LexContinuum ("we", "us" or "our") is the data controller for the personal data of people who create accounts and use the Service. You can contact us at stakweblimited@gmail.com.

Where you put other people's personal data into the Service (for example your clients' details), you are the data controller for that data and we process it on your behalf. See section 12.

We collect only what we need to run the Service. Depending on how you use it, that is:

• Account details: your name, email address, and your password (we keep only a salted hash, never the password itself). If you sign in with Google, we receive your name, email address and Google's identifier for you.
• Content you provide: documents you upload, drafts and documents you create, research questions and searches you make, items you save, and, if you use the practice tools, case, matter, client, hearing, invoice, accounting and CV records and the notes and attachments you add.
• Payment details: the plan and amount, the date and status of the payment, the payment reference and receipt number from the payment provider, and the mobile-money phone number you give us when you ask for a payment prompt. Your card details and your mobile-money PIN go to the payment provider and never reach us.
• Technical and security data: the Internet address (IP address) your requests come from, your browser and device type, the time of requests, sign-in sessions, and records we need to limit abuse (for example how many sign-in, reset or search attempts came from an address in a short time).
• Error and usage data: reports of faults (which exclude what you typed, your cookies, your email address and your name) and a small number of product events such as 'payment succeeded', each tied only to a numeric account number and your plan.
• Messages: emails you send us and the emails we send you (for example verification codes, password resets, receipts and reminders).
• Sign-up confirmations: when you confirmed that you are 18 or over, agreed to the Terms and read this Privacy Policy, the version of each document you were shown, and whether (and when) you chose to receive marketing. We keep these as the record of what you agreed to, and you can see them under Data protection.

We do not knowingly collect sensitive personal data from you about yourself. If you or your clients' records contain sensitive personal data (for example health, family or criminal matters), you are responsible for having a lawful basis to enter it, and it is protected in the same way as the rest of your content.

We use personal data only for purposes we have told you about, and only where the Data Protection Act allows it:

• To create and run your account and give you the Service you asked for (performance of our contract with you).
• To take payments, issue receipts and keep the financial records the law requires (performance of the contract and compliance with legal obligations).
• To keep the Service secure, prevent fraud and abuse, and fix faults (our legitimate interest in running a safe service, and compliance with the law).
• To send you service messages: verification codes, password resets, receipts and reminders about plans and diary dates that you set (performance of the contract). We send product updates and marketing email only if you tick the optional box when you sign up, or switch it on later under Data protection. It is never a condition of using the Service.
• To understand, in aggregate, whether the Service works and how it is used, so that we can improve it (our legitimate interest; see section 9 on analytics).
• To respond to your requests and to comply with court orders and other legal requirements (legal obligation).
• Where we rely on your consent (for example marketing email), we ask for it separately from the Terms, we keep a record of when you gave it, and you can withdraw it at any time under Data protection or by contacting us. Withdrawing does not affect your access to the Service.

The research, drafting, contract review, case brief, document analysis, resume and similar features are powered by artificial-intelligence models run by other companies (AI providers). Because the content of a law firm's files is confidential, these features are protected in the following ways. They apply to every AI request that relates to a client, a matter, a document or a draft.

• Identifying details are replaced before anything is sent. The names of your clients, their contacts and the parties and other sides of your matters, and details such as email addresses, telephone numbers, ID and passport numbers, KRA PINs, bank account numbers and land reference numbers, are replaced with placeholders (for example [PARTY_1]). The AI provider receives the placeholders, not the details. When the answer comes back, the placeholders are replaced with the real details on your screen, on our server, and the AI provider never sees them. This protects what we can recognise: a name that appears only in free text and is not yet on your client list or in your matter's parties may not be recognised, so record parties on the matter and client files.
• Only approved providers are used for confidential content. In the default (strict) setting, the administrator approves which AI providers may receive client and matter content. Free AI models are not used for it, and if the chosen provider fails, the request is not quietly sent to a different one: you are told instead. Providers hosted in China are not approved by default. Where a provider offers a setting that asks it not to keep or train on a request, we send it (for example zero-data-retention routing through OpenRouter, and storage switched off with OpenAI).
• We do not train AI models on your content, and we do not keep a copy of your requests or of the AI's answers other than the results you save in your account (such as a draft) and research answers that could not be finished. Those are kept against your account for up to seven days, so you can continue them after leaving the page, reloading or signing out; they are deleted as soon as the answer is finished or you dismiss them, and no one else can see them.
• Every AI request is recorded without its content. The record shows the date, the feature, the provider and model, how many identifying details were replaced and whether the request went through or was refused. You can see your own record under Data protection, and show it to a client or to the Data Protection Commissioner.
• You can switch AI off for client and matter data. Under Data protection, a firm can turn off every AI feature that touches client or matter data. The AI features that do not use a client's information are not affected.
• Semantic search. Documents you upload are never sent to the provider that turns text into search vectors. Only the shared library is. Your search questions are sent to it with identifying details and the names of your clients and parties replaced where we can recognise them.
• What we cannot control. Once text reaches an AI provider, what the provider does with it is governed by its own terms and by the agreements the operator has with it. Some providers keep requests for a limited period for security or abuse prevention unless a zero-retention agreement applies. Replacing identifying details reduces what a provider can learn, but the facts of a matter can themselves identify people. Providers are based in several countries, including the United States, and their servers may be outside Kenya (see section 6).
• AI output can be wrong. See the Terms and Conditions: you must check it before relying on it.
• Your professional duties remain yours. If your duty of confidentiality, or an agreement with your client, limits what may be shared with service providers, take that into account: switch AI off for that matter's data, anonymise the facts, or get your client's consent first.

