DRAFT — pending counsel review

This document is a working draft and has not been reviewed or approved by counsel. It is provided for orientation only and does not constitute the final, binding privacy notice.

Privacy Notice

Last updated: Draft of 2026-05-18.

1. Controller

The data controller is the LexTech Lab entity established in the Republic of Mauritius. We process personal data in accordance with the Data Protection Act 2017 of Mauritius.

2. Personal data we collect

Account data: email, password hash, billing country and entity.
Profile data: terms and any practitioner attestation timestamps.
Usage data: tool calls, timestamps and rate-limit counters.
Billing data: subscription and payment-event records held by our Mauritian payment provider.

3. Lawful basis

We process personal data to perform our contract with you (providing the Service), to comply with legal obligations (e.g. tax records), and on the basis of our legitimate interests in securing and improving the Service, consistent with the Data Protection Act 2017.

4. How we use the data

To operate accounts, enforce usage limits, process billing, maintain a security and audit trail, and provide support.

5. Retention

Tool-usage detail: ~30 days, then retained only in aggregate.
OAuth authorisation codes: ~1 hour.
Security audit log: ~2 years, then anonymised.
Payment/tax records: ~7 years (statutory accounting).
On account deletion, personal data is removed; audit references are de-identified.

6. Your rights

Subject to the Data Protection Act 2017, you may request access, rectification, erasure (deletion), and object to or restrict certain processing. Account deletion can be initiated from your account and cascades removal of personal data as described above.

7. Sharing and sub-processors

We share personal data only with infrastructure and payment sub-processors necessary to run the Service, under appropriate safeguards.

8. Personal data breach

In the event of a personal data breach we will notify the Data Protection Office and affected data subjects where required by the Data Protection Act 2017.

9. Governing law

This Notice is governed by the laws of the Republic of Mauritius.

10. Contact and complaints

Privacy enquiries: [email protected]. You may also lodge a complaint with the Data Protection Office of Mauritius.