Privacy Policy

Almedeo Inc., doing business as LexTabs (“LexTabs,” “we,” “us,” or “our”), operates a cloud-based wire transfer verification and trust accounting platform designed for legal professionals. This Privacy Policy explains what personal data we collect when you use our website at lextabs.comand the LexTabs application (collectively, the “Services”), how we use it, and the rights you have regarding your data.

By accessing or using the Services you agree to this Privacy Policy. If you do not agree, please discontinue use of the Services.

1. Who We Are

LexTabs is operated by Almedeo Inc., a US company and the data controller for personal data collected through the Services. Questions about this policy may be directed to privacy@lextabs.com.

Our security program is designed with reference to the NIST Cybersecurity Framework (CSF) 2.0, GLBA safeguards principles, CCPA/CPRA, Nacha operating rules, and applicable state bar ethics rules and ABA cybersecurity guidance for legal technology platforms.

2. Information We Collect

2.1 Account & Profile Data

When you register or manage your account we collect your name, email address, password (stored as a salted hash), job title, and organization details. If you invite team members we collect the email addresses you supply.

2.2 Client & Matter Data

To deliver trust accounting and wire transfer verification features you may upload or enter information about your clients, legal matters, payees, payors, contacts, and associated financial transactions. This data is processed on your behalf as a service provider and remains yours.

2.3 Bank Account & Financial Data

LexTabs integrates with Plaidto allow you to connect your trust accounts and operating accounts. When you link a bank account, Plaid provides us with account identifiers, routing numbers, balances, and transaction history necessary to reconcile your trust ledger and verify wire transactions. We do not receive or store your online banking credentials. Bank account numbers and routing numbers sourced via Plaid are never stored in plaintext; only tokenized or masked references are retained after a verification session is complete. Plaid’s use of your data is governed by the Plaid End User Privacy Policy.

2.4 Identity Verification Data

Where identity verification is required, LexTabs uses Stripe Identityto verify counterparty identity. Identity document images are processed by Stripe and are not retained by LexTabs beyond the verification event; we retain only the verification outcome and associated metadata. Stripe’s practices are governed by the Stripe Privacy Policy.

2.5 Documents

You may upload documents (PDF, Word, images, etc.) for storage and OCR-based search. We store these files securely and process them solely to provide the document management features you request.

2.6 AI & Compliance Analysis Data

LexTabs uses AI models to assist with transaction categorization, compliance scoring, amount assessment, and client-name analysis. Transaction details and contextual metadata are sent to our AI processing pipeline. We do not use your client or matter data to train third-party foundation models without your explicit consent.

2.7 Clio Integration

If you connect your Clio account, we receive OAuth tokens and sync clients, contacts, and matters from Clio to populate LexTabs. We access only the Clio data scopes you authorize and do not modify your Clio data without your instruction.

2.8 Billing & Payment Data

Subscription payments are processed by Stripe. LexTabs does not store full payment card numbers. We receive and retain a tokenized payment method reference, billing address, and subscription status from Stripe.

2.9 Authentication & Security Data

We support multi-factor authentication via authenticator app (TOTP) or hardware security key. SMS-based MFA is not used for production system access. We also support biometric authentication (passkeys / WebAuthn): biometric verification is performed on your device and we store only a public-key credential, never biometric templates. We maintain access logs (IP address, timestamp, user identity) for security auditing purposes, retained for 12 months.

2.10 Usage & Technical Data

We automatically collect log data such as IP address, browser type, pages visited, and feature interactions to operate, secure, and improve the Services.

3. How We Use Your Information

• Provide, operate, and maintain the Services, including wire transfer verification, trust ledger reconciliation, document management, and compliance analysis.
• Process subscription billing and send transactional emails (receipts, invoices, alerts).
• Authenticate users and enforce organization-level access controls.
• Run AI-powered transaction classification and compliance scoring on your behalf.
• Detect and prevent fraud, unauthorized access, and other security incidents.
• Respond to support requests and communicate service updates.
• Comply with applicable law, court orders, or regulatory obligations (including GLBA, CCPA/CPRA, Nacha, and legal malpractice record-keeping standards).
• Improve and develop new features using aggregated, de-identified analytics.

We will not sell your personal data or your clients’ data to third parties, nor use it for targeted advertising.

4. Legal Basis for Processing (EEA / UK Users)

If you are located in the European Economic Area or United Kingdom, our legal bases for processing personal data are:

• Contract performance — to deliver the Services you subscribed to.
• Legitimate interests — security monitoring, fraud prevention, and service improvement, where these do not override your rights.
• Legal obligation — where we must process data to comply with law.
• Consent — for optional communications; you may withdraw consent at any time.

