Pre-launch draft — Lexboard is not yet operating as a legal entity. These documents are drafts under legal review and are not yet in effect or binding.
Legal
Last updated: May 2026. Plain-English summary first, formal terms below.
Lexboard is a software tool law firms use to manage their cases. The data your firm puts into Lexboard belongs to your firm. We process it on your behalf, we don't sell it, share it, or train AI models on it.
Your firm's admin controls who at the firm sees what. Lexboard employees only access firm data when (a) you explicitly ask us to for support, or (b) we're responding to a security incident, and every such access is logged.
We use third parties to run the platform, Supabase for the database, Vercel for hosting, Stripe for payments, Twilio for SMS, an AI sub-processor for the AI features. The full list is below and kept current.
1
Firm data. Cases, clients, documents, communications, ledger entries, and everything your firm enters or uploads. Stored in a Postgres database isolated by firm_id. Encrypted at rest and in transit.
Account data.Names, emails, roles, and last sign-in times of your firm's team members.
Usage telemetry.Page views, feature usage, and error reports, used to fix bugs and prioritize work. Never sold. Never tied to specific firm data without your firm's consent.
Billing data. Stripe handles cards directly; we receive only the customer ID and subscription status.
2
To deliver the product, support your firm, secure the platform, and handle billing. We do not use firm data to train AI models. AI features (chronology, lien negotiator, demand drafter) send relevant context to our AI sub-processor under an enterprise agreement that prohibits training on customer data and sets retention to response-delivery only.
4
Lexboard's core inbox connects to a firm user's Gmail (via Google's Gmail API) or Microsoft 365 mailbox (via the Microsoft Graph API). This section spells out exactly what we access, why, how long we keep it, who we share it with, and how to revoke. It applies to both providers unless stated otherwise.
OAuth scopes we request. From Google, in a single consent grant when a firm connects Google Workspace: gmail.send, gmail.readonly, gmail.modify, userinfo.email, and userinfo.profile (the core inbox); calendar.events(two-way calendar sync of deadlines and appointments — we cannot see, edit, or delete your other calendars); and drive.file(store and retrieve only the case documents Lexboard creates or that you explicitly pick — we cannot see your other Drive files). Separately, and only if you choose to connect a Google Sheet as a lead source, we ask for spreadsheets.readonly at that time (incremental consent). From Microsoft: the equivalent Mail.Read, Mail.ReadWrite, Mail.Send, and User.Read. We do not request access to your Google Contacts, the ability to read files across your Drive, or any Google or Microsoft service beyond those listed here.
What we access. Email content (subject, body, attachments, headers) for every message the connected mailbox can see; label, folder, and category information; read/unread, starred, archived, and trashed state; drafts (full content, both directions); and the account profile (verified email address, display name, profile photo); your Google Calendar events (to sync deadlines and appointments two-way); the Google Drive files Lexboard creates or that you explicitly select; and the contents of any Google Sheet you connect as a lead source. We do not access: your Google Contacts, your other Drive files, passwords, or any other Google or Microsoft service.
Why we access it.
How long we retain it.While the mailbox is connected, synced data is retained according to the firm's configured retention policy (default: 7 years, the standard PI legal-hold window). When the mailbox is disconnected — by the user, a firm admin, or a Lexboard platform admin — every synced email, label, draft, and token is hard-deleted from the primary database within 30 seconds via cascade delete on the mailbox foreign key. Encrypted Supabase backups containing the data expire on the standard 7-day rolling schedule and are not individually restorable.
Who we share it with. No third party without explicit firm-admin opt-in. Specifically:
Encryption.TLS 1.2+ in transit. AES-256 at rest in the Supabase database. OAuth refresh tokens are encrypted at rest with per-firm keys so a single token compromise cannot expose another firm's mailboxes.
Data residency. Primary storage is in US-East (AWS via Supabase). Enterprise tiers can request EU or Canada residency at contract time — email legal@lexboard.net.
How to revoke access.Any of these independently revokes Lexboard's Gmail / Microsoft 365 access and triggers a cascade delete of the synced data:
/admin/platform/integrations in response to an escalation or security event.Every revocation, whoever initiates it, is logged in our immutable platform_audit_log with actor, IP, and timestamp.
Compliance.
Data export and deletion requests. Firm admins can self-serve a one-click export of all firm data, including synced mail, at /settings/data/export. For deletion or for individual-user export under GDPR / CCPA, email privacy@lexboard.net with subject “GDPR export” or “GDPR delete.” We respond within 30 days; exports are delivered within 60 days.
Updates to this section. Material changes to how Lexboard handles Gmail or Microsoft 365 data are emailed to firm admins at least 30 days before the change takes effect and surfaced as an in-app banner. The current policy version is tracked in platform_config.tos_version.
5
While your firm is a customer: data retained for as long as your firm wants it. Per-firm retention policies (medical records, intake leads, closed-case files) configurable from /admin.
On cancellation: we keep firm data for 30 days in case you change your mind, then permanent delete from primary storage. Backups expire on their own schedule (max 90 days from cancellation).
Right to delete on request: a firm admin can email privacy@lexboard.net and we'll delete sooner.
6
Export. Full firm export available from /admin/export as JSON + CSV. Includes documents, audit log, and ledger.
Correction.Edit anything you've entered, anytime.
Deletion. Delete cases, clients, documents from the app. Hard-delete on the audit log requires written request toprivacy@lexboard.net.
Access. Email privacy@lexboard.net for a copy of any personal information we hold about you. Response within 30 days.
7
Privacy questions: privacy@lexboard.net
Security incidents: security@lexboard.net
Anything else: hello@lexboard.net