1. Data Controller
Controller: Codelabs Studio, S.L. (Tax ID B88708797), owner of the Lexiel brand Registered office: Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain Registration details: Registro Mercantil de Málaga (Companies Registry of Málaga), sheet MA-198508, entry 1 Email: hola@lexiel.ai Website: https://lexiel.ai
2. Data We Collect
We collect the following categories of personal data:
- Registration data: name, email, password (hashed), firm name
- Usage data: queries made, documents uploaded, features used
- Technical data: IP address, browser type, operating system, cookies
- Billing data: processed directly by Stripe (we do not store card details)
- Professional data: bar association and bar number, and their verification against the public bar census
Data you do not give us yourself (Art. 14 GDPR)
If you are a lawyer and give us your bar association and bar number, we verify that you are a practising member using public sources: the census of the Consejo General de la Abogacía Española (Spanish General Council of Lawyers) and, where applicable, the census of your bar association. From those sources we obtain only name, bar association, bar number and status (practising or non-practising), as they appear in the census.
Uploaded Legal Documents
Documents you upload to Lexiel are processed exclusively to provide you the requested service. Your documents are NEVER used to train AI models. Documents are stored encrypted and automatically deleted according to your retention settings.
3. Processing Purposes
| Purpose | Legal Basis (GDPR) |
|---|---|
| Service provision | Art. 6.1.b - Contract performance |
| AI document analysis | Art. 6.1.b - Contract performance |
| Marketing communications | Art. 6.1.a - Consent |
| Service improvement (anonymized) | Art. 6.1.f - Legitimate interest |
| Verification of practising-lawyer status | Art. 6.1.f - Legitimate interest |
| Recording and analysis of the sessions of programme founders and product testers | Art. 6.1.b - Performance of the programme terms they accept |
| Screens used and errors of the person a founder invites to their team | Art. 6.1.f - Legitimate interest (they may object from Settings without losing access) |
| Legal compliance | Art. 6.1.c - Legal obligation |
Verification of practising-lawyer status. When you give us your bar association and bar number, we check in the public census of the Consejo General de la Abogacía Española and, where applicable, in your bar association's census, that you appear as a practising member with that name and number. We keep only name, bar association, number and status (practising or not) as they appear in the census. We never reject an application automatically: if something does not match, a person reviews it. You may object to this processing by writing to hola@lexiel.ai.
Session analysis in the Founders Programme. If you take part in the Founders Programme as a founder (free access in return for helping us improve Lexiel), or you are a product tester, we record your sessions in the app: a replay of the interface as you see it (not a video), with your screen size, device and browser, the screens you go through, where you click and the errors that appear. Other users are not recorded. The person you invite to your team is not recorded either: only the screens they use and the errors that appear are noted, technically, on the basis of our legitimate interest in the tool they use working properly (Art. 6.1.f GDPR); they are told when they first come in and may object at any time from Settings without losing access.
- What is not recorded: the content of your matters. What you type into text fields is masked in your browser before it is sent, and on-screen text is replaced with asterisks except the labels of Lexiel's own buttons and menus; images, documents and previews are replaced with an empty box. Passwords and payment data are never recorded.
- What is analysed: when each session ends, an automated process keeps a report with usage figures (duration, screens used, missions completed, feedback sent) and the technical faults you ran into (application errors, failed server responses, clicks that did nothing, elements that fall off the screen or are covered). When there is something to explain, an AI model writes a short summary from those figures, never from the screen content.
- Why: to find and fix faults, understand how Lexiel is used, and check the usage commitment set out in the programme terms. It is not used to train AI models, it is not shared with third parties and it is not used to assess your professional work.
- Feedback: if you send us feedback from the feedback tab, we link it to the stretch of your session in which you sent it, so we can see what was happening.
The basis is performance of the programme terms you accept (Art. 6.1.b GDPR), of which this analysis is the counterpart of the free access. Retention periods are in section 7.
4. Artificial Intelligence Processing
Lexiel uses AI models to analyze legal documents, search case law, and generate briefs. Here's what you should know:
- We don't train models with your data: Your documents and queries are never used to train or improve third-party AI models.
- EU processing: Our primary servers are located in the European Union.
- Automatic anonymization: We offer automatic anonymization of personal data in documents before processing.
- Human oversight: AI results are support tools and do not replace the professional judgment of a lawyer.
