Privacy, Terms, & Security.
Last updated · April 16, 2026
Note: This legal copy is a placeholder pending review by a licensed attorney. It must be approved before LexAlert enters any commercial agreement with a paying client.
Privacy Policy
1. Who we are
LexAlert Inc. (“LexAlert”, “we”, “our”) operates the LexAlert platform, a software-as-a-service that monitors public social media platforms (Reddit, X, Quora, Avvo Q&A, and others) for legal intent signals and assists law firms in drafting compliant outreach responses. This Privacy Policy explains how we collect, use, and protect information in connection with our services.
For questions, contact us at admin@lexalert.ai.
2. Information we collect
From law firm clients:
- Name, email address, and phone number of firm contacts
- Law firm name, size, and practice areas
- Billing information (processed by our payment processor — not stored by LexAlert)
- Source-platform credentials (Reddit, X, Quora, Avvo) encrypted at rest using AES-256; never logged
- Configured keywords, source targets, and system prompts
From platform operations:
- Public posts identified as matching your firm's criteria across every active source (publicly available content)
- AI-generated draft responses and your edits / approvals / rejections
- Audit logs: timestamps, action types, post identifiers
- Usage data: API calls, pipeline stage throughput, error rates
3. How we use your information
- To operate and maintain the LexAlert pipeline for your firm
- To deliver lead notifications to your designated Slack workspace and Signal Desk
- To generate AI-drafted responses using your firm's configured prompts
- To enforce compliance rules in the Gate stage
- To maintain immutable audit logs as required for professional accountability
- To diagnose and fix technical issues
- To communicate with you about your account and service updates
We do not sell your information to third parties. We do not use your client data to train AI models without explicit opt-in consent.
4. Data retention
Post data and draft responses are retained for 90 days after the pipeline processes them, then permanently deleted. Audit logs are retained for 24 months. Account data is retained until account termination plus 30 days.
5. Third-party services
We use the following third-party services to operate LexAlert:
- Anthropic API — AI classification and response drafting (Claude Haiku, Claude Sonnet)
- Reddit, X, Quora, Avvo APIs — Source monitoring via official integrations
- Slack — Lead delivery and approval workflow
- Supabase / PostgreSQL — Database and authentication (production)
Each service has its own privacy policy. We choose providers that meet appropriate security standards for B2B SaaS.
6. Security
Source credentials are encrypted at rest using AES-256 and never appear in logs, error messages, or API responses. We use HTTPS for all data in transit. Access to production systems is restricted to authorized personnel only. See the Security section below for details.
7. Your rights
You have the right to access, correct, or delete your personal information held by LexAlert. To exercise these rights, contact admin@lexalert.ai. We will respond within 30 days.
8. Changes to this policy
We will notify clients of material changes to this Privacy Policy by email at least 30 days before the change takes effect.
Terms of Service
1. Acceptance of terms
By accessing or using LexAlert, you agree to be bound by these Terms of Service. If you are accepting on behalf of a law firm or other legal entity, you represent that you have authority to bind that entity.
2. Description of service
LexAlert provides software that monitors public social media platforms (Reddit, X, Quora, Avvo Q&A, and additional sources we ship over time) for legal intent signals, generates AI-assisted draft responses, and delivers them to law firm users for review and optional dispatch. LexAlert is a drafting and monitoring tool. It does not practice law, provide legal advice, or act as legal counsel.
3. Attorney responsibility
You acknowledge and agree that:
- All content posted via LexAlert is posted by the attorney using their account on the source platform
- The attorney is the professional of record for all posted responses
- You are solely responsible for compliance with applicable bar rules, ethics rules, and advertising regulations in your jurisdiction
- LexAlert's compliance gate does not guarantee compliance with all applicable rules — it enforces a configurable subset of rules and is not a substitute for legal judgment
- Auto-post mode, if enabled, remains the attorney's responsibility
4. Acceptable use
You agree not to:
- Use LexAlert to post spam, misleading content, or content that violates the source platform's Terms of Service
- Use LexAlert to contact individuals who have explicitly opted out of attorney contact
- Attempt to reverse-engineer, copy, or resell the LexAlert platform
- Share your credentials with third parties outside your law firm
- Use LexAlert in ways that violate applicable law or bar rules
5. Intellectual property
LexAlert retains all intellectual property rights in the platform, pipeline architecture, and software. You retain ownership of your firm's system prompts, keywords, and any content you create. AI-generated draft responses are provided to you as a tool and are not claimed by LexAlert.
6. Limitation of liability
To the maximum extent permitted by law, LexAlert shall not be liable for any indirect, incidental, special, or consequential damages arising from your use of the service, including but not limited to bar complaints, client disputes, or regulatory actions arising from content posted using LexAlert. You use the service at your own professional risk.
7. Termination
Either party may terminate service with 30 days written notice. LexAlert may suspend service immediately for violations of these Terms or applicable law. Upon termination, your data will be deleted per the Privacy Policy retention schedule.
8. Governing law
These Terms are governed by the laws of the State of Delaware, without regard to its conflict of laws provisions. Disputes shall be resolved by binding arbitration in Delaware, except where prohibited by law.
9. Changes to terms
We will notify clients of material changes to these Terms by email at least 30 days before the change takes effect. Continued use after the effective date constitutes acceptance of the updated Terms.
10. Contact
For legal inquiries: admin@lexalert.ai.
Security
1. Credential storage
Per-source platform credentials (Reddit, X, Quora, Avvo) are encrypted at rest using AES-256 (Fernet). Encryption keys live in environment variables on Railway and Vercel and never appear in source control. Credentials are scoped per tenant and are never shared across firms.
2. Audit log immutability
Every approval, edit, decline, regenerate, escalation, and gate decision is appended to an immutable audit log with attorney email, timestamp, source, post ID, and (for edits) the diff. The log is append-only — no row is ever updated or deleted. CSV export is available on request.
3. Compliance gate
The compliance Gate is a deterministic Python rules engine, not an LLM. Its checks are line-for-line auditable. If a bar investigator asks why a particular post was sent, we can show them the rules that fired and the values that passed.
4. Access control
Production database access is restricted to a small set of authorized engineers via Railway and Supabase IAM. Supabase Row-Level Security (RLS) enforces tenant isolation at the DB layer in addition to application-layer query scoping.
5. Compliance posture
SOC 2 Type II is in progress. We will publish our completion status on this page when available. In the interim, we contractually agree to applicable security controls in customer DPAs.
6. Reporting issues
Suspect a security issue? Email admin@lexalert.ai. We respond to all reports within one business day.