Privacy Policy

THYNKR SYSTEMS LTD (company number 15306717, registered office Office 2, 1st Floor, 73 Station Passage, London E18 1JL, United Kingdom) is the controller for personal data processed through the LexSalim website, account administration, billing, support and security.

For Customer Content that an organisation places in its cases, the organisation is the controller and we act as its processor under the Data Processing Agreement. Individuals using a personal workspace are controllers of the third-party personal data they upload. Review: confirm the controller/processor allocation for individual (consumer) workspaces

Privacy questions and requests: [email protected] (subject line “Privacy”), or by post to the registered office. Review: decide whether a data protection officer or UK/EU representative is required

The website sets no analytics or advertising cookies and uses no tracking. Server logs record the request path, status, timing and a Cloudflare request identifier, without query strings or cookies, and are kept for a short period for security and operations. Cloudflare, which serves the site, processes connection data as described in its own notice.

If you use the contact form we process the details you give (name, email, organisation, enquiry type, message) to answer your enquiry. The message is delivered to our business mailbox by our transactional email provider. We ask you not to include case details or sensitive information in the form. The Lana help assistant on this website answers from published help articles in your browser; it does not record or transmit your conversation to us.

When the Service opens we process the following categories:

• Account data: name, email address, sign-in codes (stored hashed), authenticator settings, session and device information.
• Organisation data: organisation name, memberships, roles, invitations.
• Billing data: plan, subscription status, invoices and the payment processor’s customer reference. Card details are entered on the payment processor’s hosted page and never reach our servers.
• Usage and audit data: actions taken in a case (uploads, views, agent requests, approvals), timestamps and IP addresses for security.
• Customer Content: documents, notes, timelines and drafts placed in cases, which may contain personal data about third parties, including special-category data in legal or financial matters.
• Support data: messages you send us and our replies.

We do not make automated decisions with legal or similarly significant effects. Review: complete legitimate-interest assessments for security logging and support

When you request analysis, the relevant Customer Content is sent to AI model providers under contracts that prohibit using it to train their models and limit retention. Analysis runs only when requested, is limited to the case you are working in, and is recorded in the case audit trail. The providers in use, their locations and retention periods are listed in the sub-processor disclosure before any Customer Content is processed by them. Review: confirm provider contracts and data-residency options before launch

We share personal data only with sub-processors acting on our instructions (hosting, edge network, transactional email, payments, AI models), with professional advisers under confidentiality, and with courts, regulators or authorities where legally required. We do not sell personal data and do not share it for third-party advertising. Current and planned sub-processors are listed in the sub-processor disclosure.

The Service is hosted in the European Union. Our edge network and some sub-processors operate globally. Where personal data is transferred outside the United Kingdom or the European Economic Area we rely on adequacy regulations or decisions, the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses, with supplementary measures where needed. Review: list the transfer mechanism per sub-processor once contracts are in place

Review: confirm each period, especially audit (6 years) and backups, against professional-record expectations for legal and accounting customers

Under UK GDPR and the Data Protection Act 2018, and under the EU GDPR, you can ask for access, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent where consent is the basis. You can complain to the Information Commissioner’s Office (ico.org.uk) or to your local supervisory authority.

If you are a resident of California or another US state with a privacy law, you may have rights to know, delete, correct and opt out of sale or sharing; we do not sell or share personal data for cross-context advertising. If you are in Canada, PIPEDA or applicable provincial law gives you rights of access and correction and a right to complain to the Office of the Privacy Commissioner of Canada. Review: confirm CCPA/CPRA applicability thresholds, PIPEDA and Quebec Law 25 obligations (privacy officer, assessments, French-language notice) before selling in those markets

To exercise a right, email [email protected]. Where we act as processor we will refer your request to the organisation that controls the data.

Documents are encrypted in transit and at rest, access is granted per case, sign-in uses a one-time email code with optional authenticator app, uploads are scanned for malware, and processing is logged. Documents are not end-to-end encrypted: the Service decrypts them to process them. No certification is claimed. Details are in Security and Data Handling.

The Service is not directed at children and we do not knowingly collect personal data from anyone under 18. Customer Content may lawfully contain information about children in the context of a legal or financial matter; the controller is responsible for that content.

This draft will be replaced by an approved policy before paid plans or real customer data are accepted. Material changes will be notified to account holders by email or in the Service, and the version and effective date are shown at the top of this page.