Last updated: 15/10/2026
LexyAi (hereinafter “LexyAi” or the “Controller”) is committed to protecting the privacy of its users. This document has been prepared in accordance with Regulation (EU) 2016/679 on the Protection of Personal Data (“GDPR”), Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (“LOPDGDD”), and other applicable regulations.
To the extent that the Service involves the use of artificial intelligence technologies, please be informed that LexyAi has been developed in compliance with Regulation (EU) 2024/1689 on artificial intelligence, ensuring ethical and responsible operations aligned with the principles of transparency, security and fairness, with the final decision always in the user's hands.
Data Controller
LexyAi's Responsible Party (owner identified in the Legal Notice)
Privacy contact
Purposes
Legal Basis
International Transfers
Your contracts and analyses never leave the European Union. Only payments (Stripe), certain technical connection data (Vercel, Sentry) and the messages you send to support (Google) may involve transfers to the United States, with the safeguards described in section 7.
Exercise of Rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by sending an email to dpo@lexyai.app.
The personal data you provide in the context of using LexyAi, or collected during the contractual or pre-contractual relationship arising from use of the AI-based contract analysis service, will be processed by LexyAi's Responsible Party, the owner identified in the Legal Notice, as the Data Controller.
You may contact the Controller regarding any matter related to the processing of your personal data or the exercise of your rights at dpo@lexyai.app.
As a result of using the LexyAi contract analysis service, we will process the following personal data:
Original files (PDF, DOCX, TXT) are kept encrypted only while the analysis is carried out and are deleted automatically when it ends, whether it succeeds or not, in compliance with the data minimisation principle (Art. 5.1.c GDPR).
Uploaded documents: third-party data and special categories of data
The documents the User chooses to upload may contain personal data of persons other than the User (“Third-Party Data”), such as the other parties to the contract, their representatives, employees, clients, landlords or guarantors, and, by their very nature, special categories of data (Art. 9 GDPR) — such as health data, trade-union membership, religious or philosophical beliefs, ethnic origin or sexual orientation — or data relating to criminal offences and convictions (Art. 10 GDPR).
User responsibility. Upon registering, and again with each document uploaded, the User represents and warrants that they are entitled to upload it, that they have a legal basis to process the Third-Party Data it contains and that they fulfil their obligations towards the data subjects, assuming the responsibility and the obligation to hold harmless set out in clause 8 of the Terms and Conditions.
LexyAi's role depending on the type of User. Where the User is an individual acting in a purely personal or household capacity, LexyAi processes Third-Party Data as controller, solely to provide the requested analysis and on the basis of its legitimate interest in providing the contracted service (Art. 6.1.f GDPR), with the safeguards described in this Policy. Where the User acts in the course of a business or professional activity — for example, an advisory firm or a law firm uploading its clients' contracts — the User is the controller of such data and LexyAi acts as processor on its behalf, in accordance with Annex I of the Terms and Conditions; in that case, data subjects should first contact the User.
Special categories. With regard to their own data, by voluntarily uploading a document for analysis the User gives their explicit consent to the processing of such data for the sole purpose of generating the requested analysis (Art. 9.2.a GDPR). With regard to Third-Party Data, uploading special category or criminal offence data that is not necessary for the analysis, or for which the User has no legal basis, is prohibited.
Safeguards. LexyAi does not use Third-Party Data for any purpose other than the requested analysis, does not use it to train, improve or feed any artificial intelligence model, and deletes it in accordance with the periods set out in section 8.
Information for affected third parties. This Policy is also made publicly available to the persons whose data appears in uploaded documents, since informing them individually would be impossible or would involve a disproportionate effort (Art. 14.5.b GDPR). Such persons may exercise their rights at dpo@lexyai.app.
The data we process in LexyAi has been provided directly by you through the registration form available on the platform and through direct interaction with the service (uploaded documents and generated reports). In no case is data obtained from publicly accessible sources or from third parties processed, except where required by law or where you have provided it yourself.
