Versi v1.0-draft-2 · Diterbitkan 2026-07-24

Lexnesia Privacy Policy

Version 1.0-draft-2 · Effective from: ______

⚠ DRAFT VERSION (2026-07-25 · draft-2). This English version is a faithful translation of the Indonesian original (privacy_v1_id.md) and is likewise a draft. Some Data Controller fields (legal entity name, address, Data Protection Officer, effective date, and certain retention periods) are not yet filled in and are marked ______. This draft must be reviewed by an Indonesian advocate / data-protection counsel before formal effect. The Indonesian version at /id/privasi is authoritative — where the two texts appear to diverge, the Indonesian text controls. For questions, contact privasi@lexnesia.com.

1. Data Controller

Lexnesia is operated by ______ (full legal entity name to be filled in), a limited liability company incorporated under the laws of the Republic of Indonesia, with its registered address at ______.

Data Controller contact:

Data-subject rights requests (Articles 5–15 UU PDP) — submitted in person at the Lexnesia office with personal identification. Full terms: Section 8.
General enquiries, data breach notifications, or legal correspondence — email privasi@lexnesia.com or postal address: ______.

Designated Data Protection Officer (DPO): ______ (DPO name or "to be appointed").

2. Personal data processed

We process the following personal data while you use Lexnesia:

2.1 Identity data you register directly

Email address (used as login identifier)
Display name (optional)
Phone number (optional; only for users registering a Gold or higher tier account)
Organisation name and position (optional; used in draft documents)

2.2 Content data you generate while using the service

Legal questions you submit in chat
Documents you upload for analysis
Feedback (👍/👎) and notes you leave on AI answers
Bookmarks, search history, conversation history
Draft documents you create using Draft Documents

2.3 Technical data collected automatically

IP address and device/browser information
Login timestamps, activity timestamps
Application error logs (if any)
Session cookies and authentication tokens (not third-party advertising cookies)

2.4 Payment data (paid users only)

We do not store credit card numbers or full payment data. Payments are processed by a third-party payment provider (______) that complies with PCI-DSS standards.
We do store: transaction metadata (transaction ID, amount, date, status), required for accounting and billing evidence.

We do not process children's data. The Lexnesia service is intended for users at least 18 years of age (Indonesian legal age of majority). If we become aware that personal data of a child under 18 has been collected without valid consent, we will delete it as soon as possible.

3. Purposes of processing

We process your personal data for the following purposes:

(a) Service operation — providing AI answers to legal questions, storing your conversation history, generating draft documents, managing your account and subscription tier.

(b) AI answer-quality improvement — the content of your questions and feedback may be used to retrain, evaluate, and improve the quality of the AI model's answers. This purpose depends on your optional consent (see Section 4.2); you may withdraw consent at any time without affecting purpose (a).

(c) Service communication — sending transactional emails related to your account (verification, password reset, security notifications, payment receipts).

(d) User support — responding to your questions or requests for help.

(e) System security and abuse prevention — detecting suspicious activity, preventing unauthorised access, maintaining system integrity, and fulfilling legal obligations.

(f) Legal obligations — retaining records required by tax, accounting, and other Indonesian laws.

We do NOT use your personal data for:

Selling or renting data to third parties
Behavioural advertising
Creating profiles for automated decisions with legal or significant effects on you without your explicit consent (see Section 9).

4. Legal basis for processing and consent

Under Article 20 UU PDP, processing of personal data may be based on six legal bases. We classify the processing of your personal data using the following table:

Legal Basis	Example processing at Lexnesia
Performance of a contract	Operating the Service you have registered for or subscribed to — delivering AI answers, managing conversation history, subscription billing.
Consent	Where you have given explicit consent, including for marketing communications, research participation, and optional features. Consent may be withdrawn at any time subject to the limits stated in this Policy.
Legitimate interest	Operating, securing, improving, and developing the Service; preventing fraud and abuse; conducting analytics; enforcing the Terms of Service; and pursuing our business and commercial objectives, provided such interests are not overridden by the fundamental rights and freedoms of the data subject.
Legal obligation	To comply with laws, regulations, court orders, or requests from competent authorities.
Public interest	To support access to law, regulatory transparency, and public-benefit objectives consistent with the Lexnesia mission.
Vital interest	Where necessary to protect your vital interests or those of another person (e.g., emergencies threatening safety).

In addition to the legal bases above, some processing in the Service depends on your specific consent at registration and account setup. We split specific consents into two tiers so you retain full control:

4.1 Mandatory consent — at registration

I agree to this Privacy Policy and to the processing of my personal data for the operation of the Lexnesia service (purposes 3.a, 3.c, 3.d, 3.e, 3.f).

This consent is required to create an account. Without it, we cannot provide the Service to you and registration cannot proceed. You may withdraw this consent at any time by requesting account deletion.

4.2 Optional consent — for AI quality improvement

I allow Lexnesia to use the content of my questions, uploaded documents, and feedback in de-identified form to train and improve the quality of the Lexnesia AI model (purpose 3.b).

