Privacy policy

The short version

• We never use your content, or your clients' data, to train AI models, and neither do our service providers. An AI app you connect yourself follows its own provider's terms.
• Your data is stored in Singapore and encrypted at rest and in transit.
• We don't sell data, show ads or use tracking or analytics cookies.
• Archived collections are deleted after 90 days, and an account's data within 30 days of a request to delete it.

Who is responsible for what

For owners (the consultants and businesses who sign up), we decide how your account data is used, and this policy covers it.

For clients who are invited to a collection, the owner decides what content to publish and whom to invite. We store and process that content and those email addresses for the owner, on their instructions. If you are a client, the owner who invited you is your first point of contact. We will help them, or you, with any request.

What we collect

From owners:

• your name, email address and, if you sign in with Google, your profile picture;
• your business details and branding (name, logo, colour, contact email or WhatsApp number);
• the content of your collections and pages, including every saved version;
• the AI apps you connect, and a log of what they did in your account.

About clients, from the owner and from using Lexill:

• email address, and which collections it was invited to;
• when each page was opened. We don't store IP addresses with these records;
• the delivery status of the emails we send (sent, delivered, opened or bounced). Opens are detected by the email provider;
• login links, sign-in sessions and email preferences.

Like any website, our hosting provider keeps short-lived request logs, which include IP addresses, for security and troubleshooting. They are deleted after 30 days.

How we use it

• to run Lexill: show your pages to the people you invite, send invites, login links and update emails, and keep your versions;
• to secure the service, and to prevent and investigate abuse;
• to support you, and to tell you about important changes to Lexill or to these policies;
• to meet legal obligations.

We don't use your data for anything else without asking.

AI models

We never use your content, or your clients' data, to train or improve AI models, and our service providers listed below don't either. Lexill itself doesn't send your content to an AI model.

The one exception is an AI app you connect yourself, such as Claude. It reads and writes your pages on your behalf, so your content passes through it. Whether its provider uses that content, including for training, is covered by your agreement with them, not by this policy. Check their settings if that matters to you.

Where your data is stored, and who processes it

We run Lexill from Malaysia, and your data is stored in Singapore, encrypted at rest and in transit. Singapore has data protection law comparable to the PDPA. We use these service providers, each bound to protect your data and to use it only to provide their service to us:

• Supabase, on Amazon Web Services in Singapore: database and sign-in.
• Google Cloud, in Singapore: hosting.
• Google: sign-in with Google, if you choose it.
• Resend: sending email. To deliver a message, email providers may process the recipient's address and the message outside Singapore.
• Sentry, in the United States: reports of server errors, so we can fix them. A report describes the failure, such as the page address and the error. We remove cookies, sign-in tokens and IP addresses before it is sent, and never include page content on purpose.
• Upstash, in Singapore: short-lived counters, namely which client opened which page and when, before we move it into our database each day, how many changes an account made recently, and how many password attempts came from an IP address in the last few minutes. Each is kept for at most 9 days.

Wherever your data is processed outside Malaysia, we make sure it is protected to a standard comparable to the PDPA. We will update this list before adding a provider.

How long we keep it

• Pages and their versions: while the collection is active. You can delete them sooner by archiving the collection.
• Archived collections: deleted 90 days after archiving, unless you restore them first.
• Your account: all its data is deleted within 30 days of your request to delete it. Delete it from Settings, then Account, or email [email protected] from the address you sign in with.
• Page view records: 12 months.
• Client sign-in sessions: 30 days, or until the client signs out or is removed.

Deleted data can remain in our encrypted database backups for up to 7 more days, until those backups expire. We don't restore it from them except to recover from an incident.

Cookies

We only use cookies that Lexill needs to work: one keeps owners signed in, and one per owner's account keeps clients signed in. Client cookies are sent only to client pages, under /p, and never to the dashboard. We use no analytics, advertising or tracking cookies.

Your rights

Under the PDPA you can ask to see the personal data we hold about you, correct it, have it sent to another service (data portability), stop processing that is likely to cause you damage or distress, or withdraw your consent to how we use it. We don't send direct marketing. Owners can also export pages as Markdown and ask us to delete their account. Clients can ask us to stop emails at any time without losing access.

Write to [email protected]. We reply within 21 days. Withdrawing consent may mean we can no longer provide Lexill to you, and we will say so.

Security and breaches

Accounts are isolated from each other, client login links work once and expire after 15 minutes, and access is limited to what is needed to run the service. If a data breach must be reported under the PDPA, we will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of it, and tell the people affected without unnecessary delay.

Children

Lexill is for businesses and isn't meant for anyone under 18.

Changes

We will post any change here and update the date above. For material changes, we will email owners at least 30 days before they take effect. The terms of use explain more.

Contact

Our data protection contact: [email protected]. If you're not satisfied with our answer, you can complain to Malaysia's Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).