On that date your account is deactivated, every signed-in session is invalidated, and every personal identifier on your account (name, email, phone, credentials, sign-in links) is overwritten with a non-reversible placeholder. Billing records are kept for the statutory period in §4, and your organisation's work product stays with the organisation without your name on it.

Similar rights may apply to you under other laws — for example US state privacy statutes (access, deletion, correction, opt-out of sale/sharing; we honour Global Privacy Control) or the data-protection law of your own country. Whatever applies, write to dpo@lexai.in and we will respond within one month.

8. Children

LexVio is not directed to children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, contact us and we will delete it.

9. Security

Uploaded documents, exports and backups are encrypted at rest (AES-256 server-side encryption) and all traffic is encrypted in transit (TLS 1.2 or later). Access within the product is role-based, audit logs are append-only, and automated dependency and static-analysis scans run weekly. SOC 2 controls are mapped and evidenced in-product but not yet audited; ISO 27001 is not yet certified — current status on our Trust Centre.

In the event of a personal data breach, what we do depends on the role we hold for the data affected. For the documents and meetings your organisation submits, we are its processor: we notify the affected customer without undue delay (GDPR Art. 33(2); see DPA §9) so it can run its own Art. 33 clock and take its own decision as controller — we do not notify a supervisory authority on its behalf. For our own account data, where we are the controller: we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours unless the breach is unlikely to result in a risk to individuals (Art. 33(1)); we tell affected individuals directly where the risk to them is high (Art. 34); and every breach is recorded whether or not it is notified (Art. 33(5)). Concluding that a breach is not notifiable requires written reasoning and a named person. Notifications required by any other law binding on us are made alongside.

10. Changes to this policy

We may update this policy. Material changes will be communicated by email and posted here at least 14 days before they take effect. The “Last updated” date at the top tells you when this policy was last revised.

11. Contact

Questions about this policy or your data: dpo@lexai.in or info@globalsynapsetech.com
Complaints and data-rights requests: see Complaints & data rights
Postal: Global Synapse Technologies, Delhi, India.