Privacy Policy

1. Who we are

This Privacy Policy explains how Lexo365, operated by Scribble Solutions (“Lexo365”, “we”, “us”) collects, uses, discloses, and retains personal information in connection with the Lexo365 practice-management service (the “Service”).

Contact: info@lexo365.com.

2. Scope — firm users versus client data

This Policy covers two categories of information that must not be confused:

Firm-user information: information about the lawyers and staff who subscribe to and log into Lexo365 (accounts, names, emails, usage of the Service). Those individuals are the Subscriber’s personnel.

Client information: personal information about the Subscriber’s own clients, contacts, and related parties that the Subscriber or its users enter into the Service (names, contact details, identification and KYC records, matter notes, documents, and similar content). The Subscriber’s clients are not Lexo365’s customers.

3. Roles — controller and processor

For firm-user account information that we collect to operate the Service (registration, authentication, billing of the subscription, support), Lexo365 determines the purposes and means of processing and acts as an organization responsible for that information under applicable privacy law.

For client personal information that the firm enters into the Service, the firm (the Subscriber) is the controller (or equivalent). Lexo365 is a processor / service provider: we host and process that information on the firm’s instructions in order to provide the platform. We do not use client personal information for our own marketing or to sell it.

4. Information we collect from firm users

We collect information you provide when you register a firm or accept an invitation: name, email, password (stored as a hash by our authentication provider), firm name, firm URL slug, country, language preference, and role.

We also collect technical and usage information needed to operate the Service: IP address, user agent, sign-in events, feature usage, and records of legal-policy acceptance (bundle version, policies accepted, time, IP, and user agent).

If you configure BYOK keys or other integrations, we store encrypted credentials and related metadata. We do not log plaintext LLM keys.

5. Client personal information entered by the firm

The Subscriber decides what client personal information to enter (for example client names, contact details, government-ID and KYC data, notes, documents, emails synced by the firm, and matter records). Lexo365 processes that content to provide the features the Subscriber enables.

The Subscriber is responsible for having a lawful basis and any required consents from its clients, including under law-society rules, PIPEDA, Québec Law 25, and other applicable law. Portal or KYC consent collected from a client on intake is the firm’s client-facing consent, not this Policy.

6. How we use information

We use firm-user information to create and secure accounts, provide the Service, communicate about the Service, enforce the Policy Bundle, prevent abuse, and comply with law.

We use Subscriber Data, including client personal information, only to provide, maintain, secure, and support the Service for that firm, including backups, debugging, and optional AI features the firm enables.

We do not sell personal information.

7. AI, BYOK, and pseudonymization

Optional AI features send prompts to LLM providers that the firm configures with its own keys (BYOK). Before those calls, Lexo365 applies PII pseudonymization (token substitution) intended to prevent raw identifying information from leaving the firm’s trust boundary.

No Canadian LLM data centres exist for the models typically used. Compliance for cross-border AI processing therefore rests on pseudonymization, contractual controls, and the firm’s configuration of providers—not on Canadian residency of the model. AI output is assistive only and must be verified by a licensed lawyer, as stated in the Terms of Reference.

8. Processors

We use subprocessors to operate the Service, including Supabase (database, authentication, storage), Vercel (application hosting), and DocRaptor (document generation). BYOK LLM providers process pseudonymized prompts when the firm enables AI features.

Those parties process information on instructions to provide their services. We do not authorize them to sell Subscriber Data.

9. Retention and deletion

We retain firm-user and Subscriber Data for as long as the account is active and as needed to provide the Service. After account closure, the Subscriber may request an export for thirty (30) days. We then delete or irreversibly anonymize data in production systems, subject to encrypted backups (typically up to thirty (30) days) and any legal hold.

Legal-acceptance records may be retained as evidence of agreement. The Subscriber remains responsible for its own professional retention obligations regarding client files.

10. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the Service, including encryption in transit, tenant isolation with row-level security, and encryption of designated secrets. No method of transmission or storage is perfectly secure.

11. PIPEDA, Québec Law 25, and CCPA orientation

We design the Service with Canadian private-sector privacy law in mind, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec’s Act respecting the protection of personal information in the private sector (Law 25), and with regard to the California Consumer Privacy Act (CCPA) as it may apply to business information of U.S. firm users.

Depending on your role and jurisdiction, you may have rights to access, correct, or delete personal information, to withdraw consent where applicable, and to data portability. Firm users should contact us at info@lexo365.com. Individuals whose information was entered by a firm should generally contact that firm, which is the controller of client personal information. We will assist the firm as reasonably required.

We do not sell personal information. We do not use client personal information for cross-context behavioural advertising.

12. Contact

Privacy questions and requests: info@lexo365.com. Lexo365, operated by Scribble Solutions.