Privacy Policy

YR Legal Services Ltd is a company registered in England and Wales, Company No. 16885532. Registered Office: 124 City Road, London, England, EC1V 2NX.

We process personal data in accordance with applicable UK data protection law and, where applicable, other data protection and privacy laws.

Our privacy contact is privacy@lexona.ai. Please use that address for any question about this policy or to exercise your rights.

2.1 Lexona as controller

We are the controller of the personal data we handle for our own business operations: account administration, website enquiries, billing, customer support, security, fraud prevention, marketing, and compliance with our legal obligations. Sections 3, 4 and 8 describe that processing.

2.2 Lexona as processor for Client and Matter Data

Legal practices that use Lexona (“customers”) upload, access and work with information about their clients and matters — for example documents, correspondence, and details of clients, counterparties and other people named in legal files (“Client and Matter Data”).

For Client and Matter Data, Lexona acts as a processor on behalf of the customer legal practice. The customer determines the applicable lawful bases and, where relevant, conditions for processing special-category or criminal-offence data. Lexona processes such data only on documented instructions and in accordance with the applicable customer agreement and Data Processing Agreement.

If you are a client of a legal practice that uses Lexona, or you are named in a matter it handles, that practice is responsible for how your information is used, and its own privacy notice applies. Please contact the practice directly. If you contact us instead, we will refer your request to the practice where we can identify it.

• Enquiry data: your name, email address, phone number if you give it, your firm’s name and size, your message, and which form you used.
• Account data: the name, professional email address, role and practice of each authorised user, sign-in and multi-factor authentication settings, and account activity. Passwords are managed by our authentication provider and are not stored by us in readable form.
• Billing data: where a customer pays for the service, billing contact details and subscription and invoice records. Where card payments are offered, they are handled by a payment provider and we do not store full card numbers.
• Support data: the content of support requests and our replies.
• Security and technical data: IP address, browser and device information, request and error logs, authentication events, audit records of actions taken in the platform, and the result of automated form protection.
• Marketing preferences: whether you have asked to receive, or not to receive, updates from us.

This table covers only the processing for which we are the controller. Client and Matter Data is not included: we process it as a processor (section 2.2), and the customer legal practice determines its lawful basis.

Scroll the table sideways to see every column.

• We use Client and Matter Data only to provide the service to the customer practice and as it instructs, including keeping the service secure and giving the support it asks for.
• We do not use Client or Matter Data to train AI models.
• To produce AI-assisted drafts and analysis, the relevant parts of Client and Matter Data — such as document text, page images and matter context — are sent to AI model and document text-extraction providers through their APIs.
• Where configured and contractually available, model providers are used with enterprise privacy controls designed to limit provider retention and model training. Retention and training terms depend on each provider's agreement and account configuration, and we do not claim that any provider retains no data.
• Lexona does not make decisions about individuals that produce legal or similarly significant effects solely by automated means. AI outputs are drafts and analysis for review by the customer's authorised users, who remain responsible for the decisions they make.

• Service providers and subprocessors that host and operate the service: application hosting; database, authentication and document storage; vector search; AI model and document text-extraction services; security and network services; website hosting; and email. Customers and prospective customers can request the list of subprocessors through a security pack request; we share it with prospective customers under NDA where appropriate. Anyone can ask our privacy contact, privacy@lexona.ai, about the recipients of their personal data.
• The customer practice an authorised user belongs to: its administrators can see that practice’s users and their activity in the platform.
• Third-party platforms a customer connects, where an integration is available: data moves between Lexona and that platform as the customer instructs, under that platform’s own terms.
• Professional advisers and insurers, under a duty of confidentiality.
• Regulators, courts and law enforcement, where the law requires it or to protect our rights.
• A buyer or investor, if we are involved in a merger, acquisition, financing or sale of assets, subject to confidentiality obligations.

We do not sell personal data.

Where personal data is transferred outside the UK, an appropriate lawful transfer mechanism is required where the law requires one, which may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations, or another recognised safeguard, together with any required transfer risk assessment.

• Core application compute is hosted in the EU.
• Database, authentication, document storage and vector search services are hosted in the United Kingdom.
• AI model, document text-extraction, security, website and email services, the web font and icon services your browser contacts when you use the platform, and mail servers a customer connects, may handle data in other countries, including the United States.

The UK recognises the EEA as providing adequate protection for personal data. The UK recognises the United States as adequate only for organisations certified under the UK Extension to the EU–US Data Privacy Framework; other transfers there require an appropriate safeguard.

Anyone can ask our privacy contact, privacy@lexona.ai, about transfers of their personal data.

Data we control

• Enquiry data: for as long as we need it to deal with your enquiry and any follow-up, after which it is deleted or anonymised.
• Account data: while the customer’s account is active, and afterwards only as long as needed to close the account, resolve disputes and meet legal obligations.
• Billing data: for as long as tax and company law require.
• Support data: for as long as needed to resolve the request and keep a record of the support we gave.
• Security and technical data: for as long as needed for security, audit and investigation purposes. Audit records attributed to a customer practice are deleted with that practice’s data; authentication records that cannot be attributed to a practice may be kept for security purposes.
• Marketing preferences: until you ask us to stop. We keep a record of an opt-out so that we can respect it.

Client and Matter Data

Client and Matter Data is kept for the duration of the customer agreement.

Following termination, Client and Matter Data is deleted in accordance with the applicable customer agreement and Data Processing Agreement, normally within 30 days unless the customer instructs otherwise or Lexona is legally required to retain specified information.

Where a subprocessor keeps a copy for a limited period — for example in a backup or a provider log, where one exists — that copy is deleted on the provider’s own retention cycle.

We use technical and organisational measures appropriate to the nature of the data, as set out in our Information Security Policy and described on our Security page. Lexona is not currently certified to Cyber Essentials, ISO 27001 or SOC 2, and no independent penetration test of the production environment has been completed.

If a personal data breach affects Client and Matter Data, we will notify the customer practice without undue delay after becoming aware of it and help it meet its own obligations. If a breach affects data we control, we will notify the Information Commissioner’s Office and affected individuals where the law requires.

Depending on the circumstances, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict how we use your data;
• receive your data in a portable format;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• withdraw consent, where we rely on consent, without affecting processing that has already taken place; and
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise a right, email privacy@lexona.ai. We may need to confirm your identity. We respond normally within one month, subject to any extension permitted by applicable law.

If your request concerns Client and Matter Data, the legal practice concerned is responsible for responding. Please contact the practice; we assist it as our agreement with it requires.

You can complain to the Information Commissioner’s Office (ICO), the supervisory authority for data protection in the UK, at ico.org.uk. We would appreciate the chance to address your concern first.

lexona.ai uses only strictly necessary cookies and similar technologies, and no analytics or marketing cookies. The Cookie Policy lists each cookie and similar technology on the website and the platform, and you can review your choices at any time in Cookie settings.

Lexona is a service for legal practices and business users. We do not knowingly collect personal data directly from children. Client and Matter Data may include information about children where a legal practice’s work involves them; the practice is responsible for that data.

We update this policy when our processing changes, and change the “Last updated” date above when we do. Where a change is material, we will also tell the account administrators of our customers.

Privacy contact: privacy@lexona.ai