Privacy, in plain terms.

Lexivo is a legal practice management platform for law firms. This notice covers the Lexivo web application, the Lexivo mobile app for iOS and Android, and our website at lexivo.tech (together, "the Service").

The mobile app is a companion client for staff at firms that already subscribe to Lexivo. It is not a consumer app and offers no public registration.

Lexivo handles two categories of data under two different legal roles. Which one applies decides who you ask when you want something changed or deleted.

Information you provide

Information collected automatically

What we do not do

• We do not sell personal data. We have never sold personal data.
• We do not share personal data for advertising, cross-app tracking, or behavioural profiling.
• We do not use Apple's App Tracking Transparency framework, because we do not track you across other companies' apps or websites.
• We do not run third-party advertising SDKs.
• We do not use your firm's content to train general-purpose AI models.

The app requests each permission only when you first use the feature that needs it. You can revoke any of them in your device settings; that feature stops working, and the rest of the app continues to function.

Biometrics

Face ID, Touch ID and Android fingerprint unlock are handled entirely by your device's operating system. Your biometric data never leaves your device and is never transmitted to or stored by Lexivo. The app receives only a yes or no result from the OS.

Location is the most sensitive thing the app does, so it is worth stating plainly.

• It is off by default. Nothing is collected until you explicitly enable trip tracking in Settings.
• It is per-trip. Coordinates are recorded only between the moment you tap Start trip and the moment the trip stops.
• Background collection happens only during an active trip. With no trip running, the app collects no location data, foreground or background.
• What is recorded: latitude, longitude, GPS accuracy, speed and timestamp, sampled along the route.
• What it is for: computing trip distance and duration, showing you a route playback, and creating a billable time entry and optional travel expense in your firm's records.
• Who can see it: you, and authorised billing administrators at your own firm. Never another firm; never a third party beyond the geocoding provider named below.
• Turning it off: disable tracking in Settings, or revoke the OS location permission. Trips already recorded stay in your firm's records until deleted.

Where the GDPR, the UK GDPR, or an equivalent regime applies, we rely on the following legal bases.

For firm content, the legal basis is determined by your law firm as controller, not by us.

We share personal data only with service providers ("sub-processors") that are contractually bound to process it solely on our instructions and to protect it to a standard at least as strict as this notice.

We also disclose data where we are legally required to — for example, a binding court order or a lawful request from a competent authority. Given the privileged nature of legal-sector data, where we are lawfully permitted to do so we will notify the affected law firm before disclosing any of its content, so it can exercise its own rights.

We do not otherwise disclose data to third parties. In a merger, acquisition or asset sale, data may transfer to the successor entity under the same commitments, and we will give notice before any such transfer takes effect.

Some features send your text or documents to the AI providers listed above to generate drafts, summaries, extractions or answers.

• Content is sent only when you invoke an AI feature. There is no background AI processing of your data.
• We hold contractual terms with our AI providers under which your content is not used to train their models.
• AI output is a drafting aid, not legal advice. It can be wrong, incomplete, or subtly misleading. A qualified lawyer must review every output before it is relied on or sent to a client.
• Your firm administrator can disable AI features for the workspace or for individual users.

Exact retention windows for your firm are set out in your firm's Data Processing Agreement. Contact us if you need the current schedule.

• Encryption in transit for all traffic between your device and our servers.
• Encryption at rest for stored files and for sensitive database fields.
• Authentication tokens are stored in the platform secure enclave — iOS Keychain or Android Keystore — never in plain application storage.
• Strict per-tenant data isolation: one firm cannot reach another firm's data.
• Role-based permissions enforced server-side; the client cannot grant itself access the server denies.
• Optional multi-factor authentication.
• Uploaded files are malware-scanned before they are stored.
• A full audit trail of access, edits, shares and downloads.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify the affected law firm without undue delay and, where required, the relevant supervisory authority within 72 hours.

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent — for example by turning off trip tracking.

• For firm content, contact your firm administrator. Your firm decides these requests and we act on its instructions.
• For your account and device data, contact us at privacy@lexivo.tech. We respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. California residents: we do not sell or share personal information as those terms are defined by the CCPA and CPRA, and we do not offer financial incentives for personal information.

Deleting your account

Your Lexivo account is created and controlled by your law firm. To have it deleted, ask your firm administrator or email privacy@lexivo.tech. We will confirm your identity, delete your account profile, and delete or anonymise associated personal data except where we must retain it by law. Firm content you authored remains the property of, and under the control of, your firm.

Some sub-processors listed above operate outside your country. Where personal data leaves the EEA, the UK, or your local jurisdiction, we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism, together with additional technical safeguards including encryption.

Enterprise customers may request in-region hosting and data residency. Contact sales@lexivo.tech.

Lexivo is a professional tool for law firm staff. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

We post any change on this page and update the date above. For material changes — a new category of data, a new purpose, or a new class of recipient — we notify affected firms by email and in-app before the change takes effect.

• Privacy enquiries and data subject requests

  privacy@lexivo.tech

• Data protection

  dpo@lexivo.tech

• General support

  support@lexivo.tech