Privacy policy

1. Who we are

LexaZM ("we", "us") operates an AI-powered legal research platform for the Zambian legal profession. This policy explains what personal information we collect when you use lexazm.com and the LexaZM product, why we collect it, and how we protect it.

We process personal information in line with the Zambia Data Protection Act, No. 3 of 2021 ("DPA").

2. Information we collect

• Account details — your name, work email address, employer type, and (if provided) role.
• Research content — the questions you ask, documents you upload to chat or projects, and the citations and answers you save or bookmark.
• Usage data — pages visited, features used, search origin, and coarse performance metrics that help us keep the service fast and reliable.
• Authentication data — session identifiers and security events such as sign-in attempts and password-reset requests.

3. How we use your information

• To provide the service — answering your research questions, processing uploaded documents, and remembering your saved sources.
• To secure accounts — authenticating users, preventing abuse, and honouring rate limits.
• To improve the product — understanding which features are used so we can prioritise what lawyers actually need.
• To communicate with you — responding to early-access requests and essential service notices. We do not sell your information.

4. AI processing disclosure

LexaZM uses third-party large language model providers (currently via OpenRouter, Vercel AI Gateway, and Azure OpenAI) and embedding providers to read your questions and uploaded documents and produce grounded answers with citations.

These providers process content solely to generate a response for you. We select providers whose terms exclude training on customer inputs, and we send only the minimum content needed to answer a query.

Do not upload documents if you are not permitted to share them electronically; when in doubt, rely on client consent or de-identified material.

5. Storage, security & retention

Your data is stored on managed infrastructure with encryption in transit (TLS) and at rest. Access inside LexaZM is restricted by role, and administrative access is logged.

We keep account data while your account is active. Uploaded documents and chat history are retained until you delete them (or your account closes), after which they are removed within a reasonable operational window, except where the law requires us to retain records.

6. Your rights

Subject to the DPA (and comparable laws where they apply), you may ask us to access, correct, export, or delete the personal information we hold about you; object to certain processing; and lodge a complaint with a supervisory authority.

You can delete most content yourself from inside the product (chats, uploads, projects). For anything else, contact us using the details below and we will respond within a reasonable timeframe.

7. International transfers

Our infrastructure and AI providers may process data outside Zambia. Where that happens, we rely on provider safeguards (such as standard contractual clauses) and transfer only what is necessary to deliver the service you asked for.

8. Changes to this policy

If we make material changes, we will notify registered users by email or an in-product notice before the changes take effect, and update the "last updated" date below.

9. Contact us

Questions or requests? Email hello@lexazm.com and we will help.