5. Sub-processors
| Provider | Function | Location |
|---|---|---|
| Hetzner Online GmbH | Infrastructure (dedicated server) | EU (Germany) |
| codelabs.studio | PostgreSQL database (VPS) | EU |
| Cloudflare | CDN, DDoS protection and storage of documents and session recordings (R2) | Global (data in EU) |
| Anthropic | AI model (Claude) | USA (with SCCs) |
| Google (Gemini API; Gemini Live for the assistant voice) | AI model, embedding generation and voice | USA (EU-US Data Privacy Framework and SCCs) |
| Groq | AI model and audio transcription | USA (with SCCs) |
| Cerebras | AI model (AgenteUno assistant chat) | USA (with SCCs) |
| OpenRouter | AI model routing (fallback provider) | USA (with SCCs) |
| Hume AI | Conversational voice for the mobile app assistant | USA (with SCCs) |
| Signaturit | Electronic signature of documents (briefs, contracts) | EU (Spain) |
| Stripe | Payment processing | USA (with SCCs) |
| Mailcow (mail.codelabs.studio) | Transactional email delivery (self-hosted SMTP, primary provider) | EU (Germany) |
| Resend | Transactional email delivery (fallback provider) | USA (with SCCs) |
| Google (Google Analytics 4) | Web analytics and campaign measurement, only if you accept cookies in the banner | USA (EU-US Data Privacy Framework) |
| PostHog | Product analytics, only if you accept cookies in the banner | EU (Germany) |
| Meta (Meta pixel) | Facebook and Instagram ad measurement, only if you accept cookies in the banner; Meta is joint controller of the collection | USA (EU-US Data Privacy Framework) |
| Plausible (self-hosted, analytics.codelabs.studio) | Aggregate visit statistics, cookieless | EU (Germany) |
6. International Transfers
When data is transferred outside the EEA (Anthropic, Google, Groq, Cerebras, OpenRouter, Hume AI, Stripe and Resend), Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) apply, ensuring a level of protection equivalent to the GDPR. Mailcow is not on this list because it is hosted in the EU (Germany): there is no transfer to a third country.
AI model providers are used interchangeably: any one of them may serve a given request depending on availability, so all are listed as sub-processors even though they do not each take part in every request.
Language model providers of the assistant and international transfers. The conversational assistant on this site runs on AgenteUno. Chat messages are processed by Cerebras Systems Inc. (United States) as data processor. In voice conversations, the audio and its transcript are processed by Google LLC (Gemini Live, United States). Google LLC is certified under the EU-US Data Privacy Framework (DPF), so that transfer relies on the European Commission adequacy decision, and its data processor terms also incorporate the standard contractual clauses. Cerebras Systems Inc. is not on the DPF list: the transfer to this provider relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) incorporated into its data processing agreement (DPA).
7. Data Retention
- Account data: While your account is active + 30 days after cancellation
- Uploaded documents: According to your settings (default: 90 days)
- Query history: 12 months from last query
- Billing data: 6 years (Spanish tax obligation)
- Technical logs: 90 days
- Bar membership verification (name, bar association, number and status as shown in the census): while you keep your account; deleted together with it
- Session recordings (founders and testers): 7 days from the session, or 12 months if attached to feedback or a rating you send us; then deleted
- Screens visited and errors in the Founders Programme (founders and their team members): 90 days
- Session reports (usage figures and technical faults, no screen content): while you keep your account, to follow your progress in the programme; deleted together with it
8. Your Rights (Arts. 15-22 GDPR + LOPDGDD)
You may exercise the following rights:
- Access (Art. 15): Obtain a copy of your personal data
- Rectification (Art. 16): Correct inaccurate data
- Erasure (Art. 17): Request deletion of your data
- Restriction (Art. 18): Restrict the processing of your data
- Portability (Art. 20): Receive your data in a structured format
- Objection (Art. 21): Object to the processing of your data
- Automated decisions (Art. 22): Not be subject to decisions based solely on automated processing
To exercise your rights, contact: hola@lexiel.ai
9. Minors
Lexiel is not intended for minors under 14 years old (pursuant to LOPDGDD Art. 7). We do not intentionally collect data from minors under this age.
10. Complaints
If you believe your rights have been violated, you may file a complaint with the Spanish Data Protection Agency (AEPD):
- Web: https://www.aepd.es
- Address: C/ Jorge Juan 6, 28001 Madrid
11. EU AI Act (Regulation 2024/1689)
Lexiel aligns with the European Artificial Intelligence Regulation:
- Classification: Limited risk AI system (professional assistance)
- Transparency: We clearly indicate that results are AI-generated
- Human oversight: The lawyer always maintains control and final decision
- Technical documentation: We maintain records of system operation