Privacy Policy
Last Updated: 13 June 2026 · Version 2.0
1. Overview & Identity
LEXIVO is a legal intelligence operating system owned and operated by LEXIVO by LLM Advocates ("we", "us", "our").
As the **Data Fiduciary** (under the Digital Personal Data Protection Act, 2023) and **Data Controller** (under the EU General Data Protection Regulation), we are committed to protecting the privacy of Data Principals (users, visitors, and clients) who access our platform at lexivo.
2. DPDP Act 2023 & GDPR Compliance
This privacy policy is designed to satisfy the strict notice, separate purpose, and explicit consent requirements of:
- Section 5 and Section 6 of India's **Digital Personal Data Protection (DPDP) Act, 2023** and subsequent Rules.
- Articles 12, 13, and 14 of the **EU General Data Protection Regulation (GDPR)**.
We process all personal data strictly in a lawful, fair, transparent, and secure manner. If you do not agree with the terms of this policy, please do not use the Platform or provide any personal data.
3.1 Account Registration Details
When creating a LEXIVO account, we collect:
- Your email address (used for credential authentication and platform alerts).
- Display name or moniker (used for welcoming you in the console).
- Cryptographic bcrypt hash of your password (we never store plaintext passwords).
- Registration timestamp and consent indicators.
3.2 Legal Diagnostic Queries
When you submit a legal situation to the console, we process:
- The text of your query.
- The generated structured legal analysis report.
- The selected engine module and the AI processing model used.
- Estimated token consumption and query timestamp.
Warning on Sensitive Data: We strongly advise that you do not input sensitive personal identifiers (such as Aadhaar, PAN, bank account numbers, or real full names of third parties) in your queries. We utilize anonymization filters, but all query records are stored securely on our servers for audit purposes unless you decline Query History Consent.
3.3 Technical Data
We automatically log IP addresses, browser types, and session duration to prevent rate-limiting abuse, fraud, and security threats. We do not use persistent tracking, advertising, or cross-site analytics cookies.
4. Consent & Purpose Limitation
Under the DPDP Act 2023 and GDPR, we process personal data only when we have a valid lawful basis (explicit consent, contract fulfillment, or legal obligation). Our consent requests are:
- **Specific and Granular:** You can separately select which processing actions you permit (e.g., query logging, AI cloud processing, necessary session cookies).
- **Clear and Free:** Agreeing to cloud AI processing is not a condition for accessing the platform. If you decline, LEXIVO will seamlessly process your queries using our offline legal rule engine.
- **Revocable:** You can modify or withdraw your consent at any time via the Data Rights Portal.
5. How We Use Your Data
- Contractual Delivery: To generate and present Indian legal diagnostic reports matching your queries.
- Security Monitoring: To track daily query limits, prevent DDoS attacks, and enforce system quotas.
- Dashboard Integrity: To save your query history, allowing you to review past legal analyses.
- Grievance Processing: To address, investigate, and reply to your compliance requests or support complaints.
6. Data Storage & Security Measures
All data is housed in secure SQLite database storage configured on server-side architecture. We implement state-of-the-art protections:
- Password hashing using PHP's native
password_hash() function with the secure bcrypt algorithm.
- Strict administrative access controls requiring multi-factor admin verification.
- Transport Layer Security (HTTPS) to encrypt data in transit.
- Server-side security headers matching international guidelines to prevent XSS, clickjacking, and injection attacks.
7. Third-Party AI & Cross-Border Transfers
To provide advanced diagnostics, custom queries are transmitted to secure cloud AI model endpoints (including Anthropic, Google, and Groq). By consenting to AI processing, you permit transmitting query text to these providers. No personal identification data (like your email address) is sent to these endpoints. If you withdraw consent for AI processing, all your custom queries are routed strictly to our local, offline legal rules engine without any external transfers.
8. Your Rights as a Data Principal
You have full legal control over your personal data. You can exercise the following rights directly via our Data Rights Portal:
- Right to Access & Portability: View and instantly download a complete JSON file of all data associated with your profile and logs.
- Right to Rectification: Edit and update your name and password directly from your User Dashboard.
- Right to Erasure ("Right to be Forgotten"): Request complete deletion of your account and all associated query logs and contact messages.
- Right to Nominate: Nominate another individual to manage your legal rights in the event of death or incapacity.
- Right to Lodge Grievance: Formally submit a privacy complaint to our Grievance Officer.
9. Data Retention & Anonymization
We do not store personal data longer than necessary for the purposes of collection:
- **Query Logs:** Stored for a default period of 90 days. Upon reaching this threshold, our system executes automated daily anonymization, replacing query and response text with generic markers and permanently decoupling them from your user profile.
- **Guest IP tracking logs:** Deleted automatically after 7 days.
- **Consent Records:** Kept as an active ledger for compliance auditing, and marked inactive upon consent withdrawal.
For any privacy concerns, data corrections, erasure approvals, or to submit a formal complaint under DPDP Section 13, contact our officer:
We are legally mandated to address all grievances and requests within 30 days of submission.