Privacy Policy

1. Information we collect

• Identity and contact data. Your name, email address, occupation, firm or organisation, and other identifiers you provide on registration or in your profile.
• Technical data. Internet protocol (IP) address, browser type and version, device information, time zone and approximate location derived from your IP address.
• Usage data. Information about how you interact with the Service, including features used, queries run and volumes processed.
• Your Content. The files, documents, questions and instructions you submit to the Service, and the output generated in response. This may include personal data, confidential information and material belonging to or concerning your clients.
• Acceptance records. When you accept our Terms or this Policy, we record the version accepted, the date and time, the originating IP address and the browser used, as evidence of that acceptance.
• Billing data. Subscription and payment records. We do not store full payment card details; these are handled by our payment processor.

2. How we use your information

• to register you and administer your account;
• to provide the Service, which includes processing Your Content in order to return search results, summaries and generated text in response to your instructions;
• to manage our relationship with you, including support;
• to take payment and administer subscriptions;
• to secure the Service and protect against fraud, abuse and unauthorised access;
• to understand how the Service is used, and to maintain and improve it. Where we analyse usage for this purpose we use aggregated, de-identified data that does not identify you, your clients or the content of any document; and
• to comply with our legal obligations.

3. Legal basis for processing

• Performance of a contract. To provide and administer the Service you have subscribed to.
• Legitimate interests. To secure and administer the Service, to prevent fraud and abuse, and to maintain and improve the Service using aggregated, de-identified data.
• Legal obligation. To meet accounting, tax and other obligations that apply to us.
• Consent. Where you have given consent for a specific activity, including your explicit consent, given when you accept our Terms, to your data being processed outside Botswana as described in section 7. You may withdraw consent at any time. Because the Service cannot answer queries without that processing, withdrawing it means you can no longer use the Service.

4. AI processing and Your Content

This section describes what happens to the documents and questions you submit. Please read it in full.

• How the Service works. To answer a query, the Service extracts text from your documents, converts extracts into numerical representations (“embeddings”) so that relevant passages can be found, and sends the relevant passages and your instructions to a third-party AI model provider, which returns generated text.
• Your Content leaves Botswana. The providers we use to do this operate outside Botswana. Your Content, including any client material contained in it, is transmitted to and processed by them for that purpose. Section 6 describes them, and names them on request.
• We do not sell Your Content. We do not sell, rent or trade Your Content or your personal data, and we do not disclose Your Content to anyone other than the providers described in section 6, except where you instruct us to or where we are required to by law.
• Training. We do not use Your Content to train our own models. Where a third-party provider processes Your Content on our behalf, whether that provider may use it to train or improve its own models is governed by our agreement with that provider. If you need written confirmation of the current position for a specific provider, contact us at the address in section 12 and we will provide it.
• Output is not verified by us. We do not review the output generated in response to your instructions, and we do not check whether it is accurate. That remains your responsibility under our Terms.
• Privilege is your decision. You decide what to upload. We do not assess whether material you submit is privileged or confidential, and you are responsible for obtaining any client consent your professional obligations require before submitting it.

5. Disclosure of your information

We disclose personal data only:

• to the service providers described in section 6, who process it on our behalf and under contract, only for the purposes we specify;
• to the administrator of your organisation, where your access is provided under an organisation’s subscription, in relation to that organisation’s account;
• where required by law, court order or a regulator with jurisdiction over us; and
• to a purchaser or successor in the event of a merger, acquisition or sale of our business, subject to this Policy continuing to apply.

6. Categories of recipient

We do not sell or trade your data. We share it only with providers engaged to perform a function for us. Each is bound by contract to protect the data, to process it only on our instructions, and to use it solely to provide its service to us.

The categories below describe every kind of provider that receives personal data or Your Content. A list naming the specific providers in each category, and the safeguards that apply to them, is available on request to any customer, or to their firm’s risk, compliance or IT function. Write to us at the address in section 12 and we will provide it.

