1. Who we are
LexSpeakAI® is a trading name of LexTalkAI Intelligence Ltd, registered in England and Wales.
- Company number: 17024893
- Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
- Website: lexspeakai.com
- Data controller contact: privacy@lexspeakai.com
LexTalkAI Intelligence Ltd is the data controller for all personal data collected through LexSpeakAI® services. We are a technology service provider, not a law firm. We are not regulated by the Solicitors Regulation Authority.
2. What this policy covers
This privacy policy explains what personal data we collect and why, how we use and protect it, who we share it with, how long we keep it, your rights under UK GDPR and the Data Protection Act 2018, and how to contact us.
This policy applies to all users of LexSpeakAI® services including our website, voice AI service (LexSpeak Voice™), document services, and all related products.
3. What data we collect
3.1 Data you provide directly
- Identity data: Your first name and last name
- Contact data: Email address
- Matter data: Details of your legal situation as you describe it to Lex, whether you speak or type — this may include employment details, tenancy information, dispute facts, and other personal circumstances
- Document data: Any documents you upload to our platform for organisation, which may contain personal, financial, or sensitive information
- Communication data: Transcripts of your conversations with Lex, spoken or typed. When you speak, your words are converted to text by our voice providers, and the text transcript is what we keep.
- Payment data: Payment card details and transaction information, processed by our payment processor Stripe. We do not store full card details.
3.2 Data we collect automatically
- Technical data: IP address, browser type, device type, operating system
- Usage data: Pages visited, time spent, referring URL
- Call activity data: Linked to your Case ID: the stages your conversation reached, the type of legal matter you raised (for example "tenancy deposit" or "wills and probate"), whether it fell within the areas we cover, and how you arrived at our website (the source and landing page)
We do not currently use cookies for tracking or analytics beyond those strictly necessary for the website to function.
When you start a conversation with Lex, our chat provider (Voiceflow) saves a small identifier in your browser's local storage so the conversation can work. Nothing is saved before you open the chat. We load fonts from Google Fonts, which means your browser shares your IP address with Google when the page loads.
3.3 Special category data
Some information you share during a legal triage may constitute special category data under UK GDPR (for example, health information), or information about criminal offences or proceedings. Other details, such as immigration status, are not special category data in law, but we protect them in the same way. We only process this where you have explicitly provided it as part of describing your legal matter, and only to the extent necessary to provide the service requested. Enhanced security measures apply.
Our legal conditions for this processing are: for special category data, that it is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR); and for information about criminal offences or proceedings, the legal claims condition in Schedule 1, Part 3, paragraph 33 of the Data Protection Act 2018. We do not use this information for any purpose other than providing the service you asked for. Where a conversation involves a possible criminal matter or a risk to someone's safety, we do not record its type in our call activity data.
4. How we use your data
| Purpose | Legal basis |
|---|---|
| Providing the LexSpeakAI® service — triage calls, document drafting, evidence organisation | Performance of contract (Article 6(1)(b) UK GDPR) |
| Generating and delivering your Case ID, triage transcript, and case summary | Performance of contract |
| Processing payments for paid services | Performance of contract |
| Sending documents and service communications by email | Performance of contract |
| Maintaining records of your matters for continuity of service | Legitimate interests — enabling you to reference prior matters |
| Complying with legal and regulatory obligations | Legal obligation (Article 6(1)(c)) |
| Sorting each conversation by type of legal matter, so we can give you the right information or point you to the right organisation | Performance of contract |
| Recording call activity data (section 3.2) to understand which legal problems people bring to us, which areas to cover next, and how people find our service | Legitimate interests — running and developing the service. We record the type of matter and the stages reached, not what you said |
| Using insights from the content of your conversation to improve LexSpeakAI® for others | Consent (Article 6(1)(a)) — Lex asks you at the end of a full conversation. If you are not asked, or say no, your conversation content is not used for this |
| Responding to your queries and complaints | Legitimate interests |
We will never sell your personal data to third parties. We will never use your data for advertising purposes.
