Lex
Sign inSign up
Legal

Privacy Policy

Last updated · 2026-07-10

This Privacy Policy explains what personal data Lex collects, why we collect it, how we use it, and what rights you have. Lex is a language-learning toolkit operated by an individual entrepreneur registered in the Republic of Azerbaijan and made available to users worldwide. We process personal data in accordance with the Republic of Azerbaijan's Law on Personal Data (No. 998-IIIQ, 11 May 2010) and, for users located in the European Economic Area (EEA), Switzerland, and the United Kingdom, the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR.

1. Data controller

The data controller responsible for processing your personal data (both as “operator” under the Law on Personal Data of the Republic of Azerbaijan and as “controller” within the meaning of Art. 4(7) GDPR) is:

[Operator full name], individual entrepreneur registered in the Republic of Azerbaijan.
[Registered address, Baku, Republic of Azerbaijan]
Email: thelabmarketplace@hotmail.com

As of the date above, Lex has not appointed an EU representative under Art. 27 GDPR. For all data-protection matters, including exercising your rights, please contact us at the email address above.

2. What data we collect

Account data

When you create an account, we store your email address and a hashed password (managed by Supabase Auth). We also store your account creation date, trial start date, and subscription status.

Learning data

We store the content you create and save inside Lex: vocabulary entries, essays you write, reading texts you paste or save, and exercise progress. This data is tied to your account and is what makes Lex useful to you across devices.

AI feature inputs

When you use an AI-powered feature — essay feedback, AI text generation, AI translation, prompt generation — the relevant text (your essay, your prompt, the word being translated) is sent to OpenAI for processing. We do not allow OpenAI to use this data to train their models (OpenAI's API does not train on submitted content by default). We log a row in our own database recording that an AI call happened, against which feature, whether it succeeded, and when — but not the content of the call.

Free check (anonymous)

The free essay check on our landing page does not require an account. To prevent abuse we store a hashed cookie token and a hashed IP address (SHA-256 with a server-side secret — we never store the raw IP). We also store the language, the estimated CEFR level the AI returned, and the essay length in characters. We do not store the essay text itself.

Billing data

When you subscribe, our merchant of record, DodoPayments (Dodo Payments, Inc.), processes and stores your billing details, including name, billing address, and payment method. DodoPayments acts as the seller of record for your subscription in most jurisdictions and is the data controller for the billing data you provide to it. We receive a customer ID, subscription status, plan tier, and billing metadata from DodoPayments, but we never see your card number or full payment details.

Product analytics

We use PostHog to understand how Lex is used. PostHog sets a first-party cookie on your browser containing an anonymous identifier. We have disabled session recording and disabled automatic click tracking — only events we explicitly name (e.g. signup completed, first word saved, subscription started) are captured. PostHog does not track you across other websites.

What we don't collect

No advertising cookies, no behavioral tracking across other sites, no cross-site profiles. We do not sell your data.

3. Legal basis for processing (EEA / UK users)

For users to whom the GDPR or UK GDPR applies, we rely on the following legal bases:

  • Contract performance (Art. 6(1)(b) GDPR) — for account creation, subscription management, AI processing of content you submit, and providing the service you signed up for.
  • Legitimate interest (Art. 6(1)(f) GDPR) — for fraud prevention (anonymous-check rate limiting), security, basic server logs, and product analytics aimed at improving Lex.
  • Legal obligation (Art. 6(1)(c) GDPR) — for retaining invoices and tax records as required by the tax laws of the Republic of Azerbaijan and any other applicable tax authority.
  • Consent (Art. 6(1)(a) GDPR) — for any optional processing where we ask you separately.

For users in the Republic of Azerbaijan, the corresponding legal grounds under Articles 5 and 8 of the Law on Personal Data apply (execution of a contract to which you are a party, our legitimate interests, compliance with a legal obligation, and your consent where required).

4. Subprocessors

We use the following service providers to operate Lex. Each is bound by a Data Processing Agreement (DPA) and processes data on our behalf:

  • Supabase (auth) — hosted in the EU. supabase.com/privacy
  • Neon (Postgres database) — EU region. neon.tech/privacy-policy
  • DodoPayments (payments, merchant of record) — international processor handling checkout, subscription billing, worldwide VAT/GST/sales tax collection and remittance, and invoicing on our behalf. Uses EU Standard Contractual Clauses for transfers outside the EEA. dodopayments.com/privacy
  • OpenAI (AI features — essay feedback, AI generation, AI translation) — international processor under Standard Contractual Clauses. API submissions are not used for training by default. openai.com/policies/privacy-policy
  • PostHog (product analytics) — US region for Lex, with EU SCCs. posthog.com/privacy
  • Amazon Web Services (hosting) — Frankfurt (eu-central-1) region. Uses EU Standard Contractual Clauses for any transfers outside the EEA. aws.amazon.com/privacy
  • Cloudflare (DNS, edge network) — global. cloudflare.com/privacypolicy

5. Cookies

Lex sets a small number of first-party cookies:

  • lex_session — your signed-in session token (strictly necessary, HTTP-only, expires after 7 days).
  • lex_anon_check — set on visitors who use the free essay check on the landing page, to enforce the one-free-check limit (strictly necessary, HTTP-only, expires after 1 year).
  • ph_…_posthog — set by PostHog for product analytics (functional). Contains an anonymous identifier; expires after 1 year.

We do not set any advertising cookies. PostHog's functional cookie is disclosed in this policy; if you wish to disable it, your browser's privacy controls (Do Not Track, content-blocking extensions) will block it.

6. Data retention

Account data and your learning content are retained while your account is active. If you delete your account, we delete or anonymize your data within 30 days, except where we are required by law to retain it longer — in particular, tax-relevant invoices and related records, which we retain for the period required by the tax laws of the Republic of Azerbaijan (currently five years under the Tax Code of the Republic of Azerbaijan). Anonymous-check records are auto-pruned once they fall outside the 24-hour rate-limit window. Subscription cancellation does not automatically delete your account.

7. Your rights

Regardless of where you live, you can contact us at thelabmarketplace@hotmail.com to access, correct, or delete your personal data, or to ask a question about how we process it. We respond within 30 days.

If the GDPR or UK GDPR applies to you, you have the following specific rights:

  • Request access to your personal data (Art. 15 GDPR)
  • Request rectification of inaccurate data (Art. 16 GDPR)
  • Request deletion of your data (Art. 17 GDPR)
  • Request restriction of processing (Art. 18 GDPR)
  • Request data portability (Art. 20 GDPR)
  • Object to processing based on legitimate interest (Art. 21 GDPR)
  • Withdraw consent at any time, where consent is the basis
  • Lodge a complaint with a supervisory authority (Art. 77 GDPR) — you may complain to the data protection authority of the EU member state where you live, work, or where the alleged infringement took place.

If you are located in the Republic of Azerbaijan, you have equivalent rights under the Law on Personal Data, and you may lodge a complaint with the competent supervisory body designated under that law.

8. International transfers

Because Lex is operated from the Republic of Azerbaijan and served globally, your personal data may be processed outside your country of residence, including in the European Union, the United States, and the Republic of Azerbaijan. Where personal data of EEA, UK, or Swiss users is transferred to a country that has not been recognised as providing an adequate level of protection, we and our subprocessors rely on the European Commission's Standard Contractual Clauses or comparable safeguards.

9. Changes

We may update this Privacy Policy. Material changes will be communicated by email or via a prominent notice on this site.