You warrant that the personal data provided is true, accurate, complete and up to date, and you undertake to keep it duly updated. If you provide personal data belonging to a third party (for example, if the contract includes information about another person), you declare that you are entitled to provide it for analysis and that you fulfil your obligations towards that person, in accordance with section 3 and clause 8 of the Terms and Conditions.
Your data will be processed to manage your registration as a user, enable access to the service and provide you with automated contract analyses. This includes processing identification and payment data to manage your subscription and issue invoices.
Legal basis: Performance of the contractual relationship (Art. 6.1.b GDPR).
To generate the analysis, the content of the document you upload is processed by an artificial intelligence model (Google Gemini) hosted on servers located within the European Union. This processing is carried out under a Data Processing Agreement (DPA) that expressly prohibits the use of your data to train, improve or feed any AI model, and guarantees that it is not transferred outside the European Economic Area. The text extracted from the document is retained only for as long as strictly necessary to perform the analysis: it is deleted when the analysis ends and, as a safeguard, is never kept for more than three (3) hours, in application of the data minimisation principle (Art. 5.1.c GDPR).
Legal basis: Performance of the contractual relationship (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR).
Your data may be processed to send you commercial or promotional communications relating to products and services of LexyAi or partner companies, only when you have given your express consent. You may withdraw your consent at any time.
Legal basis: Consent of the data subject (Art. 6.1.a GDPR).
Your data may be processed to comply with obligations arising from national or European regulations, as well as requirements from judicial or administrative authorities.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
Your personal data may be disclosed to the following recipients, solely to the extent necessary for the purposes indicated:
Your contracts and analyses never leave the European Union. The content of the documents you upload, their text, the analyses generated and your account data are processed and stored exclusively on servers located in the European Union: the database and storage (Supabase), the processing of analyses (server functions running in Frankfurt, Germany), the artificial intelligence models (Google Cloud, europe-west1 region, Belgium), the processing queues (Upstash, EU) and email delivery (Resend, Ireland). AI providers have signed GDPR-compliant Data Processing Agreements (DPAs) that prevent your data from being used to train AI models.
Only in three areas, unrelated to the content of your contracts, may an international transfer of data to the United States take place:
These transfers are covered by the safeguards provided for in Chapter V GDPR: the European Commission's adequacy decision on the EU-US Data Privacy Framework, for companies certified under it, and the standard contractual clauses adopted by the European Commission (Art. 46.2.c GDPR). You can request further information at dpo@lexyai.app.
Your data will be retained for as long as the contractual relationship with you arising from the use of the LexyAi service subsists, and thereafter for the legally applicable retention periods depending on the type of data and the purpose of processing.
When processing is no longer necessary, the affected data will be blocked and will only be available upon request from public authorities or courts. Once all legal retention periods have expired, the data will be permanently deleted.
In particular, when you exercise your right to erasure or delete your account, billing data and the invoices associated with your payments are not deleted immediately: they are retained in blocked form and dissociated from your profile for the applicable legal accounting and tax retention periods (generally up to six (6) years under Article 30 of the Spanish Commercial Code), in accordance with Article 17.3.b GDPR. Once those periods have elapsed, this data will be permanently deleted.
The technical logs of the background processing system (Upstash, EU), which may include the generated report, are automatically deleted within three (3) days at most.
Users have the right to access, rectify, erase, object to, restrict the processing of and request portability of their personal data, as well as the right not to be subject to automated decisions with legal or significant effects. Where processing is based on consent, users may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, you may send a written request to dpo@lexyai.app, providing proof of identity by means of a copy of your national ID, passport or equivalent official document. LexyAi will respond to the request within a maximum of one (1) month from receipt, extendable by up to two (2) additional months if necessary.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your data protection rights have been infringed.
LexyAi reserves the right to modify, update or revise the content of this privacy policy at any time, in response to regulatory changes, case law, organisational or technical needs, or the evolution of the service itself. Where material changes are introduced, users will be clearly informed via the website or by email. The updated version will apply from the moment of its publication.