Privacy Policy
Effective date: October 14, 2026 · Last updated: October 14, 2026
This is a previous version of our Privacy Policy. It was in effect from October 14, 2026 to October 24, 2026.
1. Introduction
LexQ, LLC ("Company", "we", "us"), a Delaware limited liability company, is committed to protecting the privacy of our customers. This Privacy Policy describes how we collect, use, store, and disclose information when you use the Decision Operations Platform ("Service") at lexq.io, console.lexq.io, api.lexq.io, mcp.lexq.io, and docs.lexq.io. We collect personal information directly from users in every country where the Service is used and process it in the United States. Our mailing address is 2810 N Church St, STE 90966, Wilmington, DE 19802, USA.
2. Information We Collect
2.1 Account Information
When you create an account with an email address, we collect your name, email address, and password (stored as a cryptographic hash). If you sign up or sign in with Google, we receive your name, email address, and language setting from Google instead of a password. When you sign up, your browser also reports its time zone, country, and language, which we use to set up your organization. An administrator who invites you to an organization may add your phone number. This information is required to provide the Service and communicate with you.
2.2 Customer Data
In the course of using the Service, you may submit rule definitions, rule configurations, execution input data (facts), simulation parameters, and deployment configurations ("Customer Data"). We process Customer Data solely to provide the Service.
2.3 Usage and Log Data
We automatically collect: rule execution logs and traces, simulation results, API call metadata (timestamps, response codes, latency), IP addresses, browser type and version, and pages visited within the Service. Execution logs are retained according to your subscription plan (Free: 30-day hot retention; Growth: 180-day hot retention; Pro: 365-day hot retention plus 365-day cold archive, restorable on request; Enterprise: custom retention).
2.4 Billing Information
To issue invoices, we collect the billing profile you enter in the console: the email address that receives invoices, address line 1, city, postal code, and country code, plus, if you provide them, address line 2, state or province, company name, tax ID, and the name of your company's representative. Payment processing is handled by Stripe. We do not store credit card numbers or full payment details on our servers; Stripe's privacy policy governs the handling of payment information.
2.5 Website Analytics
We use PostHog (PostHog Inc., hosted on its US Cloud) to understand how our marketing site, lexq.io, is used. It collects page views and interaction events on lexq.io. These are not linked to your account and carry no identifier that persists beyond the tab, so we cannot tell one visit from another. For this analytics project PostHog does not store your IP address, and we have turned off the enrichment that would infer your location from it, so no country, city or coordinates are recorded. The console (console.lexq.io) sends no data to PostHog, and we do not record sessions. Analytics data is transmitted through our own domain and processed by PostHog on our behalf.
2.6 Inquiries
When you contact us by email or through the form at lexq.io/founder, we collect your email address and the content of your message. We use them only to respond to you.
3. How We Use Your Information
We use the information we collect to: provide, operate, and maintain the Service; process transactions and send billing-related communications; monitor usage for plan enforcement and overage calculations; detect and prevent fraud, abuse, and security incidents; send service-related notices (maintenance, security alerts, plan changes); respond to your inquiries; improve the Service based on aggregated, anonymized usage patterns; and comply with legal obligations. We do not sell your personal information to third parties. We do not use Customer Data for advertising or marketing purposes.
4. Data Storage and Security
Customer Data is stored on Amazon Web Services (AWS) infrastructure located in the United States. Our security measures include: written policies for access control, key management, incident response, and disaster recovery; encryption in transit (TLS 1.2+) and at rest (AES-256); isolated tenant environments (multi-tenant architecture with logical data separation); API key authentication with cryptographic hashing; and role-based access controls. Our servers run in AWS data centers, which control physical access; we do not operate server rooms of our own. While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. LexQ does not store, process, or transmit cardholder data; all payment processing is handled by Stripe (PCI-DSS Level 1 certified). LexQ has not undergone PCI-DSS, SOC 2, SOX, or HIPAA audits at this time.
5. Data Sharing and Disclosure
5.1 Service Providers
We share information with third-party service providers who process it on our behalf to operate the Service: Amazon Web Services, Inc. for cloud infrastructure, data hosting, and transactional email (Amazon SES); Stripe, LLC for payment processing; PostHog Inc. for website analytics on lexq.io; Google LLC for our business email (Google Workspace), which receives the messages you send us; Vercel Inc. for hosting lexq.io and measuring its web performance; and Mintlify, Inc. for hosting docs.lexq.io. These providers are contractually obligated to protect your data and use it only for the purposes we specify. We do not provide your personal information to any other third party except as described in Sections 5.2 and 5.3.
