Privacy Policy

What data is processed

• Account data: email address, password hash, verification status, and account creation date.
• Access data: hashed login sessions; API token name, prefix, hash, expiry, status, and last-used date. Full API tokens are shown only once.
• Security data: IP address or another rate-limit key and event timestamps used to prevent abuse. The LexData application does not keep a separate HTTP access log.
• Correspondence: your email address and message when you contact LexData.

Providing your email address is voluntary, but necessary to create a LexData account.

Purposes and legal bases

Account creation, authentication, transactional emails, and API access are processed to provide the service or take steps at your request under Article 6(1)(b) GDPR. Service security, abuse prevention, answering correspondence, and protecting legal claims rely on legitimate interests under Article 6(1)(f) GDPR.

Retention

Account data and API token metadata are kept until you delete the account. Login sessions expire after 30 days. Verification links expire after 24 hours and password-reset links after one hour. Rate-limit events are cleaned up during later checks after their applicable short limit window. Correspondence is kept until the matter is resolved and then only as long as needed to establish, exercise, or defend legal claims.

Service providers

• Hetzner — server hosting and account database storage.
• Cloudflare — network delivery, tunnel, and security; it receives technical connection data.
• Brevo — account verification and password-reset emails; it receives the recipient address and email content.

Transfers outside the EEA

The LexData server and account database are hosted by Hetzner in Germany, and Brevo states that its hosting servers are located in the EU. Cloudflare operates a global network and may process technical connection data outside the EEA. Cloudflare’s DPA provides for the EU-U.S. Data Privacy Framework for eligible U.S. transfers and the EU Standard Contractual Clauses with additional safeguards for restricted transfers.

Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. Contact [email protected]. You may also lodge a complaint with the President of the Personal Data Protection Office.

Account deletion

You can delete your account from the account settings. This immediately removes the account together with its login sessions and API tokens. No backup retains the deleted account data.

Cookies

LexData uses only necessary cookies: lexdata_session keeps you signed in and lexdata_csrf protects forms. Both are HTTP-only, Secure in production, SameSite=Lax, and expire after 30 days. No analytics or advertising cookies are used. The landing page stores only your language preference locally in the browser.