We do not sell your personal data. We share it only with the people who help us run the Service (called processors), and only for that purpose:

• Hosting and delivery: Vercel (the website and application servers).
• Database and file storage: Neon (database, in London), Cloudflare R2 and Vercel Blob (stored files and the search index), and Zilliz (search by meaning).
• AI providers: as described in section 4.
• Payments: Paystack, and the mobile-money and card networks that carry the payment, including Safaricom (M-Pesa) and Airtel Money. They are independent controllers of the payment details you give them and have their own privacy notices.
• Email delivery: the email service we have configured to send you messages.
• Sign-in: Google, if you choose to sign in with Google.
• Error monitoring: Sentry. Analytics: PostHog (only if switched on).
• Professional advisers (lawyers, accountants, auditors) who are bound by confidentiality, and insurers.
• Courts, tribunals, regulators and law-enforcement bodies, where the law requires or a valid order compels us to disclose, or to protect our rights, our users or the public. Where we can, we will tell you first.
• A buyer or successor, if the business or the Service is sold or reorganised, who will be bound to protect your data on terms no less protective than these.

We require our processors to protect personal data, to use it only on our instructions and to keep it confidential.

Some of our processors store or process data outside Kenya, for example in the United Kingdom, the European Union, the United States and, if the administrator approves such a provider, China. Where we transfer personal data abroad we do so in line with the Data Protection Act, relying on appropriate safeguards (such as contracts and the processors' security commitments), and on your consent where the law asks for it. By using the Service you agree to these transfers.

We keep personal data only as long as we need it for the purposes in this policy:

• Account and content: while your account is open (except drafts, below). If you ask us to delete your account, we delete or anonymise your account and content within a reasonable time, except what we must keep by law.
• Drafts and contract reviews made in the drafting studio: deleted automatically seven days after they are created, unless you have attached them to a matter. Download or export what you need before then.
• Payment and accounting records: for as long as tax, accounting and other laws require.
• Sign-in sessions end after 48 hours of inactivity (one week for a linked account, two hours for administrators) and in any case after 14 days. Verification codes and password-reset links expire within minutes or hours and are then useless.
• Security and rate-limit records are short-lived. Error reports are kept for a limited period.
• Backups: deleted data may remain in backups for a short further period until they are overwritten.

We use measures that are appropriate to the risk: encrypted (HTTPS) connections, hashing of passwords, access limits so that you see only your own records, rate limiting, short-lived sessions, scrubbing of error reports, and encryption at rest provided by our hosting and storage providers. No system is completely secure, and we cannot promise that data will never be accessed without authority.

Administrators of the Service have no screen or tool in the application for reading the content of your account (your clients, matters, drafts, documents, invoices and similar records). They see only account details, plan and usage totals. Technical access to our hosting and database is limited to what is needed to run, secure and support the Service.

If a breach is likely to put your rights at risk, we will tell the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you without unreasonable delay, as the Data Protection Act requires.

You also help to protect your data: choose a strong, unique password, keep it secret, sign out on shared devices, and tell us at once if you think someone else has used your account.

• Essential cookie: we set one sign-in cookie (lex_session) so that you stay signed in. The Service cannot work without it.
• Your browser's local storage keeps small preferences, such as whether the side menu is collapsed. It holds no personal data.
• Analytics: if switched on, PostHog receives page views and a few named events. It does not automatically capture what you click or type, does not record sessions, keeps its identifier in memory only (not in a cookie), and is not loaded if your browser sends a 'Do Not Track' signal.
• We do not use advertising or cross-site tracking cookies.

Under the Data Protection Act, 2019 you have the right, subject to the conditions in the Act, to:

• be told how your personal data is used (this policy does that);
• ask for a copy of the personal data we hold about you;
• object to our processing of it;
• ask us to correct personal data that is false or misleading;
• ask us to delete personal data that is false, misleading or no longer needed;
• ask for your data in a structured, commonly used form, and to have it sent to another controller where this is technically possible;
• withdraw your consent where we rely on it, without affecting what was done before you withdrew it.

To use any of these rights, write to stakweblimited@gmail.com. We may need to confirm who you are first. We will answer within the time the law sets (generally 30 days). If you are not satisfied, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke), and you may also go to court.

The Service is for people aged 18 and over. We do not knowingly collect personal data from children. If you think a child has given us personal data, tell us and we will delete it.

If you enter personal data about other people (clients, opposing parties, witnesses, staff, advocates) into the Service, you are responsible for having a lawful basis and any consent needed to do so, for keeping it accurate, and for meeting your professional duty of confidentiality and any duty to the people concerned. For that data we act as your processor: we process it only to provide the Service to you, on your instructions, and we keep it confidential and secure.

We do not read your content except where it is necessary to provide or secure the Service, to resolve a fault you report, or where the law requires.

The Service links to, and shows information from, other sources, such as Kenya Law, the Law Society of Kenya and the Judiciary of Kenya. We do not control them, and this policy does not cover how they handle personal data. When you use their sites, their own notices apply.

We may update this policy. We will post the new version on this page with a new effective date, and if the change is important we will also tell you by email or in the Service. Using the Service after the effective date means you accept the update; if you do not accept it, you should stop using the Service and ask us to delete your account.

Questions, requests and complaints about personal data: stakweblimited@gmail.com.