Privacy Policy
Effective July 11, 2026 · Last updated July 18, 2026
Lex is an AI cofounder for early-stage founders, operated by Kolkar Technologies Inc., 148 Albany Ave, Hamilton, Ontario, Canada. This policy explains what we collect, why, who processes it, and the choices you have. Sebastian Kolimaga is the person responsible for privacy compliance (including as the person in charge of the protection of personal information under Quebec's Law 25). Questions: sebastian@lexlaunchcrew.com.
What we collect
- Account: your email address, a salted hash of your password (we never store the password itself), and whether you opted in to emails at signup. A session cookie keeps you logged in for up to 30 days.
- Content you give Lex: your business plan, the hypothesis board built from it, your Context-tab answers about the business, interview notes and transcripts you paste or upload, descriptions of who you interviewed, and your chat messages with Lex (we keep the most recent portion of the conversation). Documents you upload (PDF, Word, Markdown) are converted to text in memory — the file itself is never stored.
- Payments (Lex Pro):payments are processed by Stripe — your card number never touches our servers. We store your subscription status and a Stripe customer reference so the app knows you're Pro. Deleting your account automatically cancels any active subscription.
- Abuse prevention:at signup we keep a salted hash of your network address for 24 hours, to limit mass account creation. We can't read the address back from the hash, and it is deleted automatically.
- GitHub (optional): if you connect a repository, we store the repository name, the read-only access token you provide, and recent commit messages so Lex can flag overbuilding. We never store your code.
- Outreach (optional):if you use the Outreach tool, we store the business leads in your campaigns — business names, websites, published business contact details (including email addresses found on the business's own website or public map listings, recorded together with where they were published), your notes, the emails you draft and approve, replies you paste in for guidance, and a suppression list of addresses that asked you to stop. If you connect Gmail, we store the connected address and a send-only token — we cannot read your inbox. If you connect another mailbox (for example Spacemail) instead, we store that address and its password/app-password server-side, the same way we store GitHub tokens — it is used only to send the emails you approve and is never shown back to your browser. See "Outreach leads" below.
- Pro waitlist (optional): if you join the Lex Pro waitlist, we store your email address with your entry. It is removed if you delete your account.
- Usage data:product events (e.g. "plan analyzed", "debrief run") tied to a random internal ID, used in aggregate to understand whether Lex works. Page-view analytics via Vercel Web Analytics, which does not use cookies or track you across sites.
The login session cookie is the only cookie Lex sets. There are no advertising, tracking, or third-party cookies.
Interview transcripts contain other people's information
Transcripts you upload usually include what your interviewees said. You are responsible for having the appropriate consent to record or transcribe those conversations. We process transcript content only to produce your debrief and update your board; we don't contact interviewees, build profiles of them, or use their information for anything else. Deleting your account deletes the transcripts.
Outreach leads are other businesses' information
The Outreach tool helps you email businesses and founders about your product. It is built to keep that lawful: it only collects contact details that the business itself published (its own website or public map listing) and records where each address was found; every email you send automatically includes your name, your mailing address, and a working way to opt out; addresses that opt out go on a do-not-contact list that is enforced before every send; each contact is emailed at most once per campaign; sends are capped daily; and nothing is ever sent without you approving the exact text. Uploaded lists must be ones you collected yourself — purchased or scraped lists are not allowed. You are the sender of these emails and responsible for the laws that apply to you (CASL in Canada, CAN-SPAM in the US); don't use Outreach to email recipients in jurisdictions that require prior consent for cold email (for example, Germany). If a business whose details appear in a user's campaign wants them removed, email sebastian@lexlaunchcrew.com and we'll handle it.
How we use your information
- To provide Lex: analyzing your plan, prepping and debriefing interviews, and chatting with you.
- To send account emails (password resets). If you ticked the opt-in at signup, also occasional product updates and requests for feedback from the founder — every such email tells you how to opt out, and you can withdraw consent anytime by emailing us. If you didn't opt in, you get account emails only.
- To process Lex Pro payments and manage subscriptions (via Stripe).
- To measure, in aggregate, whether the product works (event counts, retention).
- To publish aggregate, fully anonymized statistics about Lex (for example, "founders have sent X approved emails through Lex") — never anything that identifies you or your business.
- To keep the service secure, rate-limited, and free of throwaway-account abuse.
We do not sell your information or share it with advertisers, and we never will without asking you first.
AI processing
Lex's intelligence comes from third-party AI models (currently Anthropic's Claude, with Google models as fallback), reached through Vercel's AI Gateway. Your plan, transcripts, chat messages, and — if you use Outreach — lead details, your pitch, and replies you paste in for guidance are sent to these providers to generate Lex's responses. Under the API terms we rely on, these providers do not use your content to train their models.
Who processes data on our behalf
- Vercel (hosting, AI Gateway, cookieless page analytics) — USA
- Stripe (payment processing for Lex Pro) — USA
- Upstash (database) — USA
- Anthropic and Google (AI model responses) — USA
- Our email provider (password-reset delivery)
- GitHub (only if you connect a repository)
- Google (only if you connect Gmail for Outreach — used solely to send the emails you approve)
Your data is stored on servers in the United States. If you use Lex from Canada, the EU, or elsewhere, you consent to this transfer — it is protected by our processors' contractual safeguards.
How long we keep it
- Your account and workspace: until you delete your account.
- Outreach campaigns, leads, and connected email accounts: until you delete them or your account.
- Chat history: only the most recent portion of your conversation is retained.
- Daily AI-usage counters and signup abuse-prevention hashes: 24 hours.
- Subscription status: until you cancel or delete your account. Stripe retains payment records as required by financial law.
- Aggregate product metrics: kept without any email or name attached.
Deleting your account
Click your email in the app header → Delete account. This permanently erases your account, plan, hypothesis board, interviews and transcripts, chat history, GitHub connection, outreach campaigns and leads, and all connected email accounts (Gmail tokens and SMTP credentials). Aggregate event counts (with no email or name attached) survive, because they no longer identify you.
Your rights
Depending on where you live (PIPEDA in Canada, GDPR in Europe, CCPA in California), you can ask for access to, correction of, or deletion of your personal information, or object to processing. Deletion is self-serve (above); for anything else email sebastian@lexlaunchcrew.com and we'll respond within 30 days. You can also complain to your local privacy regulator.
Security
Passwords are hashed with scrypt and never stored in plain text. Sessions use httpOnly cookies over HTTPS. GitHub tokens are stored server-side and never shown back to the browser. No system is perfectly secure — if we learn of a breach affecting you, we will tell you promptly.
Children
Lex is not directed at children and is not intended for anyone under 16.
Changes
If this policy changes materially, we'll note it here with a new date and, for significant changes, tell you in the app.