Last updated: August 1, 2026
LexAI ("we," "us," "our") provides a legal practice management platform for law firms in the Philippines. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with your use of LexAI, in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
This Policy applies to (a) personal data of law firm personnel who register and use LexAI ("Firm Users"), and (b) personal data of law firm clients, leads, and related individuals that Firm Users input into LexAI in the course of managing their practice ("Client Data").
With respect to Firm User account information (name, email, firm details, billing information), LexAI acts as a Personal Information Controller under the Data Privacy Act.
With respect to Client Data that a law firm inputs into LexAI (client names, case details, documents, correspondence, and related information), the law firm is the Personal Information Controller, and LexAI acts as a Personal Information Processor, processing that data solely on the firm's instructions and for the purpose of providing the platform.
We collect the following categories of information:
LexAI's AI-assisted features (document summarization, contract risk review, drafting assistance, legal research, and the per-matter AI assistant) are powered by Anthropic's Claude models. When a Firm User actively uses an AI feature, the relevant content — for example, the text of a document being summarized, or a question asked about a case — is sent to Anthropic for processing and a response is returned.
We process personal data to:
We do not sell personal data. We do not use Client Data to train AI models.
We process personal data on the following bases recognized under the Data Privacy Act: (a) consent, where you have agreed to this Policy and our Terms of Service; (b) performance of a contract, to provide the services you have subscribed to; and (c) compliance with legal obligations.
We use the following third-party service providers to operate LexAI. Each processes data only as necessary to perform their function for us, under contractual confidentiality obligations:
Some of these providers may process data on servers located outside the Philippines. Where this occurs, we require contractual safeguards consistent with the Data Privacy Act's requirements for cross-border data transfer.
We implement organizational, physical, and technical security measures appropriate to the sensitivity of the data we process, including encryption in transit (TLS), database-level access controls (Row Level Security), and restricted internal access to production data. No system is completely secure, and we cannot guarantee absolute security, but we are committed to promptly investigating and addressing any suspected security incident.
We retain personal data for as long as your account remains active, and for a reasonable period thereafter to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. A Firm User may request deletion of their firm's account and associated Client Data, subject to the firm's own retention obligations to its clients under the Rules of Court and other applicable professional responsibility rules, which remain the firm's responsibility, not ours.
Data subjects have the right to: be informed that their personal data is being processed; access their personal data; correct inaccurate data; object to processing; request erasure or blocking of data under certain conditions; data portability; and to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data. You may also file a complaint with the National Privacy Commission.
To exercise these rights regarding your Firm User account, contact us at Lexaienterprise@gmail.com. If your request concerns Client Data, we will direct you to the relevant law firm, as they are the Personal Information Controller for that data.
In the event of a personal data breach that poses a real risk of serious harm to affected individuals, we will notify the National Privacy Commission and affected data subjects (or the relevant law firm, for Client Data) within the timeframe required under the Data Privacy Act and its Implementing Rules and Regulations.
LexAI is not directed at children. We do not knowingly collect personal data from individuals under 18 for account registration purposes. Client Data entered by law firms may, in the ordinary course of legal practice, include information about minors relevant to a legal matter (e.g., family law cases); such data is processed solely on the instructions of the law firm as Personal Information Controller.
We may update this Privacy Policy from time to time. Material changes will be notified to Firm Users via email or in-app notice. Continued use of LexAI after changes take effect constitutes acceptance of the updated Policy.
For questions about this Privacy Policy or to exercise your data privacy rights, contact us at Lexaienterprise@gmail.com.