Last updated: 28/04/2026
LexyAi (hereinafter “LexyAI” or the “Controller”) is committed to protecting the privacy of its users. This document has been prepared in accordance with Regulation (EU) 2016/679 on the Protection of Personal Data (“GDPR”), Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (“LOPDGDD”), and other applicable regulations.
To the extent that the Service involves the use of artificial intelligence technologies, please be informed that LexyAI has been developed in compliance with Regulation (EU) 2024/1689 on artificial intelligence, ensuring ethical and responsible operations aligned with the principles of transparency, security, fairness and human oversight.
Data Controller
LexyAi
Data Protection Officer (DPO)
Purposes
Legal Basis
International Transfers
No transfers are made outside the European Economic Area.
Exercise of Rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by sending an email to dpo@lexyai.app.
The personal data you provide in the context of using LexyAI, or collected during the contractual or pre-contractual relationship arising from use of the AI-based contract analysis service, will be processed by LexyAi as the Data Controller.
You may contact the Controller regarding any matter related to the processing of your personal data or the exercise of your rights at dpo@lexyai.app. LexyAI has a Data Protection Officer (DPO) whom you may contact at dpo@lexyai.app.
As a result of using the LexyAI contract analysis service, we will process the following personal data:
Original files (PDF, DOCX, TXT) are deleted from our servers immediately after text extraction, in compliance with the data minimisation principle (Art. 5.1.c GDPR).
The data we process in LexyAI has been provided directly by you through the registration form available on the platform and through direct interaction with the service (uploaded documents and generated reports). In no case is data obtained from publicly accessible sources or from third parties processed, except where required by law or where you have provided it yourself.
You warrant that the personal data provided is true, accurate, complete and up to date, and you undertake to keep it duly updated. If you provide personal data belonging to a third party (for example, if the contract includes information about another person), you declare that you have informed that person of this privacy policy and obtained their consent.
Your data will be processed to manage your registration as a user, enable access to the service and provide you with automated contract analyses. This includes processing identification and payment data to manage your subscription and issue invoices.
Legal basis: Performance of the contractual relationship (Art. 6.1.b GDPR).
Documents undergo an anonymisation procedure to remove any reference to personal data before being processed by the AI, in application of the purpose limitation principle (Art. 5.1.b GDPR). The AI does not access information that could identify you.
Legal basis: Performance of the contractual relationship (Art. 6.1.b GDPR) and compliance with legal obligations (Art. 6.1.c GDPR).
Your data may be processed to send you commercial or promotional communications relating to products and services of LexyAI or partner companies, only when you have given your express consent. You may withdraw your consent at any time.
Legal basis: Consent of the data subject (Art. 6.1.a GDPR).
Your data may be processed to comply with obligations arising from national or European regulations, as well as requirements from judicial or administrative authorities.
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR).
Your personal data may be disclosed to the following recipients, solely to the extent necessary for the purposes indicated:
No international transfers of personal data are made outside the European Economic Area (EEA). Both the databases and the artificial intelligence models used in the service are hosted entirely on servers located within the European Union. All AI providers with access to service data have signed GDPR-compliant Data Processing Agreements (DPAs) guaranteeing that data will not be transferred outside the EEA or used to train AI models.
Your data will be retained for as long as the contractual relationship with you arising from the use of the LexyAI service subsists, and thereafter for the legally applicable retention periods depending on the type of data and the purpose of processing.
When processing is no longer necessary, the affected data will be blocked and will only be available upon request from public authorities or courts. Once all legal retention periods have expired, the data will be permanently deleted.
Users have the right to access, rectify, erase, object to, restrict the processing of and request portability of their personal data, as well as the right not to be subject to automated decisions with legal or significant effects. Where processing is based on consent, users may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, you may send a written request to dpo@lexyai.app, providing proof of identity by means of a copy of your national ID, passport or equivalent official document. LexyAI will respond to the request within a maximum of one (1) month from receipt, extendable by up to two (2) additional months if necessary.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your data protection rights have been infringed.
LexyAI reserves the right to modify, update or revise the content of this privacy policy at any time, in response to regulatory changes, case law, organisational or technical needs, or the evolution of the service itself. Where material changes are introduced, users will be clearly informed via the website or by email. The updated version will apply from the moment of its publication.