Lexalytic is the data controller for the information described here. We are based in Bushey, Hertfordshire and you can reach us at hello@lexalytic.com.
This covers three different things, and what happens to your data differs considerably between them.
The free tools
The tools at lexalytic.com/tools run entirely in your browser. Spreadsheets you check, properties you enter, jobs you track and placements you record are held in your browser storage on your own device. They are never sent to us and we cannot see them.
That is why clearing your browser data erases them and why they do not appear on another device. It is a deliberate trade, and it means we hold nothing about your use of those tools beyond ordinary website analytics.
If you send an enquiry from a tool, the form submission goes to us through Formspree and includes whatever summary the tool generated. That we do receive and keep.
Retention Manager and other subscription software
This is different. To provide an account, sync across devices and send reminders, we store your data on servers we control.
What we hold: your name and email address, your company name, address and phone number, and the operational data you enter. For Retention Manager that means job references, main contractor names and email addresses, contract values, certified sums, retention rates, completion dates, payments received, certificate references and the applications you have generated.
Why: to run the service you have asked for. The lawful basis is performance of a contract. For service emails such as reminders and billing notices, the basis is also contractual performance rather than consent, because they are part of what you are paying for.
Where: in a PostgreSQL database hosted by Supabase in London. Row level security means your organisation can only read its own rows.
How long: for as long as your account is open. After a subscription ends we keep it for ninety days in case you return, then delete it. You can ask us to delete it sooner and we will do so within thirty days.
Information about other people
The software lets you record details of people at other businesses, typically a contact at a main contractor. Where you do that you are the controller of that information and you need a lawful basis for holding it, which in a commercial context is usually legitimate interests. We process it on your instructions as a processor.
We do not contact those people. Nothing you enter about a third party is used for our own marketing.
The website
We keep server logs including IP addresses for security and diagnostics, held for a short period. Contact form submissions come to us through Formspree.
We do not run advertising trackers or sell data to anyone.
Who else is involved
We use a small number of providers to run the service. Each processes data only to deliver their part of it.
Some of these are US companies. Where data leaves the UK it is covered by the UK addendum to the EU standard contractual clauses or an equivalent safeguard.
What we do not do
We do not sell your data. We do not share it with advertisers. We do not use anything you enter to train machine learning models, ours or anybody else's. We do not read your job data except where you ask us to help with a support problem.
Your rights
Under UK GDPR you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict processing. Email us and we will respond within thirty days.
You can also export your own data to CSV from within the software at any point without asking us.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can put it right.
Security
Data is encrypted in transit and at rest. Access is controlled at the database level so one organisation cannot read another's rows. Passwords are hashed and we never see them. Payment card details never touch our systems.
No system is perfectly secure. If a breach occurs that is likely to affect your rights we will tell you and the ICO within seventy two hours.
Changes
We will update this page when things change and revise the date at the top. For anything that materially affects how we handle your data we will email you first.
Getting in touch
Lexalytic, Bushey, Hertfordshire, United Kingdom. hello@lexalytic.com