Privacy Notice

1. Who we are

Jones Smith, a sole trader based at Kingston, Jamaica, trading as LexReply ("we", "us"), provides legal support and AI intake services. For personal data we process about our clients, portal users and website visitors, we act as the data controller. Where we process matter data and caller information on behalf of a law firm client, we act as a processor under that firm's instructions and our engagement terms.

2. Personal data we collect

• Account data — name, firm name, email address, phone number, login credentials, country/jurisdiction.
• Service data — matters, requests, uploaded documents, invoices, contracts and e-signature records (typed name, timestamp, IP address).
• Call intake data — caller phone number, call recordings/transcripts, AI-generated summaries and booking details captured by our AI receptionist on behalf of your firm.
• Support data — messages and attachments you send us.
• Usage and device data — IP address, browser and device identifiers, pages viewed, log and telemetry data.

Card and billing details are collected and processed directly by Paddle, our Merchant of Record — we do not store full payment card data.

3. Why we use it, and our legal basis

• Create and manage accounts; deliver the Service — performance of a contract.
• Process intake calls, generate transcripts, summaries and bookings — performance of a contract, and our clients' instructions.
• Invoicing, subscription management and tax compliance — contract and legal obligation.
• Security, abuse and fraud prevention — legitimate interests in protecting the Service.
• Support and service communications — contract and legitimate interests.
• Product improvement and analytics — legitimate interests (or consent where required).
• Marketing emails — consent, withdrawable at any time.

4. Who we share data with

• Service providers / subprocessors — cloud hosting and managed database infrastructure, transactional email delivery, AI voice and language-model providers used to run call intake and generate transcripts and summaries, and customer support tooling. These providers act on our instructions under written data-processing terms.
• Paddle, our Merchant of Record, for the sale of our products, subscription management, payments, invoicing, refunds and tax compliance. Paddle acts as an independent controller for payment and tax data — see Paddle's privacy policy.
• Professional advisers — legal, accounting and audit.
• Authorities — where required by law or to establish or defend legal claims.

We do not sell personal data.

5. International transfers

We are based in Jamaica and use providers located in the United States, the United Kingdom and the European Economic Area. Where personal data is transferred out of the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

6. Retention

We keep account and matter data for as long as your account is active and for up to 12 months after closure, unless a longer period is required for tax, accounting or legal-claim purposes (typically up to 7 years for billing records). Call recordings and transcripts are retained for 90 days by default and are automatically deleted after 90 days, unless your firm selects a longer retention period in the portal under Settings. You can download all of your call recordings, transcripts and other records at any time using the self-serve "Export All Data" button in Settings, and for 30 days after your account closes. When data is no longer needed it is deleted or anonymised.

6a. HIPAA and call-recording consent

We are NOT a HIPAA covered entity. LexReply is not a covered entity or business associate under HIPAA and the Service is not designed for the processing of protected health information. Clients are responsible for obtaining client consent to record calls per their jurisdiction, including any one-party or two-party consent requirements, call-recording notices and disclosures that apply to their callers.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to receive a portable copy, and to withdraw consent. Requests can be sent to LexReply@gmail.com and we will respond within one month. UK/EEA users also have the right to complain to their local supervisory authority; Jamaican users may complain to the Office of the Information Commissioner.

8. Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, row-level database security, least-privilege access for staff, and NDAs with everyone who handles client matters. No system is perfectly secure, but we review our controls regularly and notify affected parties where required by law.

9. Cookies

We use essential cookies for login sessions and security, and limited analytics cookies to understand how the site is used. We do not use advertising cookies. You can block or delete cookies through your browser settings; blocking essential cookies will prevent you from signing in.

10. Contact

Jones Smith, trading as LexReply — Kingston, Jamaica — LexReply@gmail.com