Privacy Policy

Lexorii (“Lexorii”, “we”, “us”) provides a practice-management platform for law firms, operated from Dubai, United Arab Emirates. This policy explains what information we collect, where it is stored, who else touches it, and the choices you have. It applies to the Lexorii web application, the Lexorii mobile app for iOS and Android, and the services at lexorii.com.

For firm and client records inside the platform, your firm is the controller and Lexorii is the processor: we hold and process that data on your firm’s instructions, not for our own purposes.

Information we collect

• Account information - your name, email address, role, and firm, provided when an account is created or invited.
• Firm and matter data - content you enter into the platform such as matters, court cases, documents, calendar events, tasks, time entries, contacts and financial records. This can include personal data about your clients and counterparties that you choose to enter, including identity-document details where your firm uses the Emirates ID feature.
• Connected Google data - if you choose to connect Google Calendar, we access your calendar events through the https://www.googleapis.com/auth/calendar.events scope and your basic profile email, solely to synchronize events between Google Calendar and your Lexorii calendar.
• Support assistant conversations - what you type into the in-app assistant, so it can answer and draft items for you to confirm. To answer questions about your work, the assistant may look up records you already have access to (such as matters, cases, tasks, calendar, clients and your own time). It only sees what your role could open in Lexorii, and it never changes anything on its own.
• Mobile app data - if you turn on notifications, a push token that identifies your phone, with its platform and language. Photos you take or choose in the app (documents, Emirates ID card copies) are uploaded to your firm’s private storage only when you save or upload them. Emirates ID cards are read on the phone itself; the image is not sent to any AI service. Face ID or fingerprint lock is handled entirely by your phone, and Lexorii never receives biometric data.
• Usage and security data - limited technical information (log, audit-trail and security data, such as who viewed or changed a document and when) needed to operate and secure the service.
• Website chat - if you use the chat assistant on lexorii.com, what you type or say to it, the page you are on, and any contact details you confirm and send to us from it.

On the public marketing pages, we ask before Google Analytics or Google Ads may use cookies. If you allow it, Google may set cookies that help us understand page visits, demo requests and which campaign brought you to Lexorii. Until you answer, and if you decline, Google's tag sets no cookies and receives only cookieless signals. Unless you decline, your browser's local storage also keeps, for up to 90 days, the page you landed on and what sent you there (a campaign tag, an ad click identifier or the referring website), so that a demo request you choose to send us says where it came from; declining deletes it. Necessary cookies and local storage are still used to keep you signed in and remember interface preferences. The Lexorii product does not use advertising cookies.

How we use information

• To provide, maintain, secure and improve the Lexorii platform.
• To enforce the role-based access your firm has configured.
• To synchronize calendar events you have authorized between Google Calendar and Lexorii.
• To send transactional email - reminders, approvals, digests and account notices. We do not send marketing email.
• To answer support requests and diagnose faults.
• With your permission on the public site, to measure marketing performance and demo requests. We do not use firm or client records for advertising.

We do not sell personal information, and we do not use your firm’s content to train AI models.

AI features and the data they share

Some features are answered by an AI model from a company outside Lexorii. Data reaches that company only when a user starts one of these features, and only what the feature needs:

• Ask AI (the assistant, on the web and in the mobile app) - the messages you type, and the Lexorii records the assistant looks up to answer them, such as matter, case, task, calendar, client, lead, time, billing and document details that your role already lets you see. If you ask it to read a document, the document’s text.
• AI drafting (web and mobile app) - the brief you give, the facts of the matter or case and its client, your client’s intake answers, and relevant passages from your firm’s precedents.
• Other AI features on the web - the text you ask it to translate; the file you ask it to read or summarise; a meeting transcript or court notice you ask it to turn into facts or hearing dates; and a fee proposal or matter facts you ask it to turn into billing terms or suggested changes.

Who receives it: Anthropic, PBC (the Claude model), in the United States, for all of the above. No other AI company receives this data from the app. If Claude is unavailable, the feature says so and asks you to try again; it does not switch to another AI service.

Google (Gemini), switched off: version 1.0 of the iPhone app names Google (the Gemini model) as a possible fallback for product-help questions in Ask AI. That fallback is switched off, so Google receives nothing from Ask AI. If it were ever switched back on, Google would receive only the question you type, never firm or client records, and we would update this policy first.

How it is protected: the data is encrypted in transit and used only to answer that request. Anthropic does not use it to train its models and deletes it within 30 days. Anthropic is bound by written terms to keep it confidential and secure, giving it the same or equal protection as this policy.

Your permission: the Lexorii mobile app asks for your permission before Ask AI or AI drafting sends anything, explains what is sent and to whom, and lets you withdraw it at any time under More > Security. If you do not agree, those features stay off and the rest of the app works as normal. On the web, these features run only when you start them, and your firm can turn AI drafting off.

The website chat: the chat assistant on our public pages is separate from the app and never sees firm or client records. It runs on ElevenLabs, which receives what you type or say to it and the page you are on, and writes its replies with Anthropic’s Claude model. If you talk to it by voice, the audio is not recorded; transcripts are kept for 30 days so we can check and improve its answers. Your contact details reach us only if you confirm them in the chat. Please do not share confidential client information there.

Messaging us on WhatsApp: if you message Lexorii on WhatsApp, your message, your name and your phone number are carried and stored by Meta (WhatsApp). The first reply may come from Meta’s business AI assistant, which answers from the product information we give it and what you write; it never sees firm or client records in Lexorii. We read these conversations and reply ourselves when needed. Meta handles them under its own terms and privacy policy, outside the UAE. Please do not share confidential client information there.

