Privacy Policy

Lexaren is marketing intelligence for law firms. A firm signs in, submits its website and the market it serves, and receives a plain-language report on how it appears in Google search results and who is appearing instead. This policy explains what we collect, why, and what we never do with it.

Lexaren is operated from Canada. If you have questions about this policy, email nima@lexaren.com.

We collect only what a report needs:

• Account information. Your email address, and — if you sign in with Google — your name and profile picture. Authentication is handled by Supabase Auth. If you sign in with a password, we never see it in readable form.
• What you tell us about your firm. Your website address, the city or market you serve, your practice areas, and any competitors you name.
• Public information about your website. We read the public pages of the website you submit, the same way a search engine does, and we respect robots.txt.
• Public search data. Rankings, search demand, map listings, and advertising activity for your market, obtained from our data provider. This is public information about search results, not information about you.
• Billing information. Handled entirely by Stripe. We store only your subscription status and plan — never your card number.
• Usage information. Standard product analytics about how the app is used, so we can improve it.

Connecting Google is entirely optional. Lexaren works without it. If you do connect it, we request read-only access to two things:

• Google Analytics (read-only). So your report can show how many visitors actually reach your site from search, next to the ranking evidence we already gather.
• Search Console (read-only). So your report can use the search queries and impressions Google already attributes to your own site.

We only ever read. Lexaren cannot create, change, or delete anything in your Google account, and it cannot post or send anything on your behalf. Access tokens are stored encrypted. You can disconnect at any time from your account settings, or revoke access directly at myaccount.google.com/permissions. Disconnecting deletes the stored tokens immediately.

Connecting X, Facebook, or LinkedIn is optional. If you connect one, Lexaren stores the provider's OAuth tokens encrypted and uses them only when you explicitly ask us to publish an article link. We do not publish automatically when you create or send a website draft.

We store the connected account and available publishing destinations (such as a Facebook Page or LinkedIn Company Page), along with the text, result, and provider post identifier for each publishing attempt. You can disconnect an account from the Social media screen; disconnecting replaces the stored OAuth credentials with a non-secret revoked marker while keeping the publication history needed to show what happened.

Lexaren’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use Google data only to provide and improve the reporting features you asked for.
• We do not sell Google user data, and we do not transfer it to third parties except as needed to provide the service, for security purposes, or to comply with the law.
• We do not use Google user data for advertising, and we do not build advertising profiles.
• We do not use Google user data to train generalized artificial intelligence or machine-learning models.
• No human reads your Google data except where you explicitly ask us to for support, where required by law, or for security investigations.

We do not sell your information. We share it only with the service providers that make Lexaren work, and only to the extent they need it:

• Supabase — database and authentication.
• Cloudflare — application hosting.
• DataForSEO — public search, map, and advertising data for your market.
• OpenAI — generating article suggestions from your report.
• Stripe — subscription billing.
• Resend — transactional email, such as sending you a report.
• Google Analytics, Microsoft Clarity, and Mixpanel — product usage analytics.
• X, Meta, and LinkedIn — only when you connect an account or explicitly publish to a selected destination.

We may also disclose information where the law requires it, or where it is necessary to protect our rights or the safety of others.

We keep your account and reports for as long as your account is open, so your history stays available to you. Cached search data expires on its own within a few weeks. When you ask us to delete your account, we remove your personal information and your reports, apart from anything we are required to retain for legal or accounting reasons.

• You can see and correct your account information at any time from your account settings.
• You can disconnect Google whenever you like, without losing your reports.
• You can ask us to export or delete your data by emailing us.
• Depending on where you live, you may have additional rights over your personal information — including access, correction, deletion, and objection. Email us and we will honour them.

Traffic is encrypted in transit. Google and social OAuth tokens are encrypted at rest. Access to production data is limited to the people who operate the service. No system is perfectly secure, but we treat your data as if a mistake would be expensive — because it would be.

Lexaren is a business tool and is not directed at children. We do not knowingly collect information from anyone under 18.

If we change this policy in a way that matters, we will update the date at the top of this page and, where the change is significant, tell you directly.