Privacy Policy

1. Introduction

This Privacy Policy explains what LexInsight collects, why, how long we keep it, and who processes it.

1.1 The short version

• We collect what you type into the order flow, the documents you upload, and basic technical data.
• We use your documents to produce your report. We do not sell them.
• We keep your order, including your documents and report, until 90 days after your payment date, then delete them. We email you a reminder before we do. You can ask us to delete them sooner.
• We do not use your documents to train AI models.
• We use a small number of service providers to run the service. Section 5.1 describes what each type of provider handles.

2. Information we collect

2.1 Information you provide

• your name and email address;
• your order details, including the review type and tier you choose;
• your intake responses, such as role, employer, work location, and document type;
• the documents you upload.

2.2 What your documents may contain

Employment and compensation documents often name people and describe pay, equity, and separation terms. They may also contain identifiers we do not want, such as Social Security numbers. Please redact those before uploading. See Section 2 of the Acceptable Use Policy.

2.3 Payment information we do not see

Payment details are entered with Stripe. We do not receive or store your full card number. Stripe processes payment data for its own compliance and fraud-prevention purposes under its own terms.

2.4 Information collected automatically

We record basic technical data when you use the service: IP address, browser type, and error events. We do not enrich your record with purchased profiles, social media data, or people-search data, and we do not collect location information derived from your IP address.

2.5 Information from other sources

We do not buy or license personal information about you from data brokers.

2.6 Children

LexInsight is for people 18 and older. We do not knowingly collect information from anyone under 18.

3. How we use information

3.1 Purposes

• to produce and deliver your report, and to remind you before we delete it;
• to take payment and keep the transaction record;
• to respond when you contact us;
• to detect and fix faults, and to protect the service from abuse;
• to measure, in aggregate, whether the service works. Page-view measurement

carries no identifier and sets no cookie. A completed order records operational stage counts under a keyed, non-reversible reference to the order, so we can tell a genuine second event from a retry. Those stage rows are order-linked, pseudonymous records, not anonymous data, and they follow the deletion of the order.

3.2 Automated processing and AI

Your documents are analyzed by automated systems, including artificial intelligence. No attorney performs or reviews that work.

We do not use your documents, intake responses, or reports to train, fine-tune, or evaluate AI models, and we require our providers not to do so. Separately, our provider may process submitted content for a limited period to deliver the response and to support its safety and abuse-monitoring duties. That processing is storage, not training.

We test and improve the service with synthetic documents and public-source records, not with customer documents.

For Executive and C-Suite / Board reports, the AI model that writes your report also picks the published occupation that best matches your role, so the report can show published pay data for it. Our application first shortlists up to 15 occupations from public U.S. Department of Labor records, using the job title you enter, the description of your responsibilities if you enter one, and the role description in your documents. The model may only choose from that shortlist, or choose none. It does not look anything up, and this step sends no document text beyond what the report already uses. The pay figures come from published U.S. Bureau of Labor Statistics data and are selected by our application, not by the model.

If the model chooses none, or is not confident, the report shows no occupation pay data. If its choice cannot be checked against your documents, our application may instead compare the job title you enter with the official occupation titles in those public records, and uses an occupation only when your title names exactly one. That comparison runs inside our application, and the report says when an occupation was matched from your job title.

3.3 Sensitive personal information

We do not ask for your race, ethnicity, religion, health information, sexual orientation, or immigration status, and we do not use the service to infer any of them. If a document you upload contains that kind of information, we hold it as part of your document and delete it on the schedule in Section 6.

4. Cookies and tracking

We use two strictly necessary cookies and no others. The Cookie Notice lists them, along with the session storage used during an order and Stripe's checkout page. We do not run advertising cookies, and we do not use third-party advertising or cross-site tracking scripts.

5. How we disclose information

5.1 Service providers

We share information with a small number of service providers that run LexInsight for us. Each one receives only what its role needs:

• Hosting and storage. Hosts the website and order flow, and keeps your order in a private database and private file storage. It handles uploaded documents, intake responses, report records, report access tokens, and technical request data such as IP address.
• AI model provider. Analyzes your documents to produce the report, and, for Executive and C-Suite / Board reports, picks the published occupation closest to your role from our application's shortlist. It handles document text and the intake context the analysis needs, including the job title and any description of your responsibilities you enter.
• Document rendering. Turns your report into a downloadable PDF. It handles report content at the point of rendering.
• Email delivery. Sends transactional email, such as the report-ready message and deletion reminders. It handles your email address and the message content, which includes your report link.
• Payment processor (Stripe). Takes payment on its own checkout page. It handles billing identifiers and transaction data. Stripe also processes payment data for its own compliance and fraud-prevention purposes under its own terms.

