Privacy Policy

The one stance

The firm is the authority layer. EdgeLex processes client and matter data only on the firm’s instructions, inside the deployment the firm chose, under the AI policy the firm set. EdgeLex never trains models on a firm’s data and never owns it. Every AI call is metered and attributed to the matter it served.

1. Two kinds of data

Firm data is what a subscribing firm puts into EdgeLex: matters, documents, email, messages, meeting recordings, deadlines, billing records and the questions its people ask Lex. The firm is the controller of this data; EdgeLex is its processor and acts only on the firm’s instructions, under the Data Processing Addendum.

Website and account data is what EdgeLex collects for itself: your name and email when you sign up, join the newsletter or book a demo; billing details handled by Stripe; and page analytics.

2. Firm data: where it lives and who can see it

• It lives in the deployment the firm chose: EdgeLex’s cloud, the firm’s own cloud, or the firm’s own hardware. In the last two, EdgeLex staff have no access unless the firm grants it for support.
• In EdgeLex’s cloud, access by EdgeLex staff is limited to what support and operations require, is logged, and is available to the firm on request.
• AI models see firm data only when a user, or a delegation the firm approved, asks a question. Which models may be used, on which matters, is set by the firm’s AI policy. On the firm’s own keys or local models, the data never reaches EdgeLex’s provider accounts.
• EdgeLex does not train, fine-tune or benchmark models on firm data, and its model providers are bound not to train on it. The providers are listed in the Data Processing Addendum.

3. Website and account data: what we collect and why

• Sign-up and demo requests: name, email, firm, and what you told us. Used to run your trial and answer you. Kept while you are a customer or prospect, deleted on request.
• Newsletter: email and first name, joined at edgelex.com. One-click unsubscribe in every issue. We record when you joined, when you left, and whether you clicked a link, so we can stop sending what you do not read.
• Billing: handled by Stripe. EdgeLex never stores card numbers.
• Analytics: self-hosted, cookie-free page analytics on edgelex.com. No advertising trackers, no data sold, no third-party analytics scripts.
• Sales chat on the site: what you type to Lex on edgelex.com is sent to an AI provider to answer you and kept as a transcript only if you ask for one by email.

4. What we never do

• Sell or rent personal data.
• Use firm data for advertising, product analytics or model training.
• Move firm data out of the region or deployment the firm chose.

5. Your rights

Access, correction, export and deletion of your personal data, on request to hello@edgelex.com. Firms exercise these rights for their own users and clients through the platform’s admin tools and the Data Processing Addendum. Where the GDPR, the UK GDPR or the California privacy laws apply to you, the rights they grant apply in full and requests are answered within the time those laws set.

6. Security

Encryption in transit and at rest; credentials encrypted with AES-256-GCM; role-based access; audit logging of access to firm data; legal hold and retention controls. Details on the Security page.

7. Changes

We post changes here with a new effective date and tell customers by email when a change matters.

Questions: hello@edgelex.com.