Privacy Policy

Effective date: 28 September 2026
Last updated: 28 September 2026
Service: Lexdum
Website: lexdum.com
Privacy contact: [email protected]

This Privacy Policy explains how Lexdum (Lexdum, we, us, our) collects, uses, stores, discloses and otherwise processes personal data in connection with our websites, applications, AI-assisted legal research, document tools, subscriptions, workspaces and related services (together, the Service).

This Policy is intended to operate with applicable Indian privacy and information-technology law, including the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 to the extent and from the date relevant provisions apply.

1. Who is responsible for your data

Lexdum operates the Service from India and acts as the relevant data fiduciary or controller where it determines why and how personal data is processed. For an enterprise customer that instructs Lexdum how to process data, the parties may have separate data-processing terms.

Questions, rights requests and grievances can be sent to [email protected].

2. Personal data we collect

Depending on how you use Lexdum, we may collect:

Account information

Your name, email address, username, organisation, professional role, profile information, account identifiers and protected authentication information. Google Sign-In provides basic identity information such as your name, email address and Google account identifier when you choose that method.

Billing information

Billing name, address, GST details where provided, transaction identifiers, subscription, plan and payment status. Full card or banking credentials are ordinarily handled by Razorpay or another authorised payment provider rather than stored by Lexdum.

User Content

Prompts, conversations, legal documents, contracts, pleadings, case notes, uploaded files, images, extracted text, generated drafts, annotations, workspaces and search history. User Content may contain personal data about people other than the account holder. You must have lawful authority to provide it.

Google Drive data

If you separately connect Google Drive, we receive an OAuth authorisation limited to the read-only Drive scope. We may access:

  • your connected Google account name and email address;
  • file names, MIME types, sizes, modification dates and identifiers needed to display supported files;
  • the contents of a supported file only when you select it for import; and
  • an encrypted OAuth refresh token needed to maintain the connection.

Lexdum cannot edit, create or delete files in your Google Drive through this permission.

Technical and usage information

IP address, device and browser information, timestamps, authentication events, request metadata, crash information, security events, usage statistics and approximate location derived from technical information where necessary.

Cookies and local storage

We use essential cookies and browser storage for authentication, security, session continuity and preferences. We may use limited performance or analytics technologies where lawfully permitted. We do not currently use Google Drive data for advertising.

3. Sources of data

We receive data directly from you, your organisation or administrators; from integrations you enable; from Google or another authentication provider; from payment and service providers; from public legal sources; and automatically through operation of the Service.

4. Why we process data

We process personal data to:

  • create, authenticate and administer accounts;
  • provide conversations, legal research and requested AI-assisted features;
  • ingest, parse, store and retrieve documents selected by you;
  • connect to Google Drive and import files you select;
  • preserve workspaces and conversation history;
  • manage subscriptions, billing and customer support;
  • secure the Service, prevent fraud and investigate misuse;
  • debug failures, monitor reliability and improve product operation;
  • comply with law and respond to lawful requests;
  • resolve disputes and establish, exercise or defend legal claims; and
  • communicate material service, security and account information.

We do not use personal data for a materially incompatible purpose without an appropriate legal basis, notice or consent.

Where applicable law requires consent, we seek consent through the relevant product flow. You can decline optional integrations such as Google Drive without preventing ordinary Google Sign-In. Where processing relies on another legally recognised ground, we process data under that ground.

You can withdraw consent for Google Drive processing by disconnecting Google Drive in Lexdum settings. Withdrawal does not affect processing lawfully completed before disconnection.

6. Google API data and Limited Use

Lexdum's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Lexdum allows users to sign in with Google and, when explicitly connected by the user, import selected files from Google Drive for use in their legal workspace. We request per-file access through the drive.file scope and Google Picker. This permission can allow changes to selected files; Lexdum uses it only to read and import files you choose, and does not edit, delete, or browse the contents of your entire Drive. Google API data is used solely to provide these user-requested features. Lexdum does not use Google APIs or Google user data to generate, facilitate, or distribute AI-generated non-consensual intimate imagery (AI NCII).

For details about how Google user data is accessed, used, stored, and shared, see our Privacy Policy.

Google user data is used only to provide or improve user-facing features that are prominent in the Lexdum interface. Specifically:

  • Google Picker lets you choose which Drive files to share with Lexdum;
  • we download only the file you select;
  • we parse and store the imported copy in your Lexdum account so it can be used in your requested legal work; and
  • we maintain the minimum OAuth credentials necessary to keep the connection available.

We do not sell Google user data, use it for targeted advertising, use it to determine lending or creditworthiness, or use private Google Drive content to train a general-purpose AI model for unrelated users. We do not transfer Google user data except to infrastructure or processing providers necessary to deliver the requested feature, where required for security or legal compliance, as part of a corporate transaction subject to applicable safeguards, or with your affirmative consent.

Human access to Google user data is limited to situations where you have given affirmative permission for support, access is necessary for security or abuse investigation, access is required by law, or the data has been aggregated and anonymised for internal operations.