This consent is optional. You may register an account without giving this consent; your account remains functional on the Free tier. Upgrading to a paid tier (Gold, Corporate) that uses personalisation based on your content requires this optional consent, because those paid tiers are offered as a different service — transparently, and recorded as part of that tier's value proposition.

You may withdraw optional consent at any time from the My Data page. If you withdraw consent while on a paid tier, your account will be automatically downgraded to Free at the end of the current billing cycle, with pro-rata refund under our refund policy.

4.3 Policy version in effect at the time of consent

Every consent you give records the version of the Privacy Policy in effect at that moment (e.g. v1.0). If we publish a new policy version with material impact on the processing of your data, we will notify you and request re-consent before continuing to process on the new version.

5. Data sharing

We do not sell your personal data. We share your personal data only with the parties below, entirely to support operation of the Service:

5.1 Data Processors

These parties process your personal data on our behalf and are bound by data-processing agreements requiring them to meet protection standards equivalent to UU PDP.

Processor	Function	Server location
Supabase (AWS)	Database + file storage	Sydney, Australia
Anthropic PBC	AI model (Claude) for question processing	United States
Google LLC	AI model (Gemini) for embedding + fallback	United States
Resend	Transactional email delivery	United States
Railway Corp.	Application hosting	United States (Oregon)
______	Payment processing	______

5.2 Cross-border transfer

Most of our processors are located outside Indonesia (United States, Australia, Singapore, and other countries per infrastructure-provider server location). By using the Lexnesia Service, you consent to the transfer of your personal data to those jurisdictions for the purposes of operating the Service.

Pursuant to Article 56 UU PDP, we conduct cross-border transfers with the following safeguards:

(i) Standard Contractual Clauses (SCCs) with each processor guaranteeing a level of protection equivalent to UU PDP;

(ii) confidentiality and data-processing provisions in agreements with infrastructure providers; and

(iii) periodic monitoring of the processors' data-protection practices.

You may request a summary of the transfer mechanisms by contacting privasi@lexnesia.com.

5.3 Legal obligation

We may disclose your personal data to competent authorities where required by court order, subpoena, or applicable law. In such cases, we will endeavour (unless prohibited by law) to notify you before disclosure, so that you have the opportunity to take legal action.

5.4 Aggregate and anonymised data for Service improvement

We may use your personal data in fully aggregated or anonymised form (no longer re-identifiable to you) to:

Analyse Service usage patterns and improve features, accuracy, and performance;
Produce aggregate reports on research trends and regulation use;
Share anonymised insights with research, academic, or commercial partners for product development, market research, and business collaboration purposes;
Retrain, test, and refine the Lexnesia AI model.

Fully anonymised data is no longer considered personal data under UU PDP and is not subject to the data-subject rights described in Section 8. We apply reasonable technical anonymisation standards to minimise re-identification risk.

5.5 Additional confidentiality commitments for enterprise clients

Enterprise clients (Corporate tier or separate service agreements) may negotiate additional confidentiality commitments through a separate Data Processing Agreement (DPA) outside this Policy, including restrictions on use of data for the purposes in Section 5.4. For general users without a separate DPA, Lexnesia's confidentiality commitment is as set out in this Policy.

6. Storage and retention

6.1 While your account is active

We store your personal data for as long as your account is active and you remain a Lexnesia user.

6.2 On account deletion

You may request account deletion at any time from the My Data page. We offer two deletion tiers:

Anonymisation (default): your identity is removed from the system — email, name, phone, links to the user. Your question content without identity may remain stored in de-identified form for AI quality purposes. That data is no longer re-identifiable to you.
Full deletion: all your personal data, including question content and history, is permanently deleted from production systems.

Both deletion tiers have a 30-day grace period for recovery (you may cancel a deletion request within those 30 days). After that, the request is irrevocable.

6.3 Data required to be retained longer

We retain certain data even after your account is deleted, due to legal obligations:

Payment records and tax invoices: ______ years (tax obligation; validated by a tax consultant)
Security logs and audit evidence: ______ years (system-protection obligation)
Data-subject rights request records: ______ years (UU PDP compliance evidence)

Data retained under Section 6.3 is limited as strictly as possible to what must be retained; the rest is deleted or anonymised.

7. Security

We apply reasonable technical and organisational measures to protect your personal data:

Encryption in transit: all communications between your browser and our servers use HTTPS/TLS 1.2 or higher.
Encryption at rest: database and file storage are encrypted at rest by the infrastructure provider (Supabase/AWS).
Role-based access control: employees have only reasonable access necessary for their work function. All admin access is recorded in an immutable audit log.
Password authentication: passwords are stored as PBKDF2 hashes with a random salt; the original password is never stored or seen by us.
Regular security testing: we conduct periodic code review and vulnerability monitoring.

Notwithstanding the above, no system is entirely immune from attack. If a personal data breach occurs that significantly affects your rights and interests, we will notify you and the Personal Data Protection Authority within 3 x 24 hours of becoming aware, in accordance with Article 46 UU PDP.

