Comprehensive Privacy Notice

The data controller is Dixi Project S.A.S. de C.V. ("LexFlow" or the "Controller"), with offices in Mexico City, Mexico.

For any matter related to personal data, contact our Data Protection Officer at acastillejos@dixi-project.com.

LexFlow is a Software-as-a-Service (SaaSSaaSSoftware as a Service — software delivered as a cloud service.) Legal Operations platform for corporate legal teams. We operate under a multi-tenant model: each customer has a logically isolated workspace with no cross-tenant access.

Services are delivered through the following channels: web portal (lexflow.com.mx, admin.lexflow.com.mx, app.lexflow.com.mx), iOS mobile app, Android mobile app, progressive web app (PWAPWAProgressive Web App — installable web app with offline capabilities.) and, soon, voice integration with Amazon Alexa for authorized queries and notifications.

To deliver the service we collect the following categories of personal data, either directly (when you provide them through forms, apps or files you upload) or indirectly (when generated automatically as you use the platform):

LexFlow does not require or request data classified as sensitive under LFPDPPPLFPDPPPMexican Federal Law on the Protection of Personal Data Held by Private Parties. (racial origin, health, beliefs, sexual life, political opinion, union membership) to operate. If the customer chooses to upload this kind of information into its records (e.g., in a labor lawsuit), the processing is performed under the customer's responsibility as data controller, and LexFlow acts strictly as a data processor under article 50 of the LFPDPPPLFPDPPPMexican Federal Law on the Protection of Personal Data Held by Private Parties. Regulations.

Personal data is processed for the following primary purposes, without which the service cannot be provided:

Additionally, and as long as you do not object, we may process your data to improve the product through aggregated and dissociated statistical analysis; send you communications about new features, training, events and relevant legal content; and run satisfaction surveys and discovery interviews.

You may object at any time by emailing acastillejos@dixi-project.com with the subject line "Opt-out from secondary purposes". Your refusal does not affect the provision of the service.

LexFlow uses generative AI models (Claude Haiku 4.5 via Amazon Bedrock) to assist users with semantic search, template drafting and invoice review. We operate under the Zero Data Retention regime agreed with AWS: models do not store prompts and do not use them for retraining.

Vector retrieval is built from embeddings (irreversible mathematical representations), so the model provider does not receive the raw original text in full. Every AI call is recorded in an internal audit log with tenant, user, model, tokens, cost and outcome, available to the customer for inspection.

LexFlow does not sell, rent or share your personal data with third parties for purposes other than service operation. The only remittances (article 36 LFPDPPPLFPDPPPMexican Federal Law on the Protection of Personal Data Held by Private Parties.) occur with processors that act under our documented instructions and equivalent confidentiality and security clauses:

Data is stored in the United States of America, within AWS region us-east-2. This transfer is necessary for service provision (article 37 fraction IV LFPDPPPLFPDPPPMexican Federal Law on the Protection of Personal Data Held by Private Parties.). AWS holds SOC 1SOC 1System and Organization Controls 1 — internal controls over financial reporting., SOC 2 Type IISOC 2 Type IISystem and Organization Controls 2 Type II — audit of operational controls over a period., ISO 27001ISO 27001International standard for information-security management systems., ISO 27017ISO 27017Cloud-services security standard., ISO 27018ISO 27018Personal-data protection standard for cloud services., PCI DSSPCI DSSPayment Card Industry Data Security Standard. and FedRAMPFedRAMPFederal Risk and Authorization Management Program — U.S. cloud authorization for government. certifications, and has signed standard contractual clauses and compliance commitments with applicable data-protection regulations.

Personal data is retained for the duration of the contract and for any additional periods required by applicable law (commercial, tax, labor or procedural). Audit logs are retained for the minimum period required by the customer's regulatory frameworks. Upon contract termination, the customer can export all of its information in standard formats; once the agreed transition period elapses, data is securely deleted following certified procedures.

You have the right to know (Access) what personal data we hold, request its Rectification when inaccurate, request Cancellation if you believe processing does not comply with the law, or Object to specific uses. You may also revoke previously granted consent.

To exercise these rights, send a request to acastillejos@dixi-project.com including: full name, copy of an official ID, clear description of the right being exercised and the data concerned. We will respond within a maximum of 20 business days. If you are not satisfied with the answer, you may file a complaint with INAIINAIMexico's National Institute for Transparency, Access to Information and Personal Data Protection. (https://home.inai.org.mx).

Our website uses strictly necessary cookies to keep your session, remember language preference and improve performance. We do not use third-party advertising cookies. You may disable cookies in your browser, but some platform features may stop working correctly.

Any material change to this notice will be communicated through the portal and by email to the tenant administrator with at least 15 calendar days' notice before taking effect.