Privacy Policy

1. Scope

This Policy applies to personal information we collect or receive when you:

• visit or interact with the Website;
• submit a Contact, Talk to LEXI, demo, support, partner, media, or other business inquiry;
• communicate with LEXI by email, telephone, chat, at an event, or through other business channels;
• interact with LEXI in a professional capacity as a customer, prospective customer, partner, reseller, supplier, service provider, consultant, or other business contact;
• apply for a job or otherwise communicate with LEXI about a career opportunity; or
• use another LEXI service or digital property that expressly links to this Policy.

Business contact information is covered by this Policy. This Policy does not replace privacy, security, or data-processing provisions in an applicable master services agreement, order form, evaluation agreement, partner agreement, statement of work, data processing agreement, or other written agreement with LEXI.

When LEXI processes personal information solely on behalf of an enterprise customer in connection with LEXI hardware, software, cloud services, applications, integrations, support, or deployments, the applicable customer agreement and data processing agreement govern that processing. In those circumstances, the customer generally determines the purposes and means of processing, provides any required privacy notices, and responds to individual rights requests; LEXI assists the customer as required by the applicable agreement and law.

2. Notice at Collection

This Section summarizes the personal information LEXI expects to collect through the interactions covered by this Policy, why we collect it, and the criteria we use to determine retention. Website forms may link directly to this Section at or before the point of collection.

LEXI does not sell personal information in exchange for money. As of the Effective Date, LEXI does not use personal information collected through the Website for cross-context behavioral advertising and does not disclose that information in a manner LEXI treats as a “sale” or “sharing” under the California Consumer Privacy Act. Section 9 explains this position and how we will address any future change in practice.

Providing business contact information is generally necessary for us to respond to an inquiry, administer an account, or enter into or perform an agreement. Other information, including optional survey or marketing-preference information, is voluntary unless we tell you otherwise at collection.

3. Personal Information We Collect

Contact and business information. Name, business email address, business telephone number, employer or organization, job title, business address, professional profile information, and information you include in an inquiry or correspondence.

Account and authentication information. User ID, account identifiers, credentials or authentication data, permissions, organization affiliation, and related account-security information when you use a LEXI account or customer-facing service.

Commercial and relationship information. Information about your organization’s interests, requested products or services, proposals, opportunities, contracts, support history, event participation, communications preferences, and other information relevant to a current or prospective business relationship.

Website and device information. IP address, browser type, operating system, device identifiers, referring and exit pages, pages viewed, links clicked, scroll and interaction events, dates and times of visits, approximate location derived from IP address, and similar technical and usage information.

Cookie, analytics, and session-technology data. Information collected through cookies, pixels, tags, local storage, analytics tools, session-recording or session-replay technologies, and chat or messaging widgets if and when those technologies are deployed, as described in Section 7.

Communications content. The content of emails, chat and messaging transcripts, meeting notes, and, where you are notified and consent is obtained as required by law, call recordings.

Customer-service and support information. Information you provide when requesting assistance, including contact information, support correspondence, diagnostic information, screenshots, logs, or other materials you choose to provide through an approved support channel.

Recruiting information. Contact details, resume or CV information, employment and education history, qualifications, professional references, work authorization or immigration-related information, and information you voluntarily provide in connection with a career opportunity.

Other information you provide. Information you voluntarily submit to LEXI through events, surveys, feedback, documents, meetings, or other communications.

Building, device, and operational data. LEXI offerings may process building, equipment, environmental, occupancy, energy, device, network, or operational data. Whether any such data is personal information depends on its content, context, and how it can be linked to an individual. When LEXI processes this information on behalf of a customer, the applicable customer agreement and data processing agreement govern that processing and this public Website Privacy Policy does not redefine ownership or permitted uses of customer data.

LEXI does not use customer-controlled building, device, or operational data to train third-party or general-purpose foundation models unless expressly authorized by the applicable customer agreement. LEXI may use aggregated or deidentified information for service improvement, analytics, research, and model development only as permitted by applicable agreements and law.

