Privacy Policy for LexiAI
Effective Date: 29.10.2026
Welcome to LexiAI, accessible at https://lexiai.org. At LexiAI, our commitment is twofold: enhancing your access to legal information through cutting-edge technology and ensuring the utmost protection and transparency regarding your personal information.
1. Introduction
LexiAI is an independent legal-information technology project originally created for use in the United States and later expanded to cover additional jurisdictions. LexiAI uses OpenAI technology to provide AI-powered legal-information assistants covering multiple jurisdictions, including specialized assistants focused on the laws of particular countries. This Policy covers the LexiAI website and the assistants identified in Section 2.
Data controller and contact:
2. Scope
This Privacy Policy applies to lexiai.org, its contact and support channels, and each legal-information chatbot, GPT, plugin, or related assistant that expressly identifies this Policy as applicable to it. A covered assistant may use its own product name and need not be separately listed on lexiai.org.
This Policy covers only processing controlled by LexiAI. It does not replace the privacy notices of OpenAI, GoDaddy, Google, or another service that a user chooses to access..
3. LexiAI assistants, OpenAI and the LexiAI Legal Sources MCP service
Covered LexiAI assistants operate within OpenAI products. Certain assistants may connect to the LexiAI Legal Sources MCP service hosted through Cloudflare Workers.
When an MCP tool is used, OpenAI sends the tool name and the arguments selected for that tool to the MCP service. For the current law collection, these arguments may include a country code, short legal search terms, a document identifier, and pagination values. Users should not include names, contact details, identification numbers, confidential documents, privileged communications, or detailed personal case narratives in MCP search terms.
The service searches and retrieves material from its included legal-source collection. It does not certify that a provision is currently in force, complete, or applicable to a particular matter.
LexiAI has not configured an application database or persistent request-body archive for MCP requests. Cloudflare processes network requests and associated technical information necessary to deliver, secure, and troubleshoot the service. This may include IP address, date and time, request headers, requested endpoint, security events, and related diagnostic information. Provider-side operational and security records follow Cloudflare’s applicable settings, policies, and retention schedules.
The MCP service does not require a LexiAI account and does not set advertising cookies. LexiAI does not use MCP requests for targeted advertising, sell them, or use them to make automated decisions producing legal or similarly significant effects.
OpenAI separately processes conversations, account information, uploaded content, tool calls, and assistant responses under its own terms, privacy notices, workspace settings, and applicable law. Requests concerning information held by OpenAI should be submitted through OpenAI’s settings, support channels, or Privacy Portal.
4. Personal data processed by LexiAI
4.1 Website delivery and security
4.2 Website analytics
4.3 Contact and support
4.4 Bot and abuse prevention
4.5 Privacy and legal requests
4.6 Security incident records
5. Data Retention Information LexiAI asks users not to send
The website and support channels are not intended to collect sensitive legal files or restricted data. Do not send passwords, authentication codes, API keys, payment-card details, bank account credentials, government identification numbers, protected health information, unredacted court evidence, privileged communications, or confidential documents belonging to another person. Use a short, redacted description of the issue. The contact form should not be used for file attachments.
If unnecessary sensitive information is received, LexiAI may delete it without reviewing the substance, ask the sender to provide a redacted summary, or retain only what applicable law requires.
6. Purpose and legal grounds
6.1 Operate and secure the website
6.2 Respond to contact and support requests
6.3 Non-essential analytics
6.4 Prevent spam and abuse
6.5 Legal compliance and claims
Where Canadian privacy law requires consent, LexiAI seeks consent appropriate to the sensitivity of the information and the reasonable expectations of the person. Consent can be withdrawn subject to legal or practical restrictions and reasonable notice. LexiAI does not use website or support data for automated decisions that produce legal or similarly significant effects.
7. Your RightsCookies and tracking choices
Lexiai.org uses cookies and similar technologies that are necessary to deliver security, remember privacy choices, and support basic website functions. With the visitor's consent where required, GoDaddy Advanced Tracking may also be used to produce aggregate traffic and performance statistics.
The website cookie notice offers choices to accept or decline analytics tracking. Visitors may also use their browser controls to delete or block cookies. Blocking necessary technologies may affect website functions. LexiAI does not currently use Google Analytics, Meta Pixel, or targeted-advertising trackers and does not use website data for cross-context behavioural advertising.
