Privacy Policy
Effective October 2, 2026 · Version 2026-10-02
In short: we collect what we need to run an intake platform for law firms, and we use it only to provide that service. Information Clients submit belongs to their law firm. We never sell personal information, use it for advertising, or use it to train AI models.
We share information only with the providers that help us deliver the Service. For example, our email provider receives a Client’s name, email address and the name of the form so it can deliver a notice that the firm has released a document. It does not receive the document.
1. Who we are and what this policy covers
Lexatta LLC (“Lexatta,” “we”) provides an online intake platform to law firms. This policy explains how we handle personal information about:
- Firm users: people at law firms who have Lexatta accounts;
- Clients: people who complete a law firm’s intake form on Lexatta; and
- Visitors and prospects: people who visit our website, contact us, try our public template analyzer, or receive our marketing emails.
If you are a Client: the law firm that sent you its form decides what information it collects and how it uses it. We handle your answers on the firm’s behalf as its service provider, under the firm’s instructions and our Data Processing Addendum. The firm’s own privacy notice applies, and questions or requests about your information should go to the firm. If you contact us instead, we will pass your request to the firm.
2. Information we collect
Information you give us
- Account information: name, work email, password (stored only by our identity provider, never in readable form), firm name, role, and firm settings.
- Billing information: plan, billing history and contact. Card details are entered directly with our payment processor; we do not receive or store full card numbers.
- Customer Data: templates and documents firms upload, intake answers Clients submit, saved drafts, notes and generated documents. Because firms design their own forms, intake answers can include any information a firm asks for, such as contact details, family and financial information, or details of a legal matter.
- Communications: messages you send through our contact or feedback forms or by email, including your name, email, phone number and message.
- Prospect information: if you request access or use our public template analyzer, your email, firm name, practice area and phone number if provided.
Information collected automatically
- Security and service logs: IP address, browser user agent, request details, timestamps and error information, generated when you use the Service.
- Verification records: when a Client verifies their email with a one-time code, the time, IP address and user agent of the attempt.
- Form activity: when a Client starts a form and which steps they reach, linked to the email they entered, so the firm can see its intake progress.
- Cookies and similar storage: see Section 6.
We do not use third-party advertising or analytics trackers, and we do not buy personal information from data brokers.
3. How we use information
- to provide the Service: accounts, intake forms, drafts, document generation, review, release and e-signature;
- to send service emails, such as verification codes, draft and submission notices, document-release notices and billing notices;
- to provide support when a firm asks for it;
- to secure the Service: authenticate users, detect and prevent fraud and abuse, and investigate incidents;
- to bill for the Service;
- to maintain and improve the Service using aggregated, de-identified statistics and troubleshooting records (see the Data Use Policy);
- to send product and marketing emails to firm users and prospects, which you can opt out of at any time; and
- to comply with law and enforce our agreements.
We use Customer Data only to provide the Service to the firm and as the firm instructs. We do not sell personal information, share it for cross-context behavioral advertising, or use Customer Data to train AI models.
5. How long we keep information
We keep information only as long as needed for the purposes above:
| Information | Retention |
|---|---|
| Customer Data (templates, submissions, generated documents) | While the firm’s account is active, and deleted after the account ends as described in the DPA. Firms can archive workflows at any time, and can ask us to delete records sooner. |
| Unsubmitted Client drafts | Deleted automatically after 30 days. |
| Public template analyzer uploads | Deleted automatically, typically within 48 hours. |
| One-time verification codes and short-lived sessions | Minutes to hours; they expire automatically. |
| Prospect, lead and contact-form information | Up to 12 months after our last contact, unless you become a customer or ask us to delete it sooner. |
| Troubleshooting records of AI processing | Up to 12 months. |
| Security, audit and access logs | Up to 7 years, to investigate incidents and meet legal and contractual obligations. |
| Backups | Expired on a rolling schedule: within 90 days for Customer Data, and within 15 months for account-directory backups. |
7. How we protect information
We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, separation of each firm’s data, role-based access controls, password requirements, logging of privileged access, and backups. No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify the affected firm, and you where the law requires, without undue delay.
8. Your choices and rights
- Firm users can update their profile in the Service. Firm owners and administrators manage their firm’s users and data.
- Marketing emails include an unsubscribe link, and opting out does not affect service emails.
- Access, correction and deletion. Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of your personal information, and to appeal our decision. Email privacy@lexatta.com. We will verify your request and respond within the time the law requires, and in any case within 45 days. We will not discriminate against you for exercising these rights.
- Clients should direct requests to the law firm. We will help the firm respond.
9. Where information is stored
We store information in the United States, and our providers process it in the United States, except that our AI model provider may analyze templates firms upload in other countries. The Service is intended for law firms and their clients in the United States. If you use it from elsewhere, your information will be transferred to and processed in the United States.
10. Children
The Service is not directed to children, and firm accounts are for adults only. A firm may collect information about a minor, for example a child named in an estate plan, through its own intake form; that information is Customer Data handled under the firm’s instructions. We do not knowingly collect personal information directly from children under 16.
11. Changes to this policy
We will post any changes on this page and update the version and effective date. For material changes we will notify firm account owners by email or in the Service before they take effect.
12. Contact us
Privacy questions and requests: privacy@lexatta.com. Mail: Lexatta LLC, Attn: Privacy, 6716 Eastside Drive NE, Ste 109, Tacoma, WA 98422.