Privacy Policy

Last updated: October 12, 2026

1. Who this policy covers, and the two roles LexCard plays

This Privacy Policy explains how Magellan Publishing Inc., operating as LexCard ("LexCard," "we," "us"), collects, uses, and shares personal information through the LexCard website and platform (the "Service").

LexCard plays two different roles depending on whose information is involved, and it matters which one applies to you:

• For our own customers — the lawyers, firm administrators, and staff who hold a LexCard account, and visitors to our marketing site — we are the business responsible for that data (sometimes called a "controller" or "business" under privacy law). This policy describes that relationship directly.
• For the prospective clients and other visitors who chat with a customer's AI Concierge, fill out an intake form, or send a document through a customer's card (an "End User"), we act on behalf of that LexCard customer (sometimes called a "processor" or "service provider"). The customer — the lawyer or firm whose card the End User interacted with — decides why and how that information is collected and used, and is the right party to contact about it. We process it only under their instructions and this policy, and we describe that relationship in Section 10 below. If you are an End User and want to exercise a privacy right over information you shared through a LexCard-powered chat, intake form, or document request, please contact the lawyer or firm directly; we will assist them in responding.

2. Information We Collect

2.1 Account and billing information. When you register, we collect your name, email address, a hashed password, and, for a firm account, firm name, website, phone, and address. Payments are processed by Stripe; we receive and store billing status and a reference to your Stripe customer/subscription record, but we do not receive or store your full card number.

2.2 Professional and card information. To build your digital card, we collect what you choose to include: title, licence/bar number, jurisdiction, practice areas, languages, phone, email, website, address, photo, biography, social and booking links, and similar professional details.

2.3 Verification records. Where you hold out as a licensed lawyer or paralegal, we verify your identity and your standing before your card can show a Verified badge. To confirm your identity, we use Stripe Identity, our identity-verification subprocessor: you submit a photo of a government-issued ID and a live selfie, and Stripe compares them to confirm you're a real person and that your face matches your ID. We do not receive or store the ID image or selfie ourselves — Stripe processes and retains that data on our behalf, for the retention periods described in Section 6. We separately collect your bar/licence number and jurisdiction to periodically check your standing against your regulator's public register (your law society or bar association, depending on jurisdiction) and keep a record of each check (date, result, who performed it, and, optionally, a screenshot of the public registry page as evidence). Because that screenshot captures only publicly available registry information, we do not encrypt it at rest the way we do the sensitive documents described in Section 2.4 below. We also receive the name as confirmed on your ID — not the ID image or selfie itself — so we can automatically check it against the name on your card; if that automatic check cannot confirm a match, we keep the ID-confirmed name only until a staff member reviews the two names and resolves the flag, then delete it (see Section 6).

2.4 End User / lead information. Where a visitor interacts with a customer's AI Concierge, we collect the conversation itself, along with any name, email, or phone number the visitor shares in it. If the visitor goes on to complete an intake form, we additionally collect fields such as date of birth, mailing address, referral source, payer information, and a privacy acknowledgment the customer's intake form asks for. If the visitor uploads identity documents or other matter-related documents at the customer's request, we store those files encrypted at rest (AES-256 with a per-file key) and accessible only to the relevant customer account.

2.5 Usage data. We record first-party usage events on a customer's card — page views, contact saves, chats started, and shares — to power that customer's own analytics. If a free-tier card's "Powered by LexCard" link brings in a new signup, we record which card referred it, for our own growth analytics. We do not use third-party advertising or analytics cookies, and as of this policy's date, the Service loads no Google Analytics, advertising pixel, or similar third-party tracker. Authentication uses your browser's local storage to hold a session token, not a tracking cookie, and clears when you sign out or clear site data.

2.6 Technical/log data. Like most web services, our hosting providers automatically log standard technical information (such as IP address, browser type, and request timestamps) for security and operational purposes.

3. How We Use Information

We use the information above to: provide and maintain the Service (render your card, generate your signature, run the AI Concierge, manage billing); verify and display licensing status where applicable; communicate with you about your account, leads, and service updates; provide customer support; maintain security and prevent abuse; and improve the Service. Where we act as a service provider for End User data (Section 1), we use that data only to operate the Service on the relevant customer's behalf, never for our own independent marketing or analytics purposes.

4. The AI Concierge and Third-Party Processing

When a visitor chats with the AI Concierge, the conversation is sent to our AI provider, Anthropic, to generate a response. Anthropic processes that content under its own API terms, which — as of this policy's date — do not use API inputs or outputs to train Anthropic's models without separate consent; we'd encourage checking Anthropic's current policies directly if that matters to you, since providers update these terms periodically. We retain the conversation as part of your lead record if you are the receiving customer, and as described in Section 1 if you are the End User who sent it.

