Privacy Policy — LexVibe
Last updated: July 17, 2026 · Drafted with AI — the same transparency standard we apply to every document we generate. The English version is the binding one.
Who we are & our two roles
LexVibe ("we") provides drop-in legal-compliance tooling for apps: hosted legal documents, a cookie-consent widget, EU AI Act tooling and integrations for AI coding agents. Contact: hola@golexvibe.com · golexvibe.com/support.
We act in two distinct roles: as controller for our own customers (your account, billing, emails), and as processor for your visitors' data when our widget records consent on your behalf — that processing is governed by our Data Processing Agreement (available in your dashboard under DPA), which covers Art. 28 GDPR: instructions, sub-processors, security, audits and deletion/return.
Data we process
- Account data — your email address (magic-link login), name and profile preferences (language, notification settings), stored in Supabase (EU project).
- App metadata — the name, domain or store-listing URL and detected technologies of apps you protect, used to generate and host your legal documents.
- Consent records — when your visitors interact with the cookie banner we store a proof-of-consent event (choice, categories, timestamp, page URL, a salted visitor hash and the Global Privacy Control signal) on your behalf as processor. We do not build visitor profiles and never sell data.
- Billing — handled by Stripe; we store your subscription status and Stripe identifiers, never card numbers.
- Emails — transactional only (welcome, drift alerts, legal-update alerts), sent via Resend. You can switch off non-essential alerts in Settings → Notifications. No marketing without opt-in.
- Integrations you connect — GitHub (repository names and manifest files of repos you link) and Vercel (project list and production domain; the OAuth token is stored encrypted). Disconnect at any time from the dashboard.
- AI generation — document generation sends your app metadata (never your visitors' data) to Anthropic's API. Generated documents are 100% AI-produced and labeled as such.
- MCP servers & free checker — anonymous, rate-limited by IP. URLs you submit are fetched once for analysis and not retained beyond operational logs.
Legal bases
Contract performance (account, hosted documents, widget, integrations), legitimate interest (security, rate limiting, first-party product analytics without third-party trackers), legal obligation (billing records) and consent where required.
Retention
- Account and app data: while your account exists; deleted or anonymised within 30 days of account deletion.
- Consent records: kept as compliance evidence for as long as you instruct us as processor (you can export them as CSV or delete the app at any time).
- Billing records: as long as tax law requires.
- Operational logs: short rotation, security purposes only.
Processors & international transfers
Supabase (database/auth, EU region), Vercel (hosting/CDN), Stripe (payments), Resend (email), Anthropic (AI generation), GitHub and Vercel APIs (optional integrations you connect). Some providers process data in the United States; where they do, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses, with the providers' own security certifications on top.
Security
Data is encrypted in transit (TLS) and at rest; OAuth tokens are additionally encrypted at the application layer; access is role-based with row-level security in the database; webhooks we send are HMAC-signed so you can verify origin. No method is 100% secure, but we ship the same protections we recommend.
Your rights
Under the GDPR you can access, rectify, erase, restrict, port and object. Write to hola@golexvibe.com — we answer within 30 days. You may lodge a complaint with your supervisory authority (in Spain, the AEPD). If your data was collected by one of our customers' apps (e.g., a cookie banner you interacted with), contact that app's owner — we will assist them as processor.
Children
LexVibe is a business tool and not directed at children under 16.
Cookies
Our own site uses only strictly necessary cookies (session, language preference). We run our own widget — practice what we ship.
Changes
We will notify material changes by email or in-app. The date above always reflects the current version.