Privacy Policy
Last updated: May 29, 2026
Contents
1Data controller
The data controller for your personal data is LexFlow, a legal contract platform for European freelancers, operated in accordance with the laws of the European Union.
Contact email: privacy@lexflow.eu
Platform: https://lexflow.eu
2Data collected
We collect the following personal data:
| Category | Data | Source |
|---|---|---|
| Identity | Full name, email address | Provided by user at registration |
| Contracts | Party names, values, project description, country, contract type | Provided when creating contracts |
| Payment | Subscription history, plan status (we do not store card data) | Processed by Stripe |
| Technical | IP address, browser, operating system, pages visited | Automatic — cookies and access logs |
| E-signature | Recipient client email and name | Provided by user when sending contracts |
3Purpose and legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provision of the LexFlow service (contract generation) | Performance of contract — Art. 6(1)(b) |
| Subscription management and billing | Performance of contract — Art. 6(1)(b) |
| E-signature and automatic reminders | Performance of contract — Art. 6(1)(b) |
| Service communications (transactional emails) | Legitimate interest — Art. 6(1)(f) |
| Compliance with legal obligations | Legal obligation — Art. 6(1)(c) |
| Analytics and product improvement | Consent — Art. 6(1)(a) |
4Data retention
| Category | Retention period |
|---|---|
| Account data | Until account deletion + 30 days |
| Generated contracts | While account is active; accessible after cancellation |
| Billing records | 7 years (EU tax obligation) |
| Technical access logs | 90 days |
| Electronic signature data | 5 years (legal evidence) |
5Third parties and sub-processors
We share data only with the following sub-processors, all operating under GDPR agreements:
| Service | Purpose | Data location |
|---|---|---|
| Supabase | Database and authentication | 🇪🇺 European Union (eu-west-1, Ireland) |
| Vercel | Hosting and infrastructure | 🇺🇸 USA — covered by SCCs |
| Stripe | Payment processing | 🇺🇸/🇪🇺 USA + EU — covered by SCCs |
| Yousign | Electronic signature | 🇫🇷 France (European company) |
| Resend | Transactional email delivery | 🇺🇸 USA — covered by SCCs |
We do not sell, rent or share personal data for third-party commercial purposes.
6International transfers
Your primary account and contract data is stored on Supabase servers in the eu-west-1 region (Ireland), within the European Union.
For services with servers in the USA (Vercel, Stripe, Resend), we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Article 46 of the GDPR.
7Your rights (GDPR)
Under the GDPR, you have the following rights:
- ✓Access — Request a copy of all data we hold about you
- ✓Rectification — Correct inaccurate or incomplete data
- ✓Erasure — Request deletion of your data ("right to be forgotten")
- ✓Restriction — Restrict processing of your data in certain circumstances
- ✓Portability — Receive your data in a structured, machine-readable format
- ✓Objection — Object to processing based on legitimate interest
- ✓Withdrawal of consent — Withdraw consent at any time without affecting prior processing
To exercise any right, contact: privacy@lexflow.eu. We will respond within 30 days.
You also have the right to lodge a complaint with your national supervisory authority (e.g. CNIL in France, BfDI in Germany, ICO in Ireland, AEPD in Spain).
9Security
We implement appropriate technical and organisational measures to protect your data:
- ✓Data transmission via HTTPS/TLS
- ✓Row Level Security (RLS) in the database — each user accesses only their own data
- ✓API keys stored as encrypted environment variables
- ✓Authentication via Supabase Auth with secure sessions
- ✓Database servers in the EU with no direct public access
10Contact and DPO
For privacy questions, exercising rights or complaints, contact our data protection officer:
This policy may be updated periodically. Users will be notified by email in the event of material changes.