Privacy Policy.
DPDP Act compliant.

1. Who we are

LexVio.ai is a product of Global Synapse Technologies, a private limited company registered in Delhi, India (the “Data Fiduciary”, “we”, “us”). Registered address: Delhi, India. GSTIN: 07AOVPR7411P1ZY. Contact: info@globalsynapsetech.com.

When you use LexVio.ai, you (the “Data Principal”) interact with us as a data subject under the DPDP Act 2023. This policy explains the personal data we process, why we process it, and the rights you can exercise.

2. What personal data we collect

We collect the following categories of personal data:

• Account data — name, work email, mobile number, organisation, role.
• Authentication data — password hashes, OAuth tokens (Google sign-in), one-time sign-in codes sent to your email, session identifiers.
• Billing data — invoicing name, GSTIN, billing address, payment method tokens (we do not store full card numbers — these are handled by Razorpay/Stripe).
• Document content — contracts, agreements, and other legal documents you upload, paste, or generate within LexVio for analysis, review, or storage in your vault.
• Meeting recordings — audio you record or upload for Meeting Intelligence, the transcript produced from it, and the minutes generated from the transcript. Speaker labels in a transcript are inferred by a model (“Speaker 1”, “Speaker 2”), not identities; your organisation can rename them.
• Voice input — audio you dictate into the product. It is transcribed and not stored; the transcript is the only record kept.
• Client contacts — where your organisation adds a client and its contacts, their names and contact details, and, if your organisation invites a contact to its client portal, a record of each one-time sign-in link sent to the contact's address on file. Your organisation is the Data Fiduciary for this data; we process it on its behalf (see our DPA).
• Usage data — pages visited, features used, search queries, clicks, IP address, user agent, device identifiers, referral URL, timestamps.
• Communications — messages you send via our contact form, support tickets, WhatsApp, or email; testimonials you submit.
• Cookies and similar technologies — see our Cookies Policy.

3. Why we process your data (purposes)

• To provide the service — analyse contracts, run compliance checks, deliver tax intelligence, store documents in your vault, manage your account.
• To transcribe and summarise meetings you record — meeting audio is sent to OpenAI's speech-to-text model and the transcript is returned to us; minutes are then generated from the transcript. The recording, transcript and minutes are stored with your account (see §5). Speakers are labelled by inference, never identified.
• To bill you and issue tax invoices — process payments, raise GST-compliant invoices, recover dues.
• To support you — respond to queries, troubleshoot issues, send transactional emails (password resets, billing receipts, deadline alerts).
• To improve LexVio — analyse aggregated, de-identified usage patterns to fix bugs and prioritise features. We do not train AI models on your document content without your explicit consent.
• To comply with law — respond to government requests, court orders, regulatory directions, and tax / accounting obligations under Indian law.
• To detect abuse — prevent fraud, account takeover, spam, denial-of-service, and other malicious activity.

4. Legal basis for processing

Under the DPDP Act, we process your personal data based on (a) your consent (for marketing communications, AI model improvement opt-in, and similar opt-in features); (b) legitimate uses under Section 7 (provision of subscribed service, employment-related processing, performance of any law, response to medical/disaster emergencies); and (c) compliance with law (tax, accounting, court orders).

5. How long we keep your data

• Account data — for the duration of your subscription plus 30 days after cancellation (to permit reinstatement). Then deleted, unless retention is required by law.
• Document content — stored until your organisation deletes the document or, where an organisation admin has set a retention period for that document category, until the period ends, when the stored file is purged. Deleted within 30 days of vault deletion. Documents filed as identity documents are never sent to an AI model and never indexed for search.
• Meeting recordings, transcripts and minutes — stored with your account. The meeting's creator or an organisation admin can delete a recording's audio in the product, and it is deleted automatically when your organisation sets a retention period for meeting audio. The transcript and minutes are kept as your organisation's business record. Cancelling a meeting does not delete anything.
• Dictated audio — not stored; only the transcript is kept.
• Billing data — retained for 8 years from the end of the relevant financial year (Companies Act 2013 §128, Income Tax Act §44AA).
• Usage logs — retained for 12 months for security and audit, then aggregated and anonymised.
• Audit logs — append-only, and retained for at least seven years.

6. Where your data is stored (data localisation)

Uploaded documents, data exports and database backups are stored in Amazon S3 in the ap-south-1 region (Mumbai, India), written with server-side encryption. There is no per-organisation region routing.

Content leaves India to be processed: document text, prompts and meeting audio go to the AI sub-processors named in §7, whose endpoints are served from the United States. The current list is published in machine-readable form at /api/v1/privacy/subprocessors, generated from the running configuration, and in our DPA §7. Transfers outside India are permitted under DPDP Act §16 for jurisdictions not restricted by the Central Government.

