Who we are
LexiSync is legal practice software for law firms, made by LexiSync.ai, LLC, a Rhode Island limited liability company (“LexiSync,” “we”). Contact: david.segala@lexisync.ai, P.O. Box 1106, Bristol, Rhode Island 02809.
The short version
- Law firms use LexiSync to run their matters. The firm owns what it puts in. We process it on the firm’s instructions under a written service agreement, a data protection agreement and, where the data includes protected health information, a business associate agreement.
- We do not sell personal information. We do not use firm or client data to advertise, to train AI models, or for any purpose other than providing the service, and we keep no de-identified or derived copy of it for our own use.
- When a person connects an outside account (a Google or Microsoft calendar, QuickBooks Online, LawPay), we take only what that connection needs, we say exactly what that is below, and disconnecting removes it.
What we collect, and from whom
From law firms and their staff (our customers). Account details (name, work email, role, sign-in and two-factor records), the matter and client information the firm enters or uploads, billing and payment records the firm creates, and activity logs inside the product (which page, which action, when). Never keystrokes, never the screen, and never anything outside LexiSync.
From a firm’s clients (through the client portal). The information a client enters when the firm invites them: contact details, forms and questionnaires they complete, documents they upload, and signatures. Clients sign in with a one-time code or link sent to their email, not with a password.
From visitors to this website. This website is a set of static pages hosted on Cloudflare, which handles each request and processes standard request details (IP address, browser, the page asked for) as our host. The pages load their fonts from Google Fonts, so Google also receives your IP address and browser details when a page loads. We set no cookies on this website and use no analytics or advertising trackers. If you email us, for example to ask for a demo, we keep your message and address so we can reply.
How we use it
To provide the service the firm signed up for: storing and organizing matters, generating documents, keeping time and billing, sending the notifications the firm turns on, and the AI features the firm uses. Those AI features run on Amazon Bedrock inside LexiSync’s own Amazon Web Services account, under Amazon’s business associate agreement. Data is not sent to an AI company’s own service, and Bedrock does not keep prompts or use them to train models. We also use data to keep the service secure and to meet our legal obligations. For nothing else.
Where it lives and how it is protected
Data is stored in the United States, in LexiSync’s own Amazon Web Services accounts. It is encrypted in transit and at rest. Each firm’s documents and its health-information fields are encrypted a second time with a key specific to that firm, and the database keeps each firm’s records separate from every other firm’s. Inside LexiSync, access is limited to the firm that owns the data. Our own staff access is limited to support and operations, requires two-factor authentication, and is logged.
Connected accounts: what each integration reads and writes
A firm, or a person at a firm, can connect outside accounts. Each connection is optional, is made by the account holder on a consent screen run by that provider, and can be removed at any time from inside LexiSync.
Google Calendar
A staff member can connect their own Google account so that their LexiSync calendar and their Google Calendar stop being two separate places. The connection works in two directions, and each item flows one way only:
- Your events, shown in LexiSync. LexiSync asks Google for permission to read your
calendars (
calendar.readonly). At connection you choose which of your calendars to include; your main calendar is selected by default. LexiSync reads the events on those calendars, their times, titles and whether they mark you busy, and shows them on your LexiSync calendar so you can see your whole day in one place. These events are shown only to you, never to anyone else at your firm, are never attached to a matter, and LexiSync never changes or deletes them. LexiSync keeps a copy of them for the calendar window it shows (about a month back and a year ahead), refreshed regularly, so that your calendar and its assistant can answer without contacting Google each time. - LexiSync dates, shown in Google Calendar. LexiSync also asks for permission to
create and manage calendars that LexiSync itself creates (
calendar.app.created). On connecting, LexiSync creates one calendar named “LexiSync” in your account and writes your LexiSync dates to it, so your phone reminds you. Each entry carries only a matter number and the kind of date (for example, “M-2026-0042 — hearing”), its time, and a link back into LexiSync; never a client name, a title, a note or a document.
Because each item flows one way, moving a LexiSync date inside Google Calendar does not move it in LexiSync.
We store the Google sign-in tokens, encrypted, only to keep these two flows running. We do not use your Google data for any other purpose, do not share it, do not sell it, and do not use it for advertising or to train AI models. Disconnecting deletes the “LexiSync” calendar from your Google account, deletes LexiSync’s copy of your events, and deletes the stored tokens. LexiSync’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft Outlook calendar
The same two flows, for a Microsoft 365 or Outlook.com account. LexiSync asks for permission to read
and write your calendars (Calendars.ReadWrite) and to stay connected
(offline_access). It reads the events on the calendars you choose and shows them only to
you inside LexiSync, without changing them; and it creates one calendar named “LexiSync” in your
account and writes the same redacted entries to it. Everything said above about your Google events
applies here too: shown only to you, never attached to a matter, kept for the same window, and never
used for advertising or to train AI models. Disconnecting deletes that calendar, LexiSync’s copy of
your events, and the stored tokens.
Calendar subscription link
Instead of connecting an account, a person may copy a private, read-only link into any calendar program. The link carries the same redacted entries. Anyone with the link can read it; the person can revoke it at any time, which makes the link stop working.
QuickBooks Online
A firm’s administrator can connect the firm’s QuickBooks Online company so invoices and payments recorded in LexiSync are also recorded there. LexiSync sends the invoice or payment amounts, dates, terms and a matter number as the customer name: no client name, no matter description, no document. LexiSync reads back only the records it created. Disconnecting stops the connection and deletes the stored tokens.
LawPay
A firm can connect its own LawPay account so clients can pay invoices online. Card and bank details are entered on LawPay’s pages and never pass through LexiSync. LexiSync sends LawPay the invoice amount and a reference, and receives back the fact and amount of a payment so it can mark the invoice paid.
Sharing
We share data only with the service providers that run LexiSync, each under a written agreement that limits them to our instructions:
- Amazon Web Services: hosting, storage, AI models, text extraction from scanned documents, and email delivery, all inside LexiSync’s own accounts. Emails carry sign-in codes, invitations and notifications, never document content.
- SignWell: electronic signature, when a document is sent for signing. It receives that document and the signers’ names and email addresses.
- Stripe: the firm’s own subscription billing. It receives the firm’s name, billing contact and payment status, never matter content.
- Browser push services: client portal notifications, carrying a generic “you have an update” message with no content.
The connected services above receive what each section describes, and only when the firm or person connects them. We disclose data when the law requires it, and we tell the firm unless the law prohibits us from doing so. We do not sell data.
Retention and deletion
A firm’s data is kept while its subscription is active. When a firm leaves, it can export its data from LexiSync for 30 days, and on written request we provide anything the export functions don’t cover in a common, machine-readable format within 30 days. We then delete the firm’s data from our live systems, except trust-accounting records and access-audit records, which are kept for the periods the law and the firm’s rules of professional conduct require. Backups expire on their regular schedule and stay encrypted until they do. Connected-account tokens are deleted when an account is disconnected. Application logs hold identifiers rather than client content and are kept for 30 days.
Your choices and rights
A firm’s administrator controls the firm’s data and can export it or ask us to delete it. Staff can disconnect any connected account from inside LexiSync. A firm’s client should direct requests about their information to their law firm, which is the party responsible for it; we assist the firm. For anything about this policy, write to david.segala@lexisync.ai.
Children
LexiSync is for law firms and their adult clients. We do not knowingly collect information from children under 13.
Changes
We will post changes here with a new date, and tell firms about material changes by email.