8. Data-subject rights (Articles 5–15 UU PDP)

As a data subject, you have the following rights over your personal data:

Right to information (Article 5) — this policy is the primary fulfilment of that right.
Right to complete, update, and/or correct personal data (Article 6).
Right to access and receive a copy of your personal data (Article 7), including the right to portability in an open, machine-readable format (Article 13).
Right to terminate processing, delete, and/or destroy personal data (Article 8) — including the choice of anonymisation or full deletion.
Right to withdraw optional consent (Article 9), including withdrawal of permission to share answer details for AI quality improvement.
Right to object to decision-making based solely on automated processing, including profiling (Article 10).
Right to suspend or restrict processing (Article 11).
Right to claim and receive compensation for processing violations (Article 12).

8.1 How to submit a request

All data-subject rights requests — without exception — must be submitted by visiting the Lexnesia office in person with personal identification (KTP or passport). We deliberately do not provide an electronic submission channel so that:

the requester's identity can be verified with certainty, so that a request cannot be used by a third party to access or delete personal data belonging to the account holder without the account holder's knowledge;
the context of the request (legal basis, scope, output format, and consequences) can be explained directly before the request is executed.

UU PDP requires the Data Controller to process data-subject rights requests reasonably and in a timely manner; UU PDP does not require an electronic submission channel. Lexnesia's submission-channel policy therefore complies with UU PDP.

The office address and service hours are published on the Lexnesia Contact page and on the My Data page in the user account.

8.2 Response time

We will respond to requests we receive within 72 hours for confirmation and within 3 x 24 hours for follow-up in accordance with Article 30 UU PDP. Some requests (e.g., deletion) have a 30-day grace period as described in Section 6.2.

Lexnesia may refuse, limit, or charge an administrative fee for a data-subject rights request if:

The request is manifestly unfounded, excessive, or repetitive.
Fulfilling the request would require disclosure of third-party personal data.
The personal data is required for the establishment, exercise, or defence of legal claims.
Applicable laws require or permit ongoing retention or processing.
The request conflicts with national defence, security, or public interest considerations.

9. Automated decision-making and fairness

Lexnesia AI answers are a legal research aid, not a substitute for professional legal advice. Lexnesia AI does not make decisions with legal or significant effects on you; any legal decision you make based on Lexnesia AI answers is entirely your responsibility and that of your professional legal advisor.

We take AI bias risk seriously:

We do not use your sensitive characteristics (ethnicity, religion, race, gender, region of origin, disability) as input to the AI model when generating answers.
We periodically evaluate AI answer quality and incorporate user feedback into the evaluation process.
You may request an explanation of a specific AI answer by contacting us at privasi@lexnesia.com. Because AI is probabilistic, our explanations are generally a description of methodology rather than a deterministic derivation.

AI-Generated Content — Important Disclaimer. The Lexnesia Service uses artificial-intelligence technology that produces outputs of legal research, regulatory analysis, and related information ("AI Content"). By using the Service, you acknowledge and agree that:

(a) AI Content is provided for information and research purposes only and does not constitute legal advice, a legal opinion, or a substitute for advice from a qualified legal professional.

(b) Lexnesia does not warrant the accuracy, completeness, timeliness, or fitness for a particular purpose of AI Content.

(c) You bear full responsibility for your reliance on AI Content in making legal, business, regulatory, or other decisions.

(d) Lexnesia is not liable for any loss, damage, liability, or consequence arising from your reliance on AI Content.

(e) AI Content may contain errors, missing information, or outdated information as a natural consequence of the nature of AI systems and the continuous evolution of law.

10. Third parties

The Lexnesia Service may contain links to third-party sites, applications, or services. Lexnesia is not responsible for the privacy practices, security, or content of any third-party platform. We encourage you to review the privacy policies of any third-party service you access through the Service. Your interactions with third-party services are subject to their respective terms and policies.

11. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. Each version is numbered and dated (e.g. v1.0, ______). Current version: v1.0-draft-2.

Non-material changes (e.g. grammar corrections, addition of contact details): effective on publication date without separate notice.
Material changes (e.g. addition of new processing purposes, addition of a new processor receiving personal data, or changes with significant impact on your rights): we will notify you by email and/or in-app notification at least 30 days before effective date. We will request re-consent before processing your personal data on the new version.

Continued use of the Service after the effective date of an updated Policy version constitutes your agreement to the changes. If you do not agree to the changes, you may cease use of the Service and request account deletion through the My Data page.

We archive Privacy Policy version history and make it available on request.

12. Governing law

This Policy is governed by and interpreted under the laws of the Republic of Indonesia. Disputes arising from or in connection with this Policy are subject to the exclusive jurisdiction of the courts of the Republic of Indonesia, or resolved through alternative dispute resolution as agreed by the parties.

13. Contact

Data-subject rights requests (Articles 5–15 UU PDP) — submitted in person at the Lexnesia office with personal identification. Full terms: Section 8.
General enquiries, complaints, or data breach notifications: email privasi@lexnesia.com or postal address ______.
Data Protection Officer (DPO): ______.

You may also submit a complaint to the Personal Data Protection Authority (once established under UU PDP) or a competent consumer disputes body.