Where your data is stored

Firm data is stored in our own Supabase/Postgres database and file storage hosted on a server in the United Arab Emirates. The web application itself runs on Vercel in Frankfurt, Germany, so data is processed in the EU while a request is being served. Some of the providers listed below operate outside the UAE; where data reaches them, it is limited to what that provider needs to do its job.

Every 15 minutes we back up the database and files to a second, separate provider whose server is also in Dubai. Backups are encrypted on our server before they are sent, and the backup provider does not hold the key, so it stores data it cannot read.

Who processes data on our behalf

• Ultahost - the server in Dubai that holds the firm database and files.
• Vercel - hosting for the web application (Frankfurt).
• Resend - delivery of notification and account email (United States and EU). Receives recipient addresses and message contents.
• Google - Calendar API for the calendar sync you connect.
• Anthropic - the Claude model behind the in-app assistant and AI drafting, processed in the United States. For the assistant it receives your messages and the records the assistant looks up on your behalf; for drafting, the brief, matter facts and relevant passages from your firm’s precedents. This can include confidential client information. Under Anthropic’s commercial terms this data is not used to train its models, and Anthropic keeps it for up to 30 days before deleting it. See Anthropic’s Privacy Policy and Commercial Terms.
• Expo, Apple (APNs) and Google (FCM) - delivery of mobile push notifications. By default a notification only says what kind of update it is (for example, “You have a task update”); client and matter names are included only if you turn on “Show details in notifications” on your phone.
• Sentry - crash and error reporting (EU region). Receives scrubbed error reports with an internal user id and role, never names, emails, request contents or client data.
• Microsoft - Microsoft 365 calendar sync, where your firm enables it.
• LightNode - storage for our backups, on a server in Dubai. Backups are encrypted before they reach LightNode, which does not hold the key.
• Upstash - rate limiting, to slow down abuse. Receives internal user ids only, never names or content.
• Zoho - our support mailbox. Receives the emails you send to support.
• ElevenLabs - the chat and voice assistant on the public website, in the United States. Receives what visitors type or say in that chat and the page they are on. Voice is not recorded, and transcripts are kept for 30 days.
• Meta (WhatsApp) - our WhatsApp business messaging, including Meta’s AI assistant that may answer messages first. Receives what people send us on WhatsApp, with their name and phone number. Never receives firm or client records.
• Google Analytics and Google Ads - optional public-site audience and conversion measurement, loaded only after you allow measurement.

Data protection law and where your data is kept

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, for firms established in the Dubai International Financial Centre, the DIFC Data Protection Law No. 5 of 2020.

Your firm’s database and files are hosted on a server in Dubai. Every backup of them is kept in Dubai too, with a second, separate provider, and is encrypted on our server before it leaves, so the backup provider cannot read it. The records that make up your firm’s account, and every backup of them, are kept in the UAE.

Some services that work on that data run abroad: the web application on Vercel in Germany, and the AI model (Anthropic) and notification email (Resend) in the United States. They receive only what they need to do their job, always encrypted in transit, and only under written terms that require them to keep it confidential and secure. A firm that needs a written data processing agreement can ask us for one.

Who at Lexorii can see your data

We do not browse firm data. Access to the production server and database is limited to Lexorii’s engineering staff and is used only to run the Service, fix a fault, or carry out something your firm has asked for. Where your firm asks us to help with setup or support from inside the app, we do so through a support account that your firm agrees to, that appears in your firm’s user list, and whose actions are recorded like any other user’s. Your partners can remove it at any time, and we remove it when the work is done. Without that permission, support works from account details such as your firm name, users and subscription, not your matters, documents or clients.

Google user data

Lexorii’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the Google Calendar scopes necessary to provide calendar synchronization. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models. Google Calendar data is used only to display and sync events on your behalf, and access tokens are encrypted at rest. You can disconnect Google at any time from your calendar settings, which revokes Lexorii’s access.

Data sharing

We do not sell personal information. We share data only with the providers listed above, and where we are required to by law. Inside the platform, data is visible to authorized members of your firm according to their role - for example, accountants cannot open legal documents. Where your firm invites a client to the client portal, that client sees only the specific matter information your firm shares with them.

Retention

We keep data for as long as your firm’s account is active. Records deleted inside the app are held in a recoverable state for 60 days and are then permanently purged. When an account closes, we provide any export your firm asks for, and firm data is deleted 30 days after closure. Encrypted backups are kept on a rolling schedule (every copy for a day, hourly copies for two days, daily copies for 30 days and weekly copies for up to a year), so data deleted from the app can remain in a backup until that backup expires. Audit and security logs may be kept longer where needed to investigate an incident.

Security

Access is authenticated and role-checked on every request, transport is encrypted, the server’s disk is fully encrypted (full-disk encryption, so firm data is encrypted at rest), and credentials for connected services are encrypted again on top of that. Backups are encrypted, cannot be deleted from the server they protect, and a restore is tested automatically every month. Sensitive actions are recorded in an audit trail. No system is perfectly secure - if a breach affects your data we will notify your firm within 72 hours of becoming aware of it, with what we know and what we are doing about it.

Your choices and rights

• Disconnect Google Calendar at any time from calendar settings.
• Request access to, correction of, export of, or deletion of your personal data.
• Ask for your staff account to be deleted - in the mobile app under More → Request account deletion, or by emailing support. We confirm with your firm, which owns the account, and then remove your account and personal data.
• Contact your firm’s partners or administrator for firm-managed records - for client and matter data, your firm decides what is kept and for how long, and we will refer such requests to them.
• Email support@lexorii.com with any privacy question or request; we aim to respond within 30 days.

Children

Lexorii is a business tool for law firms and is not directed at children. We do not knowingly create accounts for anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email, and the “Last updated” date above will change.