Local legal data. Limited online account data.

1. Scope

This notice applies to the LexCapture public website, production account and licensing service, transactional account email, billing integration, software update service, and customer support. It does not replace the privacy obligations that you or your organization may have for client or legal-matter information stored on your devices.

2. Legal and business data stays local

The LexCapture desktop stores cases, communications, time entries, invoices, invoice PDFs, settings, and captured mobile information locally in your application data. The desktop remains the Command Center. Outlook capture uses a local loopback connection, and mobile synchronization is initiated by the user over the user’s selected connection.

LexCapture’s online account, licensing, billing, update, and website services have no route or database designed to receive legal matters, communication content, time-entry descriptions, invoices, documents, or mobile-capture content. LexCapture does not provide cloud storage or synchronization for that data.

3. Information we process online

• Account information: email address, password hash, verification status, one-time verification or recovery token hashes, and account status. We do not store your plaintext password.
• Authentication and security information: hashed session credentials, login and recovery events, rate-limit and lockout state, request identifiers, bounded audit records, timestamps, and network information such as IP address and user agent available in ordinary server/security logs.
• Installation and licensing information: a random application installation identifier, installation association and revocation state, application/environment identifiers, subscription and license status, signed-entitlement records, and update-authorization metadata.
• Billing information: Stripe customer, subscription, price, invoice, charge, refund, and dispute identifiers and status needed to reconcile access. Payment-card details are entered on Stripe-hosted pages and are not received or stored by LexCapture.
• Transactional email information: your email address and a one-time account verification or recovery code sent through Resend.
• Support information: your email address and information you choose to include when contacting support. Please do not send passwords, payment-card details, access tokens, private keys, or unnecessary client-confidential information.

4. How we use information

We use online information to create and secure accounts; verify email addresses; authenticate sessions; associate and revoke installations; prevent abuse; process account recovery; validate subscriptions; issue and verify signed entitlements; provide Restricted Mode and grace behavior; authorize secure updates; reconcile refunds, disputes, cancellation, and payment status; send transactional messages; provide support; maintain backups; diagnose failures; and comply with legal obligations.

We do not sell personal information, use it for targeted advertising, or use legal-matter content for analytics or model training. The public website has no advertising tracker, analytics service, data-collecting contact form, or marketing cookie.

5. Service providers and disclosures

We disclose limited information to providers only as needed for their services:

• Stripe: hosted Checkout, payment processing, subscriptions, invoices, refunds, disputes, and the Customer Portal.
• Resend: delivery of account verification and password-recovery email.
• Hetzner: hosting for the public website and production account/licensing service, plus encrypted off-host operational backups.

These providers process information under their own terms and privacy practices. We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate fraud or abuse, enforce agreements, or complete a business transfer subject to appropriate protections.

6. Retention

We retain account, installation, licensing, billing-reconciliation, security, and audit information for as long as reasonably necessary to operate LexCapture, maintain account and transaction records, prevent fraud, resolve disputes, enforce agreements, and meet legal obligations. One-time verification and recovery codes expire and are stored only as hashes. Sessions expire or may be revoked.

Operational data may remain temporarily in rotating encrypted backups until those backups age out under the backup schedule. Stripe, Resend, and other providers apply their own retention obligations. Local legal and business data remains under your control on your devices and backups.

7. Security

LexCapture uses measures designed to limit risk, including HTTPS, least-privilege service identities, password hashing, hashed session and one-time tokens, signed entitlements, restricted production keys and configuration, bounded validation and rate limits, audit records, isolated staging and production data, encrypted off-host backups, and tested restore procedures. No security method is perfect, and we cannot guarantee absolute security.

8. Your choices and requests

You may update payment methods, view invoices, and cancel a subscription through Stripe’s Customer Portal. You may sign out or revoke local access through supported account workflows. You may request access, correction, or deletion of online account information by contacting us. We may need to verify your identity, and we may retain information where required for security, transactions, disputes, or law.

Depending on where you live, applicable law may provide additional privacy rights. We will honor non-waivable rights that apply. This notice does not claim that every jurisdiction-specific privacy law applies to LexCapture.

9. Children

LexCapture is intended for adults and professional use. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

10. Changes

We may update this notice when LexCapture, its providers, or applicable requirements change. We will post the updated notice with a new effective date and provide additional notice when required.

11. Contact

Privacy and account requests may be sent through Contact Support. No personal or mailing address is published.