Privacy Policy

Lexorii (“Lexorii”, “we”, “us”) provides a practice-management platform for law firms, operated from Dubai, United Arab Emirates. This policy explains what information we collect, where it is stored, who else touches it, and the choices you have. It applies to the Lexorii web application, the Lexorii mobile app for iOS and Android, and the services at lexorii.com.

For firm and client records inside the platform, your firm is the controller and Lexorii is the processor: we hold and process that data on your firm’s instructions, not for our own purposes.

Information we collect

• Account information - your name, email address, role, and firm, provided when an account is created or invited.
• Firm and matter data - content you enter into the platform such as matters, court cases, documents, calendar events, tasks, time entries, contacts and financial records. This can include personal data about your clients and counterparties that you choose to enter, including identity-document details where your firm uses the Emirates ID feature.
• Connected Google data - if you choose to connect Google Calendar, we access your calendar events through the https://www.googleapis.com/auth/calendar.events scope and your basic profile email, solely to synchronize events between Google Calendar and your Lexorii calendar. If a partner separately connects a Google sending mailbox, we request https://www.googleapis.com/auth/gmail.send to send the firm’s client emails and basic identity to show the connected address. This permission does not read the inbox. Email content and recipients are processed by the selected provider.
• Support assistant conversations - what you type into the in-app assistant, so it can answer and draft items for you to confirm. To answer questions about your work, the assistant may look up records you already have access to (such as matters, cases, tasks, calendar, clients and your own time). It only sees what your role could open in Lexorii, and it never changes anything on its own.
• Mobile app data - if you turn on notifications, a push token that identifies your phone, with its platform and language. Photos you take or choose in the app (documents, Emirates ID card copies) are uploaded to your firm’s private storage only when you save or upload them. Emirates ID cards are read on the phone itself; the image is not sent to any AI service. Face ID or fingerprint lock is handled entirely by your phone, and Lexorii never receives biometric data. Voice typing in the iPhone app turns your speech into text on the iPhone itself, and read-aloud uses the iPhone’s built-in voices; no audio is sent to Lexorii or anyone else, and no recording is kept (the text you then choose to send to the assistant is handled like any typed message).
• Usage and security data - limited technical information (log, audit-trail and security data, such as who viewed or changed a document and when) needed to operate and secure the service.
• Website chat - if you use the chat assistant on lexorii.com, what you type or say to it, the page you are on, and any contact details you confirm and send to us from it.

On the public marketing pages, we ask before Google Analytics, Google Ads, the LinkedIn Insight Tag or the Meta pixel may use cookies. If you allow it, Google may set cookies that help us understand page visits, demo requests and which campaign brought you to Lexorii. Until you answer, and if you decline, Google's tag sets no cookies and receives only cookieless signals. Unless you decline, your browser's local storage also keeps, for up to 90 days, the page you landed on and what sent you there (a campaign tag, an ad click identifier or the referring website), so that a demo request you choose to send us says where it came from; declining deletes it. Necessary cookies and local storage are still used to keep you signed in and remember interface preferences. The Lexorii product does not use advertising cookies.

Advertising to past visitors. If you allow cookies, Google, LinkedIn and Meta may record which of our public marketing pages you visited (for example the pricing or demo page), and whether you booked a demo, registered or contacted us. We use this to show Lexorii ads, on their sites and apps, to people who have visited our site, and to avoid showing them to people who already contacted us. LinkedIn and Meta may link the visit to your account with them; we never see who you are, only the size of these audiences. The LinkedIn and Meta tags are not loaded at all unless you allow cookies, and never on sign-in, invitation or other account pages. You can change your answer at any time with Cookie preferences, here or at the foot of any marketing page; declining removes their cookies from our site and stops the tags. You can also control ads in your LinkedIn, Facebook, Instagram and Google ad settings.

We also count visits to the public marketing pages with Umami, an analytics tool that sets no cookies and that we run ourselves on a server in Dubai (until 16 October 2026 we also used Vercel Web Analytics, which works the same way). It records the page address, the referring website, campaign tags, the type of browser and device, a country, how quickly the page loaded, and clicks on buttons such as “Book a demo”. Links that carry a private token (invitations, invoices, meeting and support links) are never sent, and it never runs inside the signed-in app. Your IP address is used to work out the country and, in scrambled form, to tell one visit from another; it is not stored. Country lookups use IP Geolocation by DB-IP.

How we use information

• To provide, maintain, secure and improve the Lexorii platform.
• To enforce the role-based access your firm has configured.
• To synchronize calendar events you have authorized between Google Calendar and Lexorii.
• To send transactional email - reminders, approvals, digests and account notices. We do not send marketing email.
• To answer support requests and diagnose faults.
• With your permission on the public site, to measure marketing performance and demo requests, and to show Lexorii ads to people who have visited it. We do not use firm or client records for advertising.

We do not sell personal information, and we do not use your firm’s content to train AI models.

