Compliance, by design.
Aligned with the GDPR., Spain's LOPDGDD., the principles of the AI Act., EU data residency.
GDPR, the EU AI Act and contracts processed entirely within the European Union. Clear processing roles and the data processing agreement included in our Terms and Conditions.
The rules we comply with
100%
Contracts processed in the EU
GDPR
European framework
AI Act
AI regulation
Never
Your data trains AI
The rules we comply with
LexyAi is built to operate within Europe's most demanding data protection and artificial intelligence frameworks.
GDPR (EU) 2016/679
We process data under the principles of privacy by design and by default, with an explicit legal basis for each purpose and data minimization.
Privacy by designMinimizationLOPDGDD (Spain)
We comply with Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights, which adapts the GDPR to Spanish law.
Law 3/2018Digital rightsEU AI Act
We apply transparency: you always know the analysis is AI-generated and the final decision is yours. Every analysis is for guidance, never a binding automated decision.
TransparencyHuman decisionEU data residency
The storage, database, processing and AI that analyze your contracts run in European Union regions. Only payments (Stripe) and some technical connection data may be processed elsewhere, with GDPR safeguards.
EU infrastructureYour contracts stay in the EU
European compliance, no exceptions
Designed from day one under the principles of privacy by design and by default of the European Union's General Data Protection Regulation.
Your contracts are stored and processed on servers in the European Union
Compliance with Art. 32 GDPR — technical and organizational measures
Right to erasure: complete cascade deletion upon request
Data minimization and purpose limitation
Auditable and traceable activity logs
Explicit legal basis for each data processing activity
DATAIN THE EU
Who is responsible for what
Full transparency on how data flows between you, LexyAi and our subprocessors.
Data controller
LexyAi, for your account data, your payments and the contracts you analyze as an individual. We process them only to provide the service and comply with the law, and never to train AI.
If you're a professional, you decide
When you upload contracts of your clients or employees, you are the controller and LexyAi the processor, with the data processing agreement (Art. 28 GDPR) included in the Terms.
Subprocessors
AI and infrastructure providers acting under a DPA. They process only what is strictly necessary and are prohibited from using your data for other purposes.
On what basis we process your data
Every processing activity we carry out relies on one of the legal bases recognized by Art. 6 of the GDPR.
Performance of the contract
We process your data to provide the analysis service you signed up for and to meet our obligations to you (Art. 6.1.b).
Consent
For analytics in your browser and marketing communications we ask for your consent, which you can withdraw at any time (Art. 6.1.a).
Legal obligation
We retain certain information when a law requires it, for example for tax or invoicing purposes (Art. 6.1.c).
Legitimate interest
For security, fraud prevention and internal service metrics (sign-ups, payments, completed analyses), pseudonymised and without the content of your contracts, on the basis of a legitimate interest balanced against your rights (Art. 6.1.f).
Data subject rights
The GDPR grants you these rights over your data. At LexyAi you can exercise them easily.
Access
Request a copy of the personal data we process about you.
Rectification
Correct any inaccurate or incomplete data from your profile.
Erasure
Delete any analysis or your entire account in cascade whenever you want.
Portability
Download your analyses in PDF whenever you want.
Objection
Object to specific processing of your personal data.
Restriction
Request that we restrict the processing of your data in certain cases.
To exercise any of these rights, write to dpo@lexyai.app. We reply within the one-month period set by the GDPR.
Transparency in case of incidents
If something went wrong, you'd know what's happening and how it affects you. No fine print.
Breach notification
If a security breach affected your personal data, we would notify you without undue delay, in accordance with Art. 33 and 34 of the GDPR.
Notice to the authority
Where applicable, we would notify the incident to the competent supervisory authority (in Spain, the AEPD) within a maximum of 72 hours.
Privacy contact
For any question about how your data is processed, write to dpo@lexyai.app. We reply within the one-month period set by the GDPR.
Built on certified infrastructure
LexyAi runs on providers with the most demanding security certifications in the market.
ISO 27001
Information Security Management
Provider: Google Cloud
ISO 27017
Security for Cloud Services
Provider: Google Cloud
ISO 27018
Protection of Personal Data in the Cloud
Provider: Google Cloud
SOC 2 Type II
Security and Availability Controls
Provider: Google Cloud · Supabase · Vercel
CSA STAR
Cloud Security Alliance Level 1
Provider: Google Cloud
ENS Medio
Spanish National Security Framework
Provider: Google Cloud
Certifications held by our infrastructure providers, not by LexyAi as a company
Compliance questions
It depends on how you use LexyAi. For your account data and the contracts you analyze as an individual, LexyAi is the data controller. If you act as a professional or business and upload contracts of your clients or employees, you are the controller and LexyAi acts as processor, under Art. 28 GDPR.
Compliance is the starting point.
Analyze your contracts knowing that data processing complies with the GDPR and follows the principles of the EU AI Act, with your contracts always in the European Union.