7. International data transfers

We keep a copy of your account data and Your Content within Botswana, on infrastructure under our own control. That copy is protected by the same security measures, and deleted on the same schedule, as the rest of your data.

The servers and database that run the Service are hosted in the European Union, in Germany and France, where data protection is governed by the EU General Data Protection Regulation. To answer your queries, the relevant parts of Your Content are also processed by AI model and other providers in other countries outside Botswana, as section 6 shows. This is necessary to provide the Service: the AI and search infrastructure the Service depends on is not available within Botswana.

Those countries may not have been recognised under the Data Protection Act, 2024 as giving adequate protection, and the protection your data receives there may be different from the protection it receives in Botswana: for example, you may find it harder to enforce your rights against the provider, and authorities in those countries may be able to require access to it. We rely on your explicit consent to the transfer, which you give after being told of these risks when you accept our Terms, as permitted by the Data Protection Act, 2024. The transfer is also necessary to perform our contract with you.

In addition, we transfer data only under contractual terms with each provider that require it to protect the data, to process it only on our instructions, and to apply appropriate security measures. If you would like details of the safeguards applying to a particular transfer, contact us at the address in section 12.

Where you upload personal data about your clients or other people, you are the data controller of that data and we process it for you as your data processor, on the terms set out in section 4 of our Terms. You are responsible for having a lawful basis, such as your client’s consent, for that data to be transferred outside Botswana.

8. Data retention

• While your account is active. We retain your account data and Your Content for as long as your account remains active, so that the Service works as you expect.
• After payment stops. If a subscription lapses, the account is suspended after 90 days and the associated data is deleted after 120 days. We give notice before each step so that you can resume the subscription or ask us for a copy of your data.
• On deletion. When you delete your account, or when the period above expires, we delete your personal data and Your Content, including the copy we keep in Botswana. Copies may persist in routine backups for a limited period before those backups expire.
• Records we keep longer. We retain billing records, and records of your acceptance of our Terms and this Policy, for as long as required to meet our legal, accounting and evidential obligations.

9. Security

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including encryption of data in transit, access controls that restrict each account to its own data, and restricted administrative access. No system is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and the relevant authority where the law requires it.

10. Your rights

Under Botswana’s Data Protection Act, 2024 you have the right to:

• access the personal data we hold about you;
• have inaccurate personal data corrected;
• have your personal data erased;
• object to, or ask us to restrict, our processing of it;
• obtain a copy of your data in a portable form, or ask us to transfer it;
• withdraw your consent, where we rely on consent to process; and
• complain to the supervisory authority in Botswana.

To exercise any of these rights, contact us at the address in section 12. We will respond within the period required by law. There is no fee, although we may charge a reasonable fee for requests that are unfounded, repetitive or excessive.

Where you have uploaded material about your own clients, you are the party responsible to those individuals for their data. We process that material on your instructions, and we will assist you in responding to any request you receive about it.

11. Cookies, children and changes

• Cookies. We use cookies only for the things the Service cannot work without: keeping you signed in between pages, and remembering preferences such as your theme. We do not use advertising cookies, and we do not use cookies to follow you across other websites. You can configure your browser to refuse cookies, but you will then be signed out on every page and most of the Service will not work.
• Usage measurement. We measure how the Service and our website are used, for example which pages are visited and which country a visit came from. This is done with a privacy-preserving analytics tool that reports aggregate figures only. It sets no cookies, stores nothing on your device and does not build a profile of you or identify you as an individual, which is why we do not ask you to accept a cookie banner.
• Children. The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children.
• Changes to this Policy. We may update this Policy. When we do, we will publish the amended version with a new version identifier and update the date at the top of this page. Where the change is material we will notify you in the Service or by email, and where appropriate ask you to accept the amended Policy before continuing to use the Service.

12. Contact us

For any question about this Policy, or to exercise any of the rights in section 10:

Afronative Solutions (PTY) LTD
Email: support@lexi.co.bw