5. Who we share your data with
5.1 Technology service providers
| Provider | Purpose | Location |
|---|---|---|
| Voiceflow | Conversational AI platform — powers Lex's conversation logic | Canada (adequacy decision applies) |
| Anthropic | Large language model API — powers Lex's intelligence | USA (UK transfer safeguards apply — see section 8) |
| Make.com | Workflow automation — transcript and email delivery | EU (GDPR compliant) |
| Stripe | Payment processing | USA/EU (UK Addendum to Standard Contractual Clauses / UK-US Data Bridge applies) |
| Supabase | Secure database and document storage — holds your case records and uploaded documents | UK (London region — UK GDPR applies) |
| PDF.co | Document generation — converts your transcript into a PDF | USA (UK transfer safeguards apply — see section 8) |
| ElevenLabs | Voice synthesis — generates Lex's spoken voice | USA (UK transfer safeguards apply — see section 8) |
| Krystal | Website hosting and email infrastructure | UK (UK GDPR applies) |
| Workspace email and data storage | USA/EU (UK transfer safeguards apply — see section 8) |
5.2 Legal requirements
We do not share your information with the police or anyone else voluntarily. We disclose it only where a court order or the law requires us to, or where someone's life is at immediate risk.
6. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Call transcripts and case summaries | 24 months from date of call | Enables reference during ongoing proceedings |
| Documents uploaded or produced | 90 days from delivery of your purchased product (or from upload where no purchase follows) | Minimises how long your most sensitive material is held |
| Identity and contact data | 24 months from last interaction | Service continuity |
| Call activity data | 24 months from date of call | Lets us compare demand over time; after that, only counts that cannot identify anyone are kept |
| Payment records | 7 years | HMRC legal requirement |
| Following deletion request | 30 days then permanently purged | Allows reversal of accidental deletion |
7. How we protect your data
- Encryption in transit: TLS 1.2 or higher on all data transmission
- Encryption at rest: AES-256 encryption on stored data
- Access controls: Personal data restricted to authorised personnel on a need-to-know basis
- PCI-DSS compliance: Payment data handled exclusively by Stripe — we never store full card details
- Regular security reviews: We review and update our security practices regularly
In the event of a personal data breach posing risk to your rights, we will notify the ICO within 72 hours and affected individuals without undue delay.
Legal professional privilege: Lex is not a lawyer, so what you tell LexSpeakAI® is not protected by legal professional privilege. We keep it confidential and secure as described above, but in some disputes the other side or a court could ask for it to be disclosed as evidence.
8. International data transfers
Some of our technology providers are located outside the UK. Where we transfer data internationally, we ensure appropriate safeguards recognised under UK law are in place — UK adequacy regulations (including the UK-US Data Bridge for certified US providers), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as applicable to each provider. Contact privacy@lexspeakai.com for details of specific safeguards.
9. Your rights under UK GDPR
- Right of access — Request a copy of the personal data we hold about you, free of charge. We respond within one month.
- Right to rectification — Ask us to correct inaccurate or incomplete data.
- Right to erasure — Ask us to delete your personal data, subject to legal retention requirements.
- Right to restrict processing — Ask us to stop processing your data in certain circumstances.
- Right to data portability — Request your data in a structured, machine-readable format.
- Right to object — Object to processing based on legitimate interests.
- Rights relating to automated decisions — LexSpeakAI® uses AI to generate outputs, and automated tools to sort each conversation by type of legal matter. Sorting decides which information or organisation we point you to; it is not a decision about you with legal or similarly significant effects. Our outputs are informational only. Human review is always available — contact privacy@lexspeakai.com.
To exercise any right: privacy@lexspeakai.com or by post to our registered address. We respond within one month (extendable by up to two further months for complex requests, in which case we will tell you why within the first month) and may ask you to verify your identity.
To complain to the regulator: Information Commissioner's Office — ico.org.uk — 0303 123 1113
10. Children's data
Our services are not directed at children under 18. We do not knowingly collect data from children. Contact privacy@lexspeakai.com if you believe a child has provided us with personal data.
11. Changes to this policy
We may update this policy from time to time. We will update the effective date, notify users of material changes by email where we hold your address, and post the updated policy on our website.
12. Contact us
LexTalkAI Intelligence Ltd — Data Controller
71-75 Shelton Street, Covent Garden, London WC2H 9JQ
Email: privacy@lexspeakai.com
Website: lexspeakai.com