Legal · Updated August 24, 2026
The entity named in the order controls account, website and commercial relationship data. For content a firm uploads about clients or matters, the firm is controller and CortexLex is processor or service provider under the DPA.
Account and contact data, memberships, configuration, sales requests, user-submitted content, security activity, device, browser, IP, usage events, support communications and subscription or payment references needed to operate the account.
Users, firm administrators, invited clients, public forms, authorized integrations and technical records needed to operate and protect the service.
Create accounts, provide features, authenticate, authorize, prevent abuse, support users, communicate changes, manage contracting and subscriptions, measure stability and meet obligations. We do not sell personal data.
Depending on territory: contract performance, pre-contract steps, legal obligations, legitimate interests in security and improvement, or consent where required.
We share what is necessary with infrastructure, storage, payments, communications and support providers under contract. The payment provider processes checkout, subscriptions and refunds; CortexLex does not store full card numbers. We may also share data when valid law requires, to protect rights or during a safeguarded corporate transaction.
The order and DPA state regions and safeguards. Recognized contractual clauses or other mechanisms apply when required.
Data remains during the relationship and for periods needed for security, backup, claims and law. Termination triggers agreed export, retention and deletion windows.
Access control, MFA, firm isolation, managed encryption, private files, auditing, backups and monitoring. No system removes all risk; incidents are managed and communicated under the response process.
Depending on law, request access, correction, deletion, portability, objection or restriction. For firm-controlled data, contact the firm first. Identity may be verified.
The service is not directed to children and does not make legal decisions with significant effects solely by automation.
Questions: [email protected]. We publish the update date and provide appropriate notice of material changes.