AI features and the data they share

Some features are answered by an AI model from a company outside Lexorii. Data reaches that company only when a user starts one of these features, and only what the feature needs:

• Ask AI (the assistant, on the web and in the mobile app) - the messages you type, and the Lexorii records the assistant looks up to answer them, such as matter, case, task, calendar, client, lead, time, billing and document details that your role already lets you see. If you ask it to read a document, the document’s text.
• AI drafting (web and mobile app) - the brief you give, the facts of the matter or case and its client, your client’s intake answers, and relevant passages from your firm’s precedents.
• Other AI features on the web - the text you ask it to translate; the file you ask it to read or summarise; a meeting transcript or court notice you ask it to turn into facts or hearing dates; and a fee proposal or matter facts you ask it to turn into billing terms or suggested changes.

Who receives it: Anthropic, PBC (the Claude model), in the United States, for all of the above. No other AI company receives this data from the app. If Claude is unavailable, the feature says so and asks you to try again; it does not switch to another AI service.

Google (Gemini), switched off: version 1.0 of the iPhone app names Google (the Gemini model) as a possible fallback for product-help questions in Ask AI. That fallback is switched off, so Google receives nothing from Ask AI. If it were ever switched back on, Google would receive only the question you type, never firm or client records, and we would update this policy first.

How it is protected: the data is encrypted in transit and used only to answer that request. Anthropic does not use it to train its models and deletes it within 30 days. Anthropic is bound by written terms to keep it confidential and secure, giving it the same or equal protection as this policy.

Your permission: the Lexorii mobile app asks for your permission before Ask AI or AI drafting sends anything, explains what is sent and to whom, and lets you withdraw it at any time under More > Security. If you do not agree, those features stay off and the rest of the app works as normal. On the web, these features run only when you start them, and your firm can turn AI drafting off.

The website chat: the chat assistant on our public pages is separate from the app and never sees firm or client records. It runs on ElevenLabs, which receives what you type or say to it and the page you are on, and writes its replies with Anthropic’s Claude model. If you talk to it by voice, the audio is not recorded; transcripts are kept for 30 days so we can check and improve its answers. Your contact details reach us only if you confirm them in the chat. Please do not share confidential client information there.

Messaging us on WhatsApp: if you message Lexorii on WhatsApp, your message, your name and your phone number are carried and stored by Meta (WhatsApp). The first reply may come from Meta’s business AI assistant, which answers from the product information we give it and what you write; it never sees firm or client records in Lexorii. We read these conversations and reply ourselves when needed. Meta handles them under its own terms and privacy policy, outside the UAE. Please do not share confidential client information there.

Where your data is stored and processed

Lexorii is fully hosted in the United Arab Emirates. Firm data is stored in our own Supabase/Postgres database and file storage on a server in Dubai, whose disk is fully encrypted. Since 16 October 2026 the web application itself also runs on a server in Dubai, so requests are handled in the UAE too; firm data passes through that server while a request is served and is not stored there.

Every 15 minutes we back up the database and files to a second, separate provider whose server is also in Dubai. Backups are encrypted on our server before they are sent, and the backup provider does not hold the key, so it stores data it cannot read.

Some of the providers listed below operate outside the UAE. Data reaches them only when a feature needs it, and only what that provider needs to do its job: the AI model when someone uses an AI feature, email and push delivery, and any calendar or other service your firm chooses to connect.

Who processes data on our behalf

• Ultahost - the database server in Dubai that holds the firm database and files, on a fully encrypted disk.
• Vercel - a standby copy of the web application in Frankfurt, used only if we have to switch back while we finish moving it to Dubai (until November 2026).
• Resend - delivery of notification and account email (United States and EU). Receives the recipient’s address and a short message that says what kind of update is waiting, with a link back to Lexorii. Emails do not carry client or matter names, documents or amounts, unless your firm chooses to include meeting details in an invitation it sends to a client.
• Cloudflare - our domain name (DNS) service. It points browsers to our server in Dubai; app traffic does not pass through it.
• Google - Calendar API for connected calendar sync, and Gmail API for client email when a partner separately connects a sending mailbox.
• Anthropic - the Claude model behind the in-app assistant and AI drafting, processed in the United States. For the assistant it receives your messages and the records the assistant looks up on your behalf; for drafting, the brief, matter facts and relevant passages from your firm’s precedents. This can include confidential client information. Under Anthropic’s commercial terms this data is not used to train its models, and Anthropic keeps it for up to 30 days before deleting it. See Anthropic’s Privacy Policy and Commercial Terms.
• Expo, Apple (APNs) and Google (FCM) - delivery of mobile push notifications. By default a notification only says what kind of update it is (for example, “You have a task update”); client and matter names are included only if you turn on “Show details in notifications” on your phone.
• Sentry - crash and error reporting (EU region). Receives scrubbed error reports with an internal user id and role, never names, emails, request contents or client data.
• Microsoft - Microsoft 365 calendar sync and, through a separate Mail.Send connection, client email from a nominated firm mailbox.
• LightNode - servers in Dubai that run the web application, our own website analytics (Umami, described above) and our encrypted backups (encrypted before they reach LightNode, which does not hold the key).
• Upstash - rate limiting for the standby copy on Vercel only, to slow down abuse. Receives internal user ids only, never names or content.
• Zoho - our support mailbox. Receives the emails you send to support.
• ElevenLabs - the chat and voice assistant on the public website, in the United States. Receives what visitors type or say in that chat and the page they are on. Voice is not recorded, and transcripts are kept for 30 days.
• Meta (WhatsApp) - our WhatsApp business messaging. Receives what people send us on WhatsApp, with their name and phone number. Never receives firm or client records.
• Google Analytics and Google Ads - optional public-site audience and conversion measurement, and advertising to past visitors. Google's tag sends only cookieless signals until you allow cookies.
• LinkedIn and Meta (Facebook, Instagram) - optional advertising to past visitors of the public site. Their tags load only after you allow cookies, and receive the marketing pages you visited and whether you contacted us. Never loaded inside the Lexorii product, and never receive firm or client records.

