Privacy Policy

This Privacy Policy explains how BEBCO Lexlink LLC (“Lexlink,” “we,” “us”) collects, uses, shares, and protects information in connection with the Lexlink case-management platform (the “Service”). Lexlink is a business-to-business platform used by law firms (“Firms”) to manage their practice. It applies to Firm users (attorneys and staff), the clients and prospective clients whose information Firms store in the Service, and visitors to our websites.

Where a Firm uses the Service to process information about its own clients, the Firm is the controller of that information and Lexlink acts as its processor/service provider, handling that information on the Firm’s behalf and under its instructions.

1. Information we collect

We collect the following categories of information:

• Account information — name, email address, password (stored hashed), phone, role, and professional profile details (e.g., bar admissions) you provide when you create or use an account.
• Firm and matter data — the information Firms enter into the Service, such as clients and contacts, matters/cases, tasks, calendar events, documents, time entries, invoices, trust-accounting records, and communications logged in the Service.
• Connected-account data — if a Firm user connects a Google or Microsoft account, the email messages and calendar events we access to provide the communication and calendar features (described in Sections 3–6).
• Payment information — billing details and payment-method tokens, processed by our payment processor; Lexlink does not store full card numbers.
• Usage and device information — log data, IP address, browser/device type, and actions taken in the Service, used to operate, secure, and improve it.

2. How we use information

We use information to: provide, maintain, and secure the Service; authenticate users and enforce permissions and tenant isolation; deliver the features a Firm enables (matters, documents, calendar, communications, billing, e-signature, reporting, and the optional AI connector); send transactional and service messages; process payments; provide support; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations.

We do not sell personal information, and we do not use connected-account (Google or Microsoft) data for advertising.

3. Connected Google and Microsoft accounts

The communication and calendar features are optional and only operate after a Firm user explicitly connects their own Google or Microsoft 365 account through a standard OAuth consent flow. The connection covers two functions:

• Client email — so the user can read and send client emails from their connected mailbox and have those messages appear on the relevant client’s communication timeline in the Service.
• Calendar sync — so appointments stay in sync between the user’s calendar and the Service, and public booking does not double-book.

A user can disconnect an account at any time from Settings → Connections, and can also revoke Lexlink’s access directly from their Google or Microsoft account security settings. Disconnecting stops further access and deletes the stored connection.

4. Google API Services — Limited Use

Specifically, data Lexlink accesses through Google APIs (Gmail and Google Calendar) is used only to provide and improve the user-facing email and calendar features described in Section 3. In accordance with the Limited Use requirements:

• We do not use Gmail or Google Calendar data for advertising, and we do not sell it.
• We do not transfer this data to third parties except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice.
• We do not allow humans to read this data, except: with the user’s explicit consent for specific messages; where necessary for security purposes (such as investigating abuse) or to comply with applicable law; or where the data has been aggregated and anonymized.

5. Microsoft 365 data

Data Lexlink accesses through Microsoft Graph (Outlook mail and calendar) is handled on the same basis as Section 4: it is used only to provide the email and calendar features the user enabled, is not used for advertising, is not sold, and is not transferred to third parties except to provide those features, comply with law, or in a merger/acquisition with notice. Tokens are stored encrypted and access can be revoked by the user at any time.

6. How connected-account data is stored

Access and refresh tokens for connected Google and Microsoft accounts are encrypted at rest. Email and calendar content is processed to populate the relevant client’s timeline and the Firm’s calendar within the Firm’s isolated tenant, accessible only to authorized users of that Firm under the Firm’s permission rules. We retain this data only as long as the account remains connected and the Firm needs it for the Service, subject to Section 8.

7. How we share information

We share information only as needed to run the Service:

• Service providers (subprocessors) — vetted vendors that process data on our behalf under contract, including cloud hosting and database/storage (Amazon Web Services, Supabase), payment processing (Stripe), transactional email delivery (Resend), and text messaging where a Firm enables it (the Firm’s own Twilio account).
• Within a Firm — Firm data is available to that Firm’s authorized users according to the Firm’s roles and permissions, and is isolated from other Firms.
• Legal and safety — where required by law, legal process, or to protect the rights, safety, and security of users, the public, or Lexlink.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with notice as required.

We do not sell personal information.

8. Data retention

We retain information for as long as an account is active and as needed to provide the Service, then delete or anonymize it within a reasonable period, unless a longer retention period is required by law or a Firm’s compliance configuration (for example, e-signature audit trails). On termination, a Firm may request export of its data within 30 days, after which Lexlink may permanently delete tenant data in accordance with its retention policies.

9. Security

We use industry-standard safeguards including encryption in transit, encryption at rest for sensitive credentials, row-level tenant isolation, role-based access controls, and least-privilege access for service accounts. No method of transmission or storage is completely secure, but we work to protect information and to promptly address vulnerabilities.

10. Your choices and rights

Depending on your location, you may have rights to access, correct, export, or delete personal information, and to object to or restrict certain processing. Firm users can update their profile in the Service and disconnect connected accounts at any time. Because Firms control the client data they store, requests about that data are directed to the relevant Firm; Lexlink will assist Firms in responding. To exercise a right or ask a question, contact us at support@lexlink.ai.

11. Cookies

We use strictly necessary cookies and similar technologies to keep you signed in, maintain your session, and operate the Service. We do not use third-party advertising cookies.

12. Children’s privacy

The Service is a professional tool intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

13. International users

The Service is operated from the United States. If you access it from outside the United States, you understand that your information may be processed in the United States, where data-protection laws may differ from those in your country.

14. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice through the platform or by email before the changes take effect. The “Last updated” date above reflects the most recent revision.

15. Contact

Questions about this Privacy Policy or our data practices can be directed to support@lexlink.ai.

BEBCO Lexlink LLC · Privacy Policy · This document supersedes prior versions.