8. Third-Party Links and ServicesDisclosures and service providers
LexiAI does not sell personal data, rent contact lists, or disclose personal data for targeted advertising. Personal data controlled by LexiAI may be disclosed only as reasonably necessary to these categories of recipients
· GoDaddy and its service providers for website hosting, contact delivery, security, cookie controls, and built-in analytics
· Google for email delivery and reCAPTCHA or related anti-abuse services
· Cloudflare and its service providers for hosting, delivery, security, abuse prevention, and operational troubleshooting of the LexiAI Legal Sources MCP service
· professional advisers, insurers, and technical specialists subject to appropriate duties
· courts, regulators, law-enforcement bodies, emergency services, or other parties when required or permitted by law or necessary to protect rights and safety
· a successor responsible for LexiAI if the project is reorganized or transferred, subject to applicable privacy requirements
OpenAI does not receive website contact data from LexiAI merely because a person uses the website. OpenAI separately processes data submitted to its own services under its policies and agreements.
9. International processing
Personal data may be processed in the United States, the European Economic Area, or other jurisdictions, depending on the service providers used and their processing arrangements. Information processed outside your country may be subject to the laws and lawful-access rules of the relevant jurisdiction.
For transfers of personal data controlled by LexiAI from the European Economic Area to a country without an adequacy decision, LexiAI relies on an available lawful transfer mechanism, such as approved standard contractual clauses, together with supplementary measures where appropriate. Information about applicable safeguards may be requested through the privacy contact. Where Canadian or Québec law applies, LexiAI uses contractual, organizational, or other measures appropriate to the sensitivity and circumstances and performs any legally required assessment before an international communication.
10. Retention and deletion
LexiAI keeps personal data only for the periods described in Section 4 or for the shortest longer period required by law, security needs, dispute resolution, or the establishment, exercise, or defence of legal claims. When information is no longer required, LexiAI deletes it, securely disposes of it, or irreversibly anonymizes it. Residual copies may remain temporarily in protected backups until overwritten through the provider's normal backup cycle.
LexiAI does not set or control the retention period for conversations stored in a user's OpenAI account. Users should use the data controls, deletion tools, Temporary Chat options, or privacy request channels made available by OpenAI or their workspace administrator.
11. Security
LexiAI applies safeguards appropriate to the amount and sensitivity of information under its control. Measures include data minimization, restricted account access, strong authentication where available, encrypted transport provided by service platforms, provider review, deletion routines, and incident assessment. No online service can guarantee absolute security.
12. Privacy rights
Depending on the law that applies, a person may request access, correction, deletion, restriction, portability, information about use and disclosure, withdrawal of consent, or objection to particular processing. A person may also challenge compliance and lodge a complaint with a competent supervisory authority. Rights are subject to legal conditions and exceptions.
Where applicable, rights include access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, withdrawal of consent at any time, and the right to complain to a supervisory authority. Withdrawal does not affect processing that was lawful before withdrawal. For processing handled by the operator in Bulgaria, the Bulgarian Commission for Personal Data Protection is a relevant supervisory authority. A person may also contact the authority in the country where they live or work or where an alleged infringement occurred.
Where applicable Canadian private-sector privacy law applies, individuals may request access to personal information under LexiAI's control, challenge its accuracy and completeness, withdraw consent subject to lawful restrictions, and challenge compliance with the person responsible for privacy matters. Québec residents may also have rights concerning computerized personal information, portability, cessation of dissemination, or de-indexation when the statutory conditions are met.
Residents of certain United States states and other jurisdictions may have additional rights where the relevant law applies, including rights to know, access, correct, delete, or obtain a copy of personal data and to opt out of certain sales, sharing, profiling, or targeted advertising. LexiAI does not sell personal data or share it for cross-context behavioural advertising and does not process website data for targeted advertising.
To make a request, email lexiaibot@gmail.com with the subject Privacy Request. LexiAI may request only the information reasonably necessary to verify identity and locate the relevant record. LexiAI will explain any lawful refusal or limitation and will not discriminate against a person for exercising a privacy right.
13 Children
LexiAI is not directed to children under 13 and does not knowingly collect their personal data through the website. A person must meet the minimum age and parental-permission requirements of the OpenAI service through which an assistant is used. A child or other person who cannot provide valid or meaningful consent should use LexiAI only with the involvement of a parent or legal guardian where required by law.
14 Security incidents and complaints
LexiAI assesses suspected privacy and security incidents and, where required, notifies the competent authority and affected individuals and maintains required records. Privacy concerns may be sent to lexiaibot@gmail.com with the subject Privacy Complaint. A person may also complain to the privacy or data-protection authority with jurisdiction.
15 Changes to this Policy
LexiAI may update this Policy when its services, providers, technologies, or legal obligations change. The current version and effective date will be published on lexiai.org. Material changes will be brought to users' attention through an appropriate notice or renewed choice where required.
16 Contact
· Privacy contact: LexiAI Privacy Contact
· For the identity and contact details of the data controller, see Section 1.
· Email: lexiaibot@gmail.com