Data protection law and where your data is kept

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, for firms established in the Dubai International Financial Centre, the DIFC Data Protection Law No. 5 of 2020.

Lexorii is fully hosted in the UAE. The web application that processes your firm’s data, the database and files that store it, and every backup of them are on servers in Dubai. Backups are kept with a second, separate provider and are encrypted on our server before they leave, so the backup provider cannot read them. The records that make up your firm’s account, and every backup of them, are kept in the UAE.

A few services that work on that data run abroad: the AI model (Anthropic, United States) when someone uses an AI feature, notification email (Resend), push notifications (Expo, Apple and Google), scrubbed error reports (Sentry, EU), and the calendar or other services your firm chooses to connect. They receive only what they need to do their job, always encrypted in transit, and only under written terms that require them to keep it confidential and secure. A firm that needs a written data processing agreement can ask us for one.

Who at Lexorii can see your data

We do not browse firm data. Access to the production server and database is limited to Lexorii’s engineering staff and is used only to run the Service, fix a fault, or carry out something your firm has asked for. Where your firm asks us to help with setup or support from inside the app, we do so through a support account that your firm agrees to, that appears in your firm’s user list, and whose actions are recorded like any other user’s. Your partners can remove it at any time, and we remove it when the work is done. Without that permission, support works from account details such as your firm name, users and subscription, not your matters, documents or clients.

Google user data

Lexorii’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request Calendar Events access for calendar synchronization and, only when a partner connects a sending mailbox, Gmail send-only access for client email. Basic identity identifies the connected account. Sending does not request inbox-reading permission. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models. Calendar data is used to display and sync events on your behalf. Client email is sent only for the firm’s requested workflows. Access tokens are encrypted at rest. Disconnect calendar sync in Calendar settings or sending in Settings → Client emails to stop that connection. You can also revoke the app in your Google Account permissions.

Data sharing

We do not sell personal information. We share data only with the providers listed above, and where we are required to by law. Inside the platform, data is visible to authorized members of your firm according to their role - for example, accountants cannot open legal documents. Where your firm invites a client to the client portal, that client sees only the specific matter information your firm shares with them.

Retention

We keep data for as long as your firm’s account is active. Records deleted inside the app are held in a recoverable state for 60 days and are then permanently purged. When an account closes, we provide any export your firm asks for, and firm data is deleted 30 days after closure. Encrypted backups are kept on a rolling schedule (every copy for a day, hourly copies for two days, daily copies for 30 days and weekly copies for up to a year), so data deleted from the app can remain in a backup until that backup expires. Audit and security logs may be kept longer where needed to investigate an incident.

Security

Access is authenticated and role-checked on every request, transport is encrypted, the database server’s disk is fully encrypted (full-disk encryption, so firm data is encrypted at rest), and credentials for connected services are encrypted again on top of that. Backups are encrypted, cannot be deleted from the server they protect, and a restore is tested automatically every month. Sensitive actions are recorded in an audit trail. No system is perfectly secure - if a breach affects your data we will notify your firm within 72 hours of becoming aware of it, with what we know and what we are doing about it.

Your choices and rights

• Disconnect Google Calendar at any time from calendar settings.
• Change your cookie answer on the public site at any time with Cookie preferences, here or at the foot of any marketing page.
• Request access to, correction of, export of, or deletion of your personal data.
• Ask for your staff account to be deleted - in the mobile app under More → Request account deletion, or by emailing support. We confirm with your firm, which owns the account, and then remove your account and personal data.
• Contact your firm’s partners or administrator for firm-managed records - for client and matter data, your firm decides what is kept and for how long, and we will refer such requests to them.
• Email support@lexorii.com with any privacy question or request; we aim to respond within 30 days.

Children

Lexorii is a business tool for law firms and is not directed at children. We do not knowingly create accounts for anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email, and the “Last updated” date above will change.