01Data processed
LexForge processes account details, workspace settings, uploaded house-style templates, source documents, generated outputs, wording-check results, usage records, browser error reports, product analytics, support messages and billing records.
To stop the same person claiming the free trial twice, LexForge keeps a pseudonymous personal data marker. It is a one-way hash (a scrambled code that cannot be turned back into the original details) made from your sign-in account ID, stored alongside your internal workspace reference and the time the trial was claimed. It contains no raw Clerk ID, email, name, organisation ID or document data. It is kept after your workspace is deleted, with no automatic time limit, to enforce the one-trial-per-signed-user rule; it is not used for other purposes.
02Document content
Document content is customer confidential data. Wording-check summaries avoid storing full document text by default. Generated documents and uploaded files are retained only for the period needed to provide the service and support customer review.
During house-style setup, LexForge reads the supplied reference document to learn its formatting and structure. Reference material is handled under the same processing and retention safeguards.
Learning a house style means building a per-firm style profile from your reference documents; it does not train any AI model.
AI can reconstruct structure and wording from page images. Wording must be corroborated by an independent reading of the source or confirmed by a person against the page image. Unresolved wording is held for review.
03Sub-processors
Sub-processors include Microsoft Azure for hosting, storage, database, Document Intelligence optical character recognition (OCR) and transactional email in the UK. Structure, layout and wording reconstruction, and the independent second reading for the wording check, run through the Azure OpenAI EU Data Zone within the EEA. LexForge also uses Clerk for sign-in and user accounts, Stripe for billing, Sentry for essential browser error monitoring and PostHog for optional cookieless product analytics. Only PostHog requires you to accept optional analytics in the cookie banner.
Azure OpenAI receives relevant full-page images and extracted text for structure, layout and wording reconstruction in the EU Data Zone. Azure OpenAI is also used to read page images and transcribe them as an independent second reading that the wording check compares against. Both readings use requests with storage switched off (the store=false setting) on the same EU Data Zone resource, so the normal Responses API conversation state is not retained. Customer material is not used to train generative models. Microsoft performs automated abuse monitoring. Material flagged by the abuse-monitoring system, or identified as part of a potentially abusive pattern of use, may be stored in a Microsoft-controlled abuse-monitoring store and reviewed by authorised Microsoft staff. Document storage and OCR remain in UK South. See the full list on the security page.
04Monitoring and analytics
Browser error monitoring and product analytics are limited to usage and error details, such as which product area was used and whether a reconstruction succeeded or failed. Sentry provides essential browser error monitoring on product pages without asking for optional analytics consent. It does not store cookies or other persistent data on your device. Product analytics (PostHog) only start if you choose "Accept optional" in the cookie banner, and stop if you later reject them. They must not include document text, filenames, extracted wording, email addresses, names, job IDs or tenant IDs.
Server operational and security logs contain pseudonymous job and account references and usage and cost counts, with no document text. They are kept for 90 days in Azure UK South.
05Customer control
Customers can export generated outputs, request workspace deletion and request deletion of stored files. Contact support@lexforge.app for help.
Uploaded scans are scheduled for automatic deletion from active storage two hours after upload. Standard extracted-text cache entries are scheduled for deletion after two hours. If application cleanup is delayed, Azure Storage lifecycle rules make both eligible for deletion once they are more than one day old. Microsoft controls the exact lifecycle processing time. Deleted blobs may remain recoverable to authorised administrators for up to seven days under Azure soft delete. Converted outputs are kept for your workspace's retention period, from one to 30 days, seven by default. Reconstruction reports, and the saved OCR reading and comparison behind them, follow the same expiry as the corresponding output. They may include document wording and are protected by the same workspace access checks. See the security page.
Uploaded scans are scheduled for deletion well before outputs.
When a document is reviewed, short review notes, correction notes, "expected versus found" snippets and flagged-word snippets are stored in the database until the output expires. These can contain document wording. Our database backups support point-in-time recovery for 14 days, so these details can remain in backups for up to 14 days after deletion.
During rendering, temporary copies are written to the conversion worker's own disk and deleted when the rendering step finishes. If a crash leaves copies behind, background cleanup retries deletion once they are old enough, while the worker is running.
Workspace deletion has a 30-day grace period before erasure. Afterwards, a closure record with no document content and the free-trial marker remain. The marker prevents the same sign-in account from claiming another free trial and has no automatic time limit. Deleted database records can remain in backups for up to 14 days; deleted files can remain recoverable for up to seven days under Azure soft delete. Clerk and Stripe keep their own records under their own policies.
06Why we use personal data
LexForge Ltd is the controller of account and service data: we decide how and why we use it. We rely on contract to provide the service to account holders and paying customers. We rely on legitimate interests to protect and maintain the service through security, fraud prevention, error monitoring and service logs. We rely on consent for optional product analytics.
For personal data in documents customers upload, LexForge acts as a processor on the customer's instructions. Your firm decides why that data is processed and is responsible for its lawful basis. This is also explained in our terms.
07Your data protection rights
Depending on the circumstances, you can ask for access to your personal data, rectification of inaccurate data, erasure of data, restriction of its use, or portability (a reusable copy). You also have a right of objection to processing based on legitimate interests. These rights are subject to the conditions and exceptions in data protection law.
You can withdraw consent for optional analytics at any time. Select "Cookie settings" in the footer of this website, or at the bottom of the side menu in your workspace, then choose "Reject optional". Contact support if you need help. This does not affect processing carried out before you withdrew consent.
To exercise your rights, email support@lexforge.app. For personal data in a customer's document, contact the firm that supplied it; we help that firm respond on its instructions. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.
08International processing
Document storage, the database and Document Intelligence OCR are in Azure UK South. Azure OpenAI processing takes place in the Azure OpenAI EU Data Zone within the EEA. Sentry and PostHog receive browser monitoring and analytics data through EU endpoints. These EU services involve processing outside the UK.
Privacy questions can be sent to support@lexforge.app.