5. How We Share Information

We share information with the following categories of service providers, each under contractual confidentiality and security obligations, and only as needed to provide the Service:

• Stripe — payment processing and subscription billing.
• Stripe Identity — identity verification (government ID and selfie check) for licensed cardholders seeking the Verified badge; see Section 2.3.
• Resend — transactional email delivery (account notices, lead alerts, verification emails).
• Anthropic — AI Concierge conversation processing, as described in Section 4.
• Railway — application hosting and database infrastructure.
• Hostinger — static website hosting for lexcard.io.
• Zapier, and your own connected tools (such as Clio Manage) — only where you, as a customer, choose to connect your own Zapier automation to push intake or document data into your own account with that tool. We do not have our own direct connection to Clio Manage or any practice-management platform; that connection is yours, and governed by your agreement with Zapier and that tool.

We may also disclose information where required by law, to protect the rights, safety, or property of LexCard or others, or in connection with a merger, acquisition, or sale of assets (with notice as required by law). We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

6. Data Retention

We retain account, card, and billing information for as long as your account is active and as needed to comply with legal, tax, and accounting obligations after closure. We retain verification check records, including screenshots, as part of our ongoing compliance record. Where our automatic identity name-match check (Section 2.3) flags a possible mismatch, we retain the ID-confirmed name only until a staff member resolves that flag, then delete it. Identity verification data (ID document images and selfies) is retained by Stripe Identity on our behalf, not by us directly: non-biometric verification data for up to 3 years, and biometric data (selfie images) for up to 1 year, after which Stripe automatically deletes it. We retain End User/lead data (conversations, intake forms, uploaded documents) for as long as the receiving customer's account remains active, or until the customer deletes it; a customer can request deletion of a specific document or lead through the dashboard.

7. Data Security

We use industry-standard safeguards appropriate to the sensitivity of the data involved, including password hashing (bcrypt), encrypted transmission (HTTPS), and application-layer encryption (AES-256) for identity documents and other sensitive uploads. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Privacy Rights

8.1 Canada (PIPEDA). As a Canadian business, we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act. You may request access to, or correction of, your personal information, and may withdraw consent for optional uses, by contacting us at info@lexcard.io. If you believe we have not handled a concern appropriately, you may complain to the Office of the Privacy Commissioner of Canada.

8.2 California (CCPA/CPRA). If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you; to request deletion; to request correction; to opt out of the sale or sharing of personal information and of the use of your sensitive personal information beyond what's necessary to provide the Service; and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA. Unlike many other states, California's privacy law applies to business-contact and employment-context personal information too, not only to individuals acting as personal consumers — so these rights may extend to your business-contact information as a LexCard customer, not only to End User data. You can exercise these rights by contacting us at info@lexcard.io; we will verify your request before acting on it.

8.3 Other US state privacy rights. Depending on your state of residence, you may have similar rights — to access, delete, correct, or obtain a portable copy of your personal information, and to opt out of targeted advertising, the sale of personal information, or profiling used for certain automated decisions — under the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, among other states as their laws take effect. As noted above, we do not sell personal information, engage in cross-context behavioral advertising, or use automated profiling to make legal or similarly significant decisions about you, which covers most of what these rights address. Most of these states, unlike California, limit "consumer" rights to information about you in a personal or household context, and generally do not extend them to your information in a business or employment capacity (such as your details as a paying LexCard customer) — California is the exception described above. Where applicable, we honor recognized universal opt-out signals, including Global Privacy Control, for the browsers and states that require it. To exercise any of these rights, contact us at info@lexcard.io; we will not discriminate against you for making a request.

8.4 End User rights. If you are an End User whose information was collected through a LexCard customer's card, chat, or intake form rather than through your own LexCard account, please direct rights requests to that lawyer or firm, who controls that data; we will assist them in fulfilling a verified request as required by applicable law.

8.5 International users. If you access the Service from outside Canada or the United States, your information will be processed in Canada and/or the United States as described in Section 9, which may have different data protection laws than your home jurisdiction. By using the Service, you consent to that processing to the extent consent is the appropriate legal basis under your local law.

9. International Data Transfers

Our service providers, including our hosting infrastructure, are located in Canada and the United States. By using the Service, you understand that your information may be transferred to, stored, and processed in either country.

10. LexCard as Service Provider for End User Data

Where we process End User/lead data on behalf of a LexCard customer (Section 1), we do so only under that customer's instructions and for the purpose of providing the Service to them — not for our own independent purposes, and not combined with other customers' data for our own analytics or marketing. Our relationship with each customer regarding that data is governed by our Terms of Service and this policy, which together serve as our data processing terms with that customer.

11. Children's Privacy

The Service is intended for licensed professionals, their staff, and adult members of the public contacting them, and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at info@lexcard.io and we will delete it.

12. Cookies and Similar Technologies

As described in Section 2.5, the Service does not currently use third-party advertising or analytics cookies. We use your browser's local storage only to keep you signed in. If this changes — for example, if we add a first-party or third-party analytics tool — we will update this section and, where required, request your consent first.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last updated" date and, for material changes, provide reasonable notice before they take effect.

14. Contact Us

Magellan Publishing Inc.

71 Wilson Street East, Ancaster, Ontario L9G 2B3

info@lexcard.io

If you are not satisfied with our response to a privacy request, Canadian residents may contact the Office of the Privacy Commissioner of Canada, and California residents may contact the California Privacy Protection Agency.