7. Who we share your data with

• Cloud storage and email — Amazon Web Services (ap-south-1, Mumbai): object storage for uploaded documents, exports and backups; transactional email.
• AI processing — Anthropic (United States): model inference for contract analysis, redlining and the copilot; receives document text and prompts. OpenAI (United States): text embeddings for search over every uploaded document; multi-agent analysis when Deep Audit is used; speech-to-text transcription of meeting recordings and of voice dictation. Google (United States): multi-agent analysis when Deep Audit is used. LlamaParse (United States): document parsing and text extraction; receives uploaded files. Under each vendor's API terms, your content is not used to train its models.
• Voice and messaging — Deepgram: speech-to-text for voice input; receives the raw audio in full, and our integration does not select a processing region. Twilio: WhatsApp delivery of notifications and assistant replies; receives message bodies and phone numbers. The processing location and transfer safeguard for both are being confirmed and the register above says so.
• Your organisation's own channels — if your organisation connects its own email relay, SMS provider (MSG91) or WhatsApp Business account using its own credentials, that provider acts for your organisation under its own contract, not as our sub-processor.
• Identity verification — Karza (India): KYC for marketplace professionals; receives PAN, name and bank-account details, and Aadhaar on the offline-verification path.
• Payments — Razorpay (INR subscriptions) and Stripe (other currencies). Neither receives document content.
• Monitoring — Sentry (error monitoring, scrubbed of personal data) and PostHog (product analytics, consent-gated). Both are switched off on an air-gapped deployment.
• Authorised users in your organisation — anyone you add to your LexVio workspace as a team member, administrator, or guest.
• Compelled disclosure — to government authorities, courts, or regulators if required by Indian law, after notifying you where legally permissible.
• Business transfer — in connection with a merger, acquisition, or sale of all/part of our business, after binding the recipient to terms equivalent to this policy.

We do not sell your personal data. We do not share document content with third parties for marketing or advertising.

8. Your rights as a Data Principal

Under DPDP Act §11–§14 you have the following rights:

• Right to access — request a summary of the personal data we hold about you, the categories of processing, and the entities with whom it has been shared.
• Right to correction and erasure — request correction of inaccurate data, completion of incomplete data, or erasure of data no longer necessary for processing.
• Right of grievance redressal — escalate complaints to our Grievance Officer; see Grievance.
• Right to nominate — nominate another individual to exercise your rights in the event of death or incapacity.
• Right to withdraw consent — withdraw consent for processing you previously authorised. Withdrawal does not affect lawful processing before withdrawal.

Exporting your data.From Settings → Privacy you can request a copy of your personal data. We assemble a ZIP archive of JSON files — your profile, your consent records, the audit trail of your own actions, and your export and deletion history — with a manifest listing what it contains and anything that could not be collected. The archive is stored encrypted and is available to download from the app for 7 days through a short-lived link minted on each download; we do not email the archive. It is your personal data, not a copy of your organisation's vault: documents and other org-owned material belong to the organisation and are not included.

Deleting your account.From Settings → Privacy you can ask us to delete your account. We schedule the erasure 30 days out and your account stays fully active in the meantime; the pending request is visible, and can be cancelled, from any device you sign in on until the scheduled date. On that date your account is deactivated, every signed-in session is invalidated, and every personal identifier on your account (name, email, phone, credentials, sign-in links) is overwritten with a non-reversible placeholder. Billing records are kept for the statutory period in §5, and your organisation's work product stays with the organisation without your name on it.

To exercise any other right, email support@globalsynapsetech.com. We will respond within 30 days, as required by the DPDP Act.

9. Children

LexVio is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

10. Security

Uploaded documents, exports and backups are encrypted at rest (AES-256 server-side encryption) and all traffic is encrypted in transit (TLS 1.2 or later). Access within the product is role-based, audit logs are append-only, and automated dependency and static-analysis scans run weekly. SOC 2 controls are mapped and evidenced in-product but not yet audited; ISO 27001 is not yet certified. Read more on our Security page.

Despite these measures, no system is 100% secure. Our incident process is built for the DPDP Act, which sets no risk threshold: every personal data breach is notifiable, to the Data Protection Board of India and to each affected Data Principal. It is built around the tightest clock that applies to us — the 6-hour incident-reporting direction from CERT-In (Directions of 2022, direction 20(3)), which runs today — and, once DPDP §8(6) and Rule 7 are in force, an immediate intimation to the Board with a detailed report within 72 hours, and notice to affected Data Principals without delay.

11. Changes to this policy

We may update this policy. Material changes will be communicated by email and posted here at least 14 days before they take effect. The “Last updated” date at the top tells you when this policy was last revised.

12. Contact

Questions about this policy or your data: info@globalsynapsetech.com
Grievance Officer: see /legal/grievance
Postal: Global Synapse Technologies, Delhi, India.