Privacy Notice

1. Who we are

Lex Aurum ("Lex Aurum", "we", "us") operates the Lex Aurum legal intelligence platform. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA) — equivalent to a data controller under the UK and EU GDPR — for the personal information described in this notice. You can reach our information officer at info@lexaurum.co.za.

2. What we collect and why

• Account data — name, email address, firm or institution name, practitioner type, and login credentials. Used to create and secure your account and to administer your plan. Legal basis: performance of our contract with you.
• Content you submit — research queries, drafting instructions, matter and client records, and uploaded documents (which may contain your clients' personal information). Used to provide the research, drafting, analysis, and storage features you request. Legal basis: performance of our contract. Where your uploads contain third-party personal information, you act as the responsible party for that information and we process it on your instruction.
• Usage and telemetry — feature usage, AI prompt counts against your daily allowance, timestamps, device and browser information, and IP address. Used for service operation, fair-use enforcement, security, abuse and fraud prevention, and product improvement. Legal basis: legitimate interests in running a secure and sustainable service.
• Support communications — messages you send us. Used to answer and resolve your query. Legal basis: legitimate interests and contract performance.
• Subscription records — plan, status, and billing period. Note that card details and billing addresses are collected and processed by Paddle, not by us. Legal basis: contract performance and legal obligation.

We do not sell personal information, and we do not use your client documents to train third-party foundation models.

3. Who we share it with

• Service providers and operators — cloud hosting, database, authentication, and AI model providers that process content solely to deliver the features you use, under contract and on our instructions.
• Paddle.com — our Merchant of Record, for sale of subscriptions, subscription management, payments, tax compliance, and invoicing.
• Professional advisers — legal, accounting, and audit advisers where necessary.
• Authorities — where we are required to disclose by law, court order, or lawful regulatory request.

4. Cross-border transfers

Some of our providers process information outside South Africa (including in the EU, UK, and United States). Where personal information is transferred across borders we rely on the safeguards permitted by section 72 of POPIA and, where the GDPR applies, on adequacy decisions or Standard Contractual Clauses with the recipient.

5. How long we keep it

Account and matter data is retained for as long as your account is active and for 12 months afterwards, so you can reactivate or export. Uploaded documents are deleted within 30 days of you deleting them or closing your account. Billing and tax records are kept for five years as required by South African tax law. Security and audit logs are kept for up to 12 months. When information is no longer needed it is deleted or anonymised.

6. Your rights

Under POPIA you may request access to the personal information we hold about you, ask us to correct or delete it, object to processing, and lodge a complaint with the Information Regulator (South Africa). If the UK or EU GDPR applies to you, you also have rights of restriction, portability, and withdrawal of consent, the right to complain to your supervisory authority, and we will respond to requests within one month.

To exercise any right, email info@lexaurum.co.za.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest for stored documents, row-level access controls so that accounts can only reach their own records, private document storage, role-based administrative access, and least-privilege service credentials. No system is perfectly secure, but we work to protect your information and will notify you and the Information Regulator of a compromise as POPIA requires.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in, maintain your session, and secure the platform; these cannot be switched off without breaking the Service. We use a limited amount of privacy-respecting analytics to understand aggregate feature usage. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser settings, but sign-in will not work without the essential ones.

9. Changes

We may update this notice; the revised version will be posted here with a new "last updated" date, and we will tell you about material changes by email or in-app notice.