Privacy Policy

1. Introduction

LexiFlow ("we", "our", or "us") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share information when you use our document generation platform ("Service"). This policy applies to all users of our website and Service.

2. Data We Collect

We collect the following types of information:

• Account Information: Name, email address, password (hashed), and profile details you provide during registration
• Content Data: Document templates, variables, data source configurations, generated documents, and workflow definitions you create within the Service
• Usage Data: Log data, IP addresses, browser type, device information, pages visited, features used, and timestamps of interactions
• Payment Data: Billing address and payment method details are processed securely by our payment provider (Paddle) — we do not store full credit card numbers
• Communication Data: Support tickets, feedback, and communications you send to us

3. How We Use Your Data

We use the collected information to:

• Provide, operate, and maintain the Service
• Process transactions and manage your subscription
• Send service-related notices, updates, and security alerts
• Improve and personalize the Service based on usage patterns
• Respond to your requests, comments, and support inquiries
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our Terms of Service

4. Cookies and Tracking

We use cookies and similar tracking technologies to operate and improve the Service. For detailed information about the cookies we use, please see our Cookie Policy.

5. Third-Party Services

We share data with the following third-party services, each governed by their own privacy policies:

• Paddle: Payment processing — receives billing and payment information to process transactions securely. Paddle acts as Merchant of Record and handles VAT/tax compliance
• Analytics Providers: We may use services such as Google Analytics or similar tools to understand how users interact with the Service. Optional Google Analytics is enabled after an explicit analytics choice. Product events exclude document contents, CSV contents and account identity; technical logs are separate
• Hosting Infrastructure: Our servers and cloud infrastructure providers process your data to deliver the Service
• OpenAI (optional AI tools): Content involved in an AI action may be sent to OpenAI for that action. Ordinary template-variable replacement does not require an AI request

We do not sell your personal data to third parties.

6. Data Retention

We retain data needed to provide the Service while your account is active and may retain records where required for legal, tax or compliance purposes. Account and document records use soft deletion; file cleanup is separate. A deletion action does not establish immediate removal from every file or backup. Contact support for erasure requests and confirmation of the applicable file and backup retention periods.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. The public service uses HTTPS (TLS), account authentication and resource access controls. Documents are processed on the server. Application code does not establish encryption at rest or a regular external security-audit programme; contact us for infrastructure details. However, no method of transmission over the Internet or electronic storage is 100% secure.

8. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Request restriction of processing of your personal data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data for certain purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. Where we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this page periodically for the latest information on our privacy practices.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

LexiFlow — Data Protection
Email: [email protected]