4. Sensitive Personal Information

Some privacy laws define certain information as “sensitive personal information” or “sensitive data.” In limited circumstances, LEXI may collect:

• Account credentials, such as a user name or account identifier in combination with a password or other credential permitting access to an account.
• Citizenship, immigration, or work-authorization information where you provide it in connection with a job application and it is reasonably necessary to evaluate employment eligibility or comply with law.

LEXI uses sensitive personal information only for reasonably necessary and proportionate purposes such as providing requested services, authenticating accounts, maintaining security and integrity, preventing or investigating fraud and unauthorized access, evaluating employment eligibility, and complying with legal obligations. LEXI does not use sensitive personal information to infer characteristics about you and does not sell or share sensitive personal information for cross-context behavioral advertising.

The public Website is not designed for you to submit other highly sensitive information such as government identification numbers, financial account credentials, health information, biometric identifiers, precise geolocation, or information revealing racial or ethnic origin, religious or philosophical beliefs, union membership, sexual orientation, or health status. Please do not provide such information through general Website forms unless LEXI specifically requests it and provides an appropriate channel.

5. Sources of Personal Information

We may collect personal information from:

• you directly, including when you submit forms, communicate with us, attend an event, request support, or apply for a position;
• your organization, including a customer, prospective customer, partner, reseller, supplier, or employer that provides business contact or account information;
• your browser or device, through logs, cookies, analytics technologies, and other automated means that are in use;
• service providers and business partners, such as hosting, security, CRM, analytics, communications, event, recruiting, and integration providers;
• public and professional sources, such as company websites, professional networking services, trade publications, public registries, and conference or industry directories; and
• third-party integrations or services, when you or your organization directs or authorizes an integration with LEXI.

6. How We Use Personal Information

We may use personal information to:

• operate, secure, maintain, troubleshoot, and improve the Website and other covered services;
• respond to inquiries, provide requested information, schedule demonstrations, and communicate about LEXI offerings;
• establish, administer, support, and secure business relationships and user accounts;
• provide customer service, technical support, implementation coordination, and related communications;
• evaluate prospective business, partner, supplier, reseller, media, financing, or other professional relationships;
• send marketing, product, event, and business-development communications subject to applicable law and your communication preferences;
• measure Website performance, understand usage, conduct analytics, and improve content, navigation, and communications;
• detect, investigate, and prevent fraud, abuse, security incidents, unauthorized access, and other harmful activity;
• protect the rights, safety, security, and property of LEXI, our customers, users, and others;
• manage recruiting and evaluate candidates for employment opportunities;
• comply with law, regulation, legal process, contractual requirements, audits, and internal governance obligations;
• establish, exercise, or defend legal claims; and
• support a merger, financing, acquisition, reorganization, sale of assets, due diligence process, or similar corporate transaction.

We may also use information in aggregated, deidentified, or otherwise non-personal form for lawful business purposes, including analytics, research, service improvement, benchmarking, reporting, and model development where permitted by law and applicable agreements. Where we hold information in deidentified form, we will maintain and use it in deidentified form and will not attempt to reidentify it except as permitted by law to test or validate deidentification measures.

7. Cookies, Analytics, and Session Technologies

The Website may use cookies and similar technologies to operate requested functions, maintain security, remember preferences, understand performance and usage, and support measurement or communications. The technologies actually in use may include:

• Strictly necessary technologies that support core functions, security, network management, and requested services.
• Analytics and performance technologies that help us understand how visitors use the Website and improve performance and content.
• Functional technologies that remember preferences or enable enhanced features, such as chat or messaging tools.
• Session-recording or session-replay technologies, if deployed, that record or reconstruct Website interactions for troubleshooting or usability analysis.
• Advertising or social-media technologies only if LEXI later enables them in accordance with Section 9 and applicable law.

Some technologies may be provided by third parties that receive information directly from your browser or device and process it under their own terms. Where applicable, the Website’s cookie or privacy controls identify the technologies and choices then available.

Where applicable law requires consent before a non-essential technology is activated, we obtain that consent before activating the technology for the user or jurisdiction to which the requirement applies. You may change applicable choices through any cookie or privacy controls made available on the Website or through browser settings.