5. Data Sharing & Disclosure

We share personal data only as described below. We do not sell data.

• Sub-processors. We engage sub-processors under contractual obligations to protect your data, including: Supabase (database hosting), AWS (cloud infrastructure, object storage), Azure Key Vault (encryption key management), Plaid (bank account connectivity), Stripe (payments and identity verification), and AI model providers (transaction analysis). All sub-processors are subject to annual vendor review.
• Your organization. Members of your organization with appropriate role-based permissions can access data within that organization’s workspace.
• Legal requirements. We may disclose data if required by law, subpoena, or government request, or to protect the rights, property, or safety of LexTabs, our users, or the public.
• Business transfers. In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before data is subject to a different privacy policy.

6. Data Retention

We retain data only as long as necessary for the business purpose for which it was collected, or as required by law or contract. Retention periods run from the later of (a) the date the data was collected or (b) the date the underlying business purpose concluded. Our retention schedule is:

Account termination. Upon termination of your account, we provide a 30-day window to export data you are entitled to retrieve, then initiate deletion within 30 days of the termination date or export window close, whichever is later. We retain only data required by applicable law or the minimum retention schedule above and issue a written deletion confirmation upon request.

Legal holds. If LexTabs becomes aware of actual or anticipated litigation, regulatory investigation, or audit, a legal hold may supersede the standard retention schedule for affected data until the matter is resolved.

7. Data Security

Our security program is aligned with the NIST Cybersecurity Framework 2.0. Controls include:

• Encryption in transit: TLS 1.2 or higher on all external-facing endpoints and internal service communication. TLS 1.0 and 1.1 are disabled.
• Encryption at rest: AES-256 applied to all databases, file storage, and backups containing Restricted or Confidential data, with per-organization encryption keys managed in a dedicated key management service.
• Access controls: Role-based access control (RBAC) with least-privilege enforcement. MFA required for all production and administrative access (TOTP or hardware security key; SMS-based MFA not used).
• Vulnerability management: Automated dependency scanning on every build; critical/high vulnerabilities remediated within 14 days; annual third-party penetration testing.
• Secure development: Peer code review, SAST in CI/CD pipeline, OWASP Top 10 baseline, no secrets in source control.
• Audit logging: All production access logged with timestamp, source IP, and user identity; logs retained 12 months.
• Backup & recovery: Daily encrypted backups stored in a geographically separate region. RTO 4 hours; RPO 24 hours. Restoration tested semi-annually.

No system is completely secure. If you believe your account has been compromised, contact us immediately at security@lextabs.com.

8. Incident Response & Breach Notification

Upon detection of a security incident involving unauthorized access to Restricted data (bank account numbers, identity documents, wire transaction records) or a system compromise, LexTabs will:

• Contain the incident within 1 hour of detection by isolating affected systems.
• Notify affected customers within 72 hours, consistent with applicable breach notification requirements.
• Notify Plaid and other affected integration partners promptly, and no later than required by applicable agreements.
• Preserve forensic evidence and conduct a post-incident review within 14 days.

Security incidents, suspected vulnerabilities, or security inquiries can be reported to security@lextabs.com.

9. Attorney-Client Privilege & Confidentiality

LexTabs is designed for use by licensed legal professionals. We understand that client data you enter may be subject to attorney-client privilege and professional confidentiality obligations. We process such data solely as a service provider acting on your instructions and do not access it for any purpose beyond operating the Services. Our sub-processors are bound by equivalent confidentiality obligations.

10. Cookies & Similar Technologies

We use session cookies and local storage to keep you authenticated and to remember your preferences. We do not use third-party advertising cookies. You can configure your browser to refuse cookies, but some features of the Services may not function correctly without them.

11. Your Privacy Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (subject to legal retention obligations described in Section 6).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time where processing is based on consent.
• Opt out of sale/sharing (we do not sell or share data for cross-context behavioral advertising).

To exercise these rights, email privacy@lextabs.com. We will acknowledge your request within 5 business days and complete it within 30 days (or as otherwise required by applicable law). We may need to verify your identity before processing your request. Deletion requests are assessed against applicable legal hold, retention, and contractual obligations before completion.

12. International Data Transfers

LexTabs operates in the United States. If you are located outside the US, your data will be transferred to and processed in the US. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) for transfers from the EEA or UK.

13. Children’s Privacy

The Services are intended for legal professionals and are not directed to individuals under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

14. Third-Party Links & Integrations

The Services may contain links to or integrations with third-party websites and services (e.g., Clio, Plaid, Stripe). This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy policies before sharing information with them.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or by posting a prominent notice in the application at least 14 days before the changes take effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

16. Contact Us

Questions, concerns, or requests regarding this Privacy Policy should be sent to:

If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.