5.2 Legal Requirements
We may disclose your information if required to do so by law, regulation, legal process, or governmental request. We will notify you of such disclosure unless prohibited by law.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership.
6. Data Retention
Account information is retained for as long as your account is active. Customer Data (rule definitions, rules) is retained while your account is active and for 30 days after account termination. Execution logs are retained according to your plan tier: Free: 30-day hot retention; Growth: 180-day hot retention; Pro: 365-day hot retention plus 365-day cold archive (restorable on request); Enterprise: custom retention. Billing records are retained for 7 years as required by applicable tax laws. Upon account deletion, we permanently remove your personal data within 30 days, except where retention is required by law; copies in backups are removed within a further 7 days. We delete inquiries once we have finished handling them, except that records of consumer complaints and disputes are kept for 3 years. Analytics data is retained by PostHog for up to 1 year.
7. Your Rights
7.1 General Rights
You have the right to: access the personal information we hold about you; correct inaccurate or incomplete information; export your Customer Data through the console or API; delete your account and associated data; and opt out of non-essential communications. To exercise these rights, email hello@lexq.io. You may also act through an authorized representative.
7.2 California Residents
We do not sell or share personal information, as the California Consumer Privacy Act (CCPA) defines those terms, and we do not use sensitive personal information to infer characteristics about you. California residents may exercise the rights in Section 7.1 whether or not the CCPA applies to their request, and we will not treat you differently for exercising them.
7.3 EEA/UK Residents (GDPR)
If you are located in the European Economic Area or United Kingdom, you have additional rights under GDPR: the right to data portability; the right to restrict processing; the right to object to processing; the right to withdraw consent; and the right to lodge a complaint with a supervisory authority. Our legal basis for processing personal data is: contract performance (to provide the Service), legitimate interests (to improve the Service and ensure security), and legal compliance (to meet regulatory obligations).
8. Cookies and Tracking
8.1 Cookies We Set
We use essential cookies for authentication and session management. We do not use analytics cookies: PostHog keeps its identifier in memory only, so it is gone when you close the tab and we cannot recognize you on a later visit. Analytics requests are served through our own domain. We do not place advertising cookies or tracking pixels on our sites, and we do not track your activity on other websites.
8.2 Content from Other Companies
The demo videos on the lexq.io home page are embedded from YouTube (Google LLC) in privacy-enhanced mode. Opening that page does not connect your browser to YouTube's servers: Vercel, which hosts lexq.io, fetches the video thumbnails and serves them from lexq.io. When you play a video, YouTube loads its player and may set cookies or use similar technologies. The console loads Google's sign-in script to offer Sign in with Google. Through these, Google may collect information about your online activities over time and across different websites under its own privacy policy.
8.3 Your Choices
You can block or delete cookies in your browser settings (for example, Chrome: Settings > Privacy and security > Third-party cookies; Edge: Settings > Cookies and site permissions; Safari: Settings > Privacy). If you block essential cookies, you may not be able to sign in to the console. If your browser sends a Do Not Track or Global Privacy Control signal, lexq.io does not collect analytics from your visit, and refusing analytics does not affect your use of the Service. We do not collect information about your activities on third-party websites ourselves.
9. International Data Transfers
We are based in the United States and process your personal information there. Our servers and service providers are also located in the United States: Amazon Web Services, Inc. (cloud infrastructure, data hosting, and transactional email), Stripe, LLC (payment processing), PostHog Inc. (website analytics), Google LLC (business email), Vercel Inc. (hosting for lexq.io and web performance measurement), and Mintlify, Inc. (hosting for docs.lexq.io). Each receives only the categories described in Section 2. We implement appropriate safeguards for international transfers as required by applicable law. You may object by writing to hello@lexq.io, and you can refuse website analytics as described in Section 8.3.
10. Children's Privacy
The Service is built for business use and is not directed to children. We do not accept sign-ups from, or knowingly collect personal information from, children under 13, or anyone below the minimum age set by the law of their country. If we learn that we have collected such information, we delete it, together with the account, without delay.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before they take effect. If a change requires your consent under applicable law, we will ask for it before applying the change to you. The effective date at the top of this page shows when this version took effect, and any version this one replaces is published at lexq.io/en/privacy/archive.
12. Contact Us
For privacy-related questions or to exercise your rights, contact us at hello@lexq.io, or write to LexQ, LLC, 2810 N Church St, STE 90966, Wilmington, DE 19802, USA.