We process legally recognized browser-based opt-out preference signals, including Global Privacy Control, when and to the extent applicable law requires us to do so. Browser “Do Not Track” signals are not standardized and may not be interpreted consistently; this does not limit our obligation to honor legally recognized preference signals.

8. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this Policy:

• service providers and contractors, including hosting, cloud infrastructure, cybersecurity, CRM, analytics, communications, event, recruiting, professional-services, and support providers that process information for us under contractual restrictions;
• business partners and integration providers when necessary to support a jointly offered service, authorized integration, referral, reseller relationship, or other interaction you or your organization requests;
• your organization, for example when your employer or customer organization administers your business account or requests information related to an enterprise relationship;
• professional advisors, including attorneys, accountants, auditors, insurers, consultants, and financial advisors;
• government authorities or other parties where disclosure is required by law, legal process, or reasonably necessary to protect rights, safety, security, or property; and
• transaction counterparties in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction.

We may also disclose personal information with your consent, at your direction, or as otherwise described at the time information is collected. Corporate affiliates, if any, may receive information where reasonably necessary for internal administration and lawful business operations.

9. Sale, Sharing, and Targeted Advertising

LEXI does not sell personal information in exchange for money.

As of the Effective Date, LEXI does not use personal information collected through the Website for cross-context behavioral advertising and does not disclose that information to third parties in a manner LEXI treats as a “sale” or “sharing” under the California Consumer Privacy Act or as processing for targeted advertising under comparable U.S. state privacy laws.

If LEXI changes these practices, we will update the applicable privacy disclosures and implement any legally required opt-out or consent mechanism before activating the new processing where required by law. Where an opt-out preference signal such as Global Privacy Control must be honored, we will process it as required by applicable law.

LEXI does not knowingly sell or share the personal information of individuals under 16 years of age.

10. Automated Decision-Making and Profiling

LEXI does not use automated processing through the public Website to make decisions about individuals that produce legal or similarly significant effects without meaningful human involvement. Website analytics and customer-relationship tools may assist LEXI in understanding business interests or communications, but they are not used through the public Website to make consequential decisions about employment, housing, lending, insurance, education, healthcare, or similar significant services.

If LEXI uses an automated decision-making technology in a context that triggers notice, access, opt-out, human-review, or similar rights under applicable law, LEXI will provide the required notice and mechanism for that context. Recruiting tools that rank, score, filter, or automatically reject candidates are reviewed separately from ordinary resume-field extraction or administrative automation.

11. Marketing Communications

You may unsubscribe from promotional email communications using the unsubscribe link in the message or by contacting us. Where we rely on consent for marketing, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. If European data-protection law applies to you, you have the right to object to processing of personal information for direct marketing purposes, and we will stop that processing on request.

Even if you opt out of marketing, we may continue to send non-promotional communications relating to an existing business relationship, security, legal notices, transactions, or services you or your organization requested.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal, contractual, security, dispute-resolution, and records-management requirements. Because LEXI’s interactions range from one-time Website inquiries to multi-year enterprise relationships, a single fixed retention period is not appropriate for every record. We therefore use the following category-specific criteria:

When determining retention, we consider the duration of the relationship, sensitivity and volume of information, purpose of processing, contractual requirements, security and fraud-prevention needs, legal limitation periods, regulatory obligations, and whether information can be deleted, aggregated, or deidentified. Customer-controlled data may be subject to different retention and deletion terms in the applicable commercial agreement or data processing agreement.

13. Security

LEXI maintains administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. No security measure or method of transmission or storage can be guaranteed to be completely secure.

Where a security incident affecting personal information requires notification under applicable law, we will notify affected individuals and regulators within the timeframes required by law.

If you believe your interaction with LEXI is no longer secure or wish to report a suspected security issue, contact [email protected] or use your designated customer-support channel.

14. Third-Party Websites and Services

The Website may link to third-party websites, platforms, social networks, integrations, or services. Those third parties operate under their own privacy policies and practices. LEXI does not control and is not responsible for third-party privacy practices. We encourage you to review the privacy information provided by a third party before providing personal information to it.

