Privacy policy
This explains what personal information Lex360 handles and why. the operator of Lex360 is the provider ("we"). Contact: the contact address on this site.
Two roles
For the students and teachers in an organisation's account, the organisation (the school or tutor) decides why and how their data is used and we act on its behalf as a processor. For visitors to this website and people who ask for access, we are the controller.
What we hold
- Accounts: name, email (optional for students), a personal ID number, role, a password stored only as a one-way hash.
- Teaching records: classes, lessons taught, homework answers and scores, placement test results, teachers' feedback, reports, notes, whiteboards and messages.
- Requests for access: the details you type into the form and when you agreed to be contacted.
- Attendance and certificates: registers of who attended each class, end-of-level results and the certificates issued, which carry the holder's name and a serial number anyone can check.
- Billing and email: for paying accounts, the plan and subscription status (card details are handled by Stripe and never reach us), and a log of the emails we send you.
- Technical data: sign-in times and security logs needed to protect accounts.
What we do not do
We show no advertising, we do not sell personal data, and we do not use students' records to build profiles for others.
Where it is kept and who helps us
Data is stored in the European Union (Frankfurt, Germany) with our hosting provider, Fly.io. If your organisation turns on AI-drafted feedback or natural voices with its own keys, the text of that item is sent to the provider you chose (Anthropic or Google); that happens only when you or your teachers use those features.
Our service providers
We use: Fly.io (hosting and database, Frankfurt), Stripe (payments), an email delivery provider (so sign-in codes and receipts reach you), and, only if your organisation turns them on with its own keys, Anthropic (AI-drafted feedback) and Google (natural voices). The full list is in the data processing terms.
How long we keep it
Teaching records are kept while the account is active so history is not lost. Accounts are deactivated rather than deleted unless an administrator permanently deletes them, which removes the student's records. Requests for access that do not become accounts are deleted within 12 months.
Your rights
You can ask to see, correct, export or delete your personal data. Students can download their own data and request deletion of their account from their page; their school or tutor decides. We will help organisations meet these requests.
Security
Each organisation's data is separated from every other's inside the database. Connections are encrypted, passwords are hashed, sign-in codes work once, and sensitive keys are stored encrypted. No system is perfectly secure; tell us at once if you suspect a problem.
Children
Students may be under 18. Organisations that enter children's details are responsible for having the consent or other lawful basis the law requires where they are.
Changes
If this policy changes materially, we will tell account holders in advance.