7. AI processing

A request may be processed by Lexdum infrastructure and by third-party AI or model providers used to produce the requested result. We apply contractual and technical controls appropriate to confidentiality, security, retention and permitted use. Private User Content is not used by Lexdum to train a general-purpose model for unrelated users unless you expressly opt in through a separate, clear mechanism.

AI processing can involve prompts, selected conversation context, relevant extracts from uploaded or imported documents and retrieved legal sources. We minimise the context sent to what is reasonably required for the requested feature.

Lexdum may retrieve and process publicly available judgments, legislation and other legal materials. Public availability does not automatically permit every reuse of associated personal information. We assess applicable privacy, copyright, database, court and contractual restrictions.

9. Sensitive and confidential information

User Content may include financial, identity, health, criminal-case, employment, children's, client or legally privileged information. Avoid submitting unnecessary sensitive information. If you upload another person's data, you are responsible for having an appropriate lawful basis and authority.

10. Children's data

Lexdum is not directed to children and does not knowingly seek children's personal data except where legally permitted and supported by required authorisation and safeguards. If you believe a child supplied data contrary to law, contact [email protected].

11. How we share data

We may provide limited access to personal data to cloud and database providers, document-processing services, AI/model providers, authentication providers, payment processors, email and support providers, security providers, professional advisers, auditors and other processors needed to operate the Service.

Providers receive only access reasonably necessary for their function and are expected to protect the data through appropriate contractual and technical safeguards. We may also disclose data to government or law-enforcement authorities where legally required.

We do not sell personal data or Google Drive data.

12. International processing

Some infrastructure or service providers may process data outside India. Where personal data is processed internationally, we apply applicable Indian requirements, contractual protections and any restrictions imposed on the relevant transfer.

13. Security

We maintain technical and organisational safeguards appropriate to the data and risk. Measures include encryption in transit, encryption at rest where appropriate, access controls, least privilege, protected credentials, audit logging, monitoring, secure development practices and incident-response procedures.

Google OAuth refresh tokens are encrypted before storage. The encryption key is held separately from the database. No internet service can guarantee absolute security.

14. Security incidents

We investigate suspected personal-data breaches and security incidents and make notifications required by applicable law, including applicable DPDP and CERT-In requirements. We may retain incident records and cooperate with competent authorities.

15. Retention

We retain personal data only as long as reasonably necessary for the disclosed purpose, operation of the Service, security, fraud prevention, legal compliance, accounting, disputes or legal claims.

In general:

  • account and workspace data is retained while the account remains active;
  • conversations and imported documents remain until deleted through available controls or account closure, subject to legal and technical retention;
  • a Google Drive refresh token remains until you disconnect the integration, close the account or the token becomes invalid;
  • transient Drive file listings are not retained as a permanent copy merely because they were displayed;
  • an imported Drive file and its parsed output are stored as User Content in Lexdum until deleted under the ordinary document controls;
  • billing and transaction records are retained for the period required by tax, accounting and legal obligations; and
  • security and access logs are retained for the period reasonably required for security and applicable cyber-incident obligations.

Data scheduled for deletion may persist temporarily in restricted backups until the backup lifecycle completes.

16. Deletion and disconnection

You can disconnect Google Drive from Lexdum settings. Disconnection deletes the stored Drive connection and attempts to revoke the Google token. It does not delete files from Google Drive. Imported copies already stored in Lexdum are separate User Content and can be deleted using the applicable Lexdum document controls.

You may request deletion of personal data by emailing [email protected]. Deletion may be limited by legal retention, unresolved disputes, security and fraud prevention, statutory records, evidentiary requirements and backup cycles.

You can also manage or revoke Lexdum's access from your Google Account permissions.

17. Your rights

Subject to applicable law and commencement of relevant DPDP provisions, you may have rights to information about processing, correction, updating, erasure, withdrawal of consent, grievance redressal, nomination and other rights provided by law.

Send a request to [email protected]. We may verify your identity and connection to the relevant account before acting on a request.

18. Grievances

Privacy complaints and rights requests may be submitted to:

Grievance Officer, Lexdum
Email: [email protected]
Location: India

We will receive, track, investigate and respond to grievances within applicable statutory timelines. Where law provides an escalation mechanism, we will make the relevant route available.

19. Your duties

You should provide accurate information, avoid impersonation, avoid fraudulent complaints, supply information needed to process a legitimate rights request and comply with applicable law. These duties do not restrict statutory privacy rights.

The Service links to third-party websites and legal sources. Lexdum is not responsible for their privacy practices. Review the relevant policy before submitting information to a third party.

21. Corporate transactions

Personal data may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets or business transfer, subject to applicable law, notice where required and appropriate safeguards.

22. Vulnerability reports

Security researchers may report vulnerabilities to [email protected]. Do not access, modify, exfiltrate or destroy personal data or systems beyond what is necessary to report a vulnerability safely.

23. Changes to this Policy

We may update this Policy for legal, product, processing, vendor or security changes. We will provide appropriate notice of material changes where required. The “Last updated” date identifies the current version.

24. Contact