Your uploaded documents are kept in private storage with no public access. Document analysis and report generation are performed by automated systems, and no attorney performs or reviews that work. We do not receive or store your full card number.

If we add a type of provider that handles uploaded documents, we will update this section before we do, and note the change on the legal changelog.

5.2 Other disclosures

We may disclose information where the law requires it, where we need to establish or defend a legal claim, or to protect someone's safety. Where we are legally able to tell you about a compelled disclosure, we will.

5.3 What we do not do

We do not sell your information. We do not rent it, trade it, or share it for advertising. We do not share your documents with anyone except the providers that process them for us and any recipient you direct us to.

6. Retention and deletion

Your order. We keep your uploaded documents, the extracted text stored with your order record, your report, and its published evidence until 90 days after your payment date. Then we delete them from active systems and revoke access. You can ask us to delete them sooner.

Deletion reminders. If your report was delivered, we email the address used for the order seven days before the deletion date, and again during the last day before it unless the first reminder was sent within the previous two days. Each reminder carries a new report link that stops working at the deletion time. A reminder never postpones deletion.

Working files. Separately from your order record, we keep the working files created while your report is being processed, such as raw, normalized, sanitized, and validated artifacts and render intermediates, for seven days, or until your order record is deleted, whichever comes first.

Abandoned orders. If you start an order and do not complete payment, we delete the intake and any uploaded files seven days after they were created.

Access links. A report link works for 14 days and can be used more than once. A report session lasts 24 hours after you open the link. Each file download uses a signed link that expires after five minutes. These are different periods for different things.

Transaction records. We keep a minimal transaction and assent record for seven years. It holds what was bought, when, and what you agreed to. It does not hold your documents, your report, or your intake answers.

Funnel counts. We keep aggregate counts of how far an order progressed, such as a confirmed payment or a delivered report. A count that belongs to an order is stored under a keyed, non-reversible reference to that order, not under the order number. These rows are deleted within 30 days. Page-view measurement carries no identifier and is not linked to an order.

Deletion requests. We keep a minimal record of a completed deletion request for three years, so we can show the request was handled. That record is not a copy of the deleted content.

Backups. Deletion applies to active systems when the deletion job runs. Backup copies age out under our provider's rotation schedule.

6.1 Legal holds

If we are required to keep specific data, for example because of a legal claim or a lawful instruction, we pause deletion for that data and keep a record of why. A hold is a recorded instruction with a scope and an owner, and it is reviewed periodically. It is not inferred from anything a report says.

6.2 Early deletion on request

You can ask for earlier deletion at any time. To protect you, we first confirm that you control the email address used for the order and that the order details match. Holding a forwarded report link is not enough on its own, because a forwarded link does not show who ordered the review. Once confirmed, we revoke access and delete the private material on the schedule above. If a legal hold applies, we tell you that we cannot delete that data and why.

7. Security

Uploads go to a private storage bucket with no public access. Files are encrypted in transit and at rest by our infrastructure providers, and downloads use short-lived signed links. Access to production data is limited to the team that operates the service.

No system is perfectly secure. We cannot promise that unauthorized access will never happen. If a breach affects your information, we will notify you and the authorities as the law requires.

8. Your privacy rights

8.1 Rights available to everyone

You can ask us to:

• tell you what we hold about you;
• correct something that is wrong;
• export a copy;
• delete your information, subject to Section 6.

Contact info@lexinsight.co. We respond to requests as the applicable law requires. We may need to confirm that you control the email address associated with the order before we act.

8.2 California residents

If you live in California, you may have rights under the CCPA and CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising a right.

8.3 Other U.S. state residents

Several other states give residents rights over their personal data, including rights to access, delete, correct, and obtain a copy. Contact us to make a request, and we will handle it as the applicable law requires.

8.4 Nevada residents

We do not sell covered information as defined by Nevada law. You may still submit a request to info@lexinsight.co.

8.5 Users outside the United States

LexInsight is intended for users in the United States. If you use it from another country, you are responsible for your own local law. Contact us before using the service if you need to understand how your local law applies.

9. Changes to this policy

If we change this policy in a way that affects what we collect or how long we keep it, we update the effective date and note the change on the legal changelog.

10. Contact

info@lexinsight.co