Lexion AI

Lexion states it uses de-identified, anonymized, and aggregated Customer Content to improve AI models, but the language is somewhat vague about opt-out mechanisms and the scope of what constitutes 'de-identified' data. The company claims data cannot be re-identified once converted, but this is a technical assertion rather than a contractual guarantee.

“[ToS] Lexion may improve the Services by producing artificial intelligence models that include Customer Content that has been de-identified, anonymized, and aggregated so that it does not identify Customer, Customer Affiliates, Authorized Users, or any other individual person or company.”

The license granted to Lexion is limited to providing the Services, but Lexion retains broad rights to use de-identified data and feedback perpetually. The feedback license is perpetual and irrevocable with no restrictions, which is concerning for IP protection.

“[ToS] Customer hereby grants to Lexion a limited, non-exclusive, royalty-free, worldwide license to use, copy, store, modify, distribute, transfer, and display all Customer Content solely for the purpose of providing the Services. [ToS] Customer hereby grants Lexion a perpetual and irrevocable license to use and exploit any portion of Feedback in any manner without any obligation, royalty, or restriction.”

Lexion shares data with essential service providers (cloud, analytics, email) and third-party advertising/marketing partners. While some controls exist through DPA, the sharing with ad networks and marketing partners for targeted advertising is broad. Sub-processor list is not explicitly published in provided documents.

“[Privacy] We may use third-party service providers and business partners to perform functions in connection with the Site or Services. Examples include running our Services on cloud providers, using account management ticketing products, and sending you email and text notifications via messaging providers. [Privacy] We may use cookies, pixels, or other tracking technologies provided by third party advertising, social media or analytics providers, including, without limitation, Google, Facebook, or LinkedIn.”

Lexion provides a 30-day window for data export after termination, after which it may delete data. However, the policy allows retention for 'financial reporting, compliance, or other legal purposes' indefinitely, and backup retention timelines are not clearly specified.

“[ToS] If requested by Customer, within thirty (30) days following the expiration or termination of this Agreement... Lexion shall have no further obligation to retain any Customer Content and Customer consents to deletion by Lexion, except that Lexion may retain relevant information for financial reporting, compliance, or other legal purposes.”

Lexion explicitly states that Customer retains all rights to Customer Content. The vendor claims no ownership of outputs and the license is strictly for service delivery purposes. This is enterprise-friendly.

“[ToS] As between the parties, any rights in and to Customer Content are retained by Customer. [ToS] All rights (including all ownership rights) not expressly granted to Customer under this Agreement or in an Order Form are reserved by Lexion, its suppliers, and licensors.”

Lexion references certifications and security posturing in the ToS introduction and mentions a DPA with Standard Contractual Clauses for GDPR compliance, but specific certifications (SOC 2, ISO 27001, HIPAA) are not explicitly listed in the provided documents. A security policy is available upon request.

“[ToS] DocuSmart, Inc., d/b/a Lexion, a Delaware corporation ("Lexion"), provides a business-focused solution and takes the privacy and security of data seriously (go here to learn about Lexion's certifications and security posturing). [ToS] A copy of Lexion's current security policy is available upon request.”