Privacy Policy
1Overview & Our Promise
Lexapient is a Windows desktop application that automates the extraction, classification, and structuring of information from documents. It connects directly to the Google Gemini API — there is no intermediary server, no cloud backend, and no third-party processing layer operated by Lexapient.
Our core guarantee: Document content, prompts, Playbooks, and extraction results never pass through any infrastructure controlled by Lexapient. We cannot see your data — not because of a policy, but because of how the application is built.
This Privacy Policy explains what data the application handles, where it is stored, what network connections it makes, and what choices you have.
2Zero-Access Architecture
Privacy is the foundational design principle of Lexapient. The application communicates directly with the Google Gemini API. Every API call goes straight from your machine to Google.
- No man in the middle. Lexapient (the vendor) never sees, processes, stores, or has access to any document content, prompts, LLM responses, Playbooks, or extraction results.
- No telemetry on content. The application does not transmit any user data, document content, or extraction results to Lexapient or any third party.
- Both authentication modes are direct. Whether using a vendor-provisioned batch-scoped key or your own API key, every API call goes directly from your machine to
generativelanguage.googleapis.com.
3Data We Collect
Lexapient collects the minimum data necessary to operate and improve the application:
| Data | Purpose | Storage |
|---|---|---|
| Email address (waitlist / account) | Account creation, product updates, and early-access communication | Our systems |
| Anonymised usage analytics | Feature usage counts (e.g., number of extractions run, Playbooks created). No content is included. | Our systems |
| Application version & update checks | Deliver software updates | Transient — only version number is transmitted |
4Data We Never Collect
The following data never leaves your machine and is never transmitted to Lexapient:
Your files, PDFs, Word documents, and emails
The queries sent to Gemini and the answers returned
Your custom extraction configurations
The structured data extracted from your documents
Verbatim text snippets linked to answers
Stored locally in Windows Credential Manager only
5Local Data Storage
All application data resides on your local machine or your organisation's infrastructure:
| Data | Storage Location | Vendor Access |
|---|---|---|
| Source documents | Local filesystem, Outlook, or iManage — accessed in place, never copied | None |
| Playbooks | Local application data folder | None |
| Extraction results | Local application data folder | None |
| LLM prompts & responses | Transient in-memory only | None |
| API key (BYOK mode) | Windows Credential Manager (OS-level encryption) | None |
| API key (vendor-provisioned) | Transient in-memory only — created per batch, deleted on completion | Key issuance only — never sees data processed with the key |
| Application settings | Local application data folder | None |
6API Key Handling
Lexapient supports two authentication modes. Both use direct-to-Google connections.
Vendor-Provisioned Keys
When you use vendor-provisioned access, a temporary API key is created per extraction batch, restricted to generativelanguage.googleapis.com only. The key is held in memory (never written to disk) and deleted immediately when the batch completes.
Bring Your Own Key (BYOK)
When you provide your own Gemini API key, it is stored locally in Windows Credential Manager with OS-level encryption. Lexapient is not involved in any API call — the key is used directly between your machine and Google.
7Network Endpoints
The application communicates only with the following endpoints — no other outbound connections are made:
| Endpoint | Purpose | Data Transmitted |
|---|---|---|
generativelanguage.googleapis.com |
Gemini API calls | Document content + Playbook (encrypted in transit via TLS) |
| Vendor key service | Create and delete batch-scoped API keys | Authentication credentials only — no user data |
| Application update server | Version checks and installer downloads | Application version number only — no user data |
You and your IT administrators can verify this via firewall rules or network monitoring tools.
8Google's Data Handling
Under Google's current Gemini API terms (as of the date of this policy):
- API inputs and outputs are not used to train Google models.
- Data is processed transiently and not retained beyond the API call lifecycle.
Lexapient surfaces Google's data handling terms during application setup and links to the current policy for transparency. We monitor changes to Google's terms and communicate any material changes to users.
For the latest information, refer to Google's Gemini API Terms of Service.
9Analytics & Telemetry
Lexapient may collect anonymised usage analytics — for example, feature usage counts such as the number of extraction batches run or Playbooks created. This data:
- Contains no document content, prompts, responses, or extraction results.
- Contains no personally identifiable information beyond what is necessary for account management.
- Is used solely to improve the product and understand feature usage patterns.
10Your Rights & Choices
You have full control over your data:
- Disable analytics: Turn off all anonymised usage analytics in the application settings.
- Choose your auth mode: Use BYOK for complete independence from Lexapient's key service.
- Delete local data: All Playbooks, results, and settings are stored in your local application data folder and can be deleted at any time.
- Verify network activity: The application's limited network endpoints can be verified with any firewall or network monitoring tool.
- Request account deletion: Contact us to have your account and any associated data (email, subscription information) permanently deleted.
11Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the application and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
12Contact
If you have questions about this Privacy Policy or our data practices, please contact us:
Lexapient
Email: privacy@lexapient.com