15. Your Privacy Rights and Choices

Depending on where you live and subject to applicable law, you may have some or all of the following rights regarding personal information:

• confirm whether we process your personal information and obtain access to it;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• receive a portable copy of certain personal information;
• object to or restrict certain processing;
• opt out of sale, sharing, targeted advertising, or certain profiling where those rights apply;
• limit certain uses or disclosures of sensitive personal information where applicable;
• withdraw consent where processing is based on consent, without affecting prior lawful processing;
• appeal a decision regarding a privacy-rights request where applicable law provides an appeal right; and
• not receive unlawful discriminatory treatment for exercising applicable privacy rights.

15.1 How to submit a request

You may submit a privacy request by email to [email protected] with the subject line “Privacy Request,” through any privacy-request form made available on the Website, or by mail to the address in Section 23. Where applicable law requires additional request methods, including a toll-free telephone method, LEXI will make those methods available for the covered processing.

Section 9 states LEXI’s current position on sale, sharing, and targeted advertising. If LEXI later engages in processing that creates an applicable opt-out right, the Website will provide the required opt-out mechanism and will honor qualifying opt-out preference signals as required by law.

15.2 Verification, authorized agents, and timing

We may need to verify your identity before responding, and the level of verification will depend on the sensitivity of the information and the risk of harm from unauthorized disclosure. We may ask you to provide information we already hold so we can match it to our records. If we cannot verify your identity, we will explain why and, where possible, what would allow us to proceed. Information provided for a rights request will be used to verify and process the request and maintain legally required records.

An authorized agent may submit a request on your behalf where permitted by law. We may require evidence of authorization and may ask you to verify your own identity or confirm the agent’s authority, except where a valid power of attorney or other law requires a different process.

We will respond within the period required by applicable law. U.S. state privacy laws commonly provide an initial response period of approximately 45 days, while European data-protection law generally provides one month, subject to permitted extensions and notice.

15.3 Appeals

Where applicable law provides a right to appeal our decision on a privacy request, you may appeal by replying to our decision or by emailing [email protected] with the subject line “Privacy Appeal.” We will respond within the period required by law and will provide regulator contact information where the law requires it.

15.4 Requests relating to customer environments

If we process personal information solely on behalf of an enterprise customer, we may direct your request to that customer or ask you to contact the customer directly because the customer controls the relevant data and determines how it is used. We will assist the customer as required by the applicable data processing agreement and law.

16. California Privacy Notice

This Section supplements the rest of this Policy for California residents and applies to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to LEXI’s processing. In the preceding 12 months, LEXI has collected the following categories of personal information in connection with activities covered by this Policy, depending on the individual’s interaction with LEXI:

Retention criteria for these categories are described in Sections 2 and 12. LEXI does not sell personal information in exchange for money. Section 9 states LEXI’s current position regarding “sale” and “sharing” as those terms are defined by the CCPA.

If the CCPA applies to LEXI, California residents may have rights to know and access, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information where applicable, and receive non-discriminatory treatment for exercising CCPA rights. Requests may be submitted using the methods in Section 15. LEXI processes qualifying opt-out preference signals when required by applicable law.

California Civil Code Section 1798.83 (“Shine the Light”) may provide certain California residents with rights regarding disclosure of personal information to third parties for those third parties’ own direct-marketing purposes. Requests may be submitted using the contact information in Section 23.

17. Other U.S. State Privacy Rights

Residents of other U.S. states may have rights similar to those described in Section 15, including rights to access, correct, delete, or obtain a copy of personal information and to opt out of certain sales, targeted advertising, or profiling. Availability and scope vary by state and may be subject to exemptions. Submit a request using the methods in Section 15 and appeal a decision as described in Section 15.3.

Nevada. Nevada residents may submit a verified request directing LEXI not to make a sale of covered information as defined by Nevada law by contacting [email protected].

