Data Use Policy

• Your data is yours. Your firm owns its templates, its clients’ intake answers and the documents generated from them.
• Used only to serve you. We use your firm’s data only to provide, secure and support your Lexatta account, and as your firm instructs.
• Never sold, never advertised against. We do not sell your data or use it for advertising.
• Never used to train AI. Neither we nor our AI providers train models on your data.
• Kept separate. Each firm’s data is isolated from every other firm’s.
• Deleted when you leave. When your account ends, we delete your data on a published schedule.

“Customer Data” is everything your firm and your clients put into Lexatta, and what Lexatta produces from it:

• the templates and documents your firm uploads;
• the workflows and intake forms built from them;
• your clients’ intake answers, saved drafts and verification details; and
• the documents generated for your firm, and your review notes and decisions.

Our Privacy Policy covers the account, billing and website information Lexatta collects for its own purposes.

We use Customer Data to:

• build workflows and intake forms from your templates;
• present your forms to clients, save their drafts and accept their submissions;
• generate draft documents from submissions for your firm to review;
• deliver documents to clients when your firm releases them, and route documents for e-signature when your firm requests it;
• send the notifications your workflows call for;
• show your firm intake activity, such as forms started and completed;
• investigate problems your firm reports or that we detect; and
• protect the Service against abuse and comply with law.

We also compute aggregated, de-identified statistics, such as how long forms take to complete or how often a generation step succeeds. These statistics cannot identify your firm, a person, or the content of any document or answer. We use them only to operate and improve Lexatta.

When your firm creates a workflow, we send the template you uploaded to an AI model provider. The model identifies the information the document needs, the parts that are conditional or repeat, and a proposed intake form. Our own software then checks and assembles that result. Your firm reviews and edits the workflow before using it.

Client submissions are not sent to AI providers today. Documents are filled from client answers by our own software, without an AI model. If we introduce a feature that sends client submissions to an AI provider, we will update this policy and notify your firm before it takes effect.

Our AI providers act as our subprocessors and are contractually bound to:

• not train their models on your data;
• use it only to provide results to us, except to detect misuse of their own service or where the law requires;
• delete it within 30 days, unless it is flagged for misuse review or the law requires them to keep it longer; and
• keep it confidential and secure.

The AI provider may analyze your template on its infrastructure outside the United States. Your templates and other data are stored by Lexatta in the United States.

We may keep records of AI processing, meaning what was sent to the model and what it returned, for up to 12 months. We use them to troubleshoot generation problems and check the quality of results. They are subject to the same access controls as the rest of your data, and are never used to train AI models.

AI can be wrong, so Lexatta presents a proposed workflow as a draft for your firm to review before it is used. Documents generated from client answers do not involve AI, but they are drafts too: an attorney should review every document before it is released. Neither is legal advice. See our Terms of Service.

• sell Customer Data, or share it with anyone for their own purposes;
• use Customer Data for advertising or marketing to your clients;
• train AI models on Customer Data, or allow our providers to;
• contact your clients except to deliver the communications your firm’s workflows send; or
• show one firm’s data to another firm.

Access by Lexatta personnel is the exception, not the routine. It is:

• Limited to a small number of authorized staff who need it to support your firm or to keep the Service secure and working;
• Purposeful: viewing your firm’s account as you see it requires a separate permission and a stated reason, and the session is read-only and expires within 30 minutes;
• Recorded: support sessions and staff access to your documents are logged; and
• Confidential: staff are bound by confidentiality obligations.

We access your data without a request from your firm only to investigate a security issue, abuse or a malfunction, or when the law requires it.

Lawyers owe their clients a duty of confidentiality, and many bar authorities expect firms to understand how a technology vendor handles client information before using it. This policy, our Data Processing Addendum and our security practices are designed to give your firm that understanding. We are happy to answer reasonable security questionnaires.

Your firm decides what to ask clients. We encourage firms to collect only what a matter needs, and to avoid collecting highly sensitive identifiers they do not need.

We keep Customer Data while your firm’s account is active. Unsubmitted client drafts expire automatically after 30 days. When your account ends, you may request an export within 30 days. We then delete Customer Data within 90 days, and backups age out on their normal schedule. The Privacy Policy lists retention periods in detail.

To ask for an export or deletion at any time, email privacy@lexatta.com from the account owner’s address.

If we change this policy in a way that expands how we use Customer Data, we will notify firm account owners before the change takes effect. Questions: privacy@lexatta.com.