Washington and Nevada consumer health data. The public Website is not designed to collect consumer health data as defined by the Washington My Health My Data Act or comparable Nevada consumer-health-data law. Building, environmental, occupancy, or operational data processed by LEXI on behalf of enterprise customers is governed by the applicable customer agreement and must be evaluated in context rather than treated as Website data under this statement.

18. Job Applicants and Candidates

This Section applies to individuals who apply for a position with LEXI or otherwise communicate with us about a career opportunity. Where applicable law requires a separate notice at collection for applicants, LEXI or the recruiting platform used for the application will provide that notice at or before collection.

We collect the recruiting information described in Section 3 from you, recruiters and staffing agencies, references you provide, and public professional sources. We use it to evaluate applications, communicate with candidates, conduct interviews and reference checks, verify eligibility for employment, comply with equal-opportunity and other legal recordkeeping obligations, and, where appropriate, consider candidates for future roles. Where required, background checks are conducted only with legally required authorization and notices.

If LEXI uses a recruiting technology that ranks, scores, filters, or automatically rejects candidates in a manner regulated by applicable automated-decision laws, LEXI will provide the notices, rights, and human-review processes required for that use. Recruiting information is retained using the criteria in Section 12.

19. EEA, United Kingdom, and Switzerland

If European data-protection law applies to our processing of your personal information, Lexi Devices, Inc. is the controller unless we are acting solely as a processor for a customer, and this Section provides additional information required by applicable European law.

19.1 Lawful bases

Depending on the processing activity, we rely on one or more lawful bases:

• Contract or pre-contractual steps, where processing is necessary to enter into or perform an agreement or respond to a request you make before entering into an agreement.
• Legitimate interests, such as operating and securing our business and Website, managing B2B relationships, responding to inquiries, improving services, preventing fraud, and conducting appropriate business development, balanced against your rights and interests.
• Consent, where we request consent, including for certain cookies or marketing activities where consent is required.
• Legal obligations, where processing is necessary to comply with applicable law, regulation, or legal process.

19.2 Your rights

Subject to applicable law, you may have rights to access, rectify, and erase personal information; restrict or object to processing; obtain data portability; and withdraw consent at any time without affecting prior lawful processing. The right to object to direct marketing is absolute under applicable European data-protection law. You may exercise these rights using Section 15.

You may also lodge a complaint with a competent supervisory authority. In the United Kingdom, the supervisory authority is the Information Commissioner’s Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We encourage you to contact us first so we have an opportunity to address your concern.

19.3 International transfers

LEXI is based in the United States. If personal information is transferred from the EEA, United Kingdom, Switzerland, or another jurisdiction that restricts international transfers, we use legally recognized transfer mechanisms and safeguards as applicable, which may include adequacy decisions, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or other approved mechanisms. Customer-specific transfer arrangements may be addressed in an applicable data processing agreement. You may contact [email protected] for information about relevant safeguards.

19.4 Representatives and data-protection contacts

Where Article 27 of the EU GDPR or UK GDPR requires LEXI to appoint a local representative, the representative’s identity and contact information will be published with this Policy or in a regional notice linked from it. Privacy and data-protection inquiries may be sent to [email protected].

20. Singapore

Where Singapore’s Personal Data Protection Act applies, LEXI’s public data-protection contact is [email protected]. Requests or questions relating to personal data processed in connection with Singapore business relationships may be sent to that address. Customer-controlled data processed on behalf of a customer remains subject to the applicable customer agreement and data processing terms.

21. Children

The Website is intended for business and professional audiences, and the LEXI Terms and Conditions require Website users to be at least 18 years old. LEXI does not knowingly collect personal information through the public Website from children under 13 or from any higher age at which applicable law requires parental authorization for the relevant processing. LEXI does not knowingly sell or share personal information of individuals under 16. If you believe a child has provided personal information through the Website, contact [email protected] so we can evaluate and, where appropriate, delete it.

22. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or services. The “Last Updated” date identifies the most recent revision. If we make a material change, we will provide notice in the manner required by applicable law. Where applicable law requires consent before we begin a materially different processing activity, we will obtain the required consent before conducting that activity.

23. Contact Us

If you have questions about this Policy or wish to exercise an applicable privacy right, contact: