Privacy Policy

LexShield is a legal-practice-management and compliance platform operated by Joticle, Inc. (“LexShield,” “we,” “us,” or “our”). This Privacy Policy explains what information we collect through mylexshield.com and the LexShield application (together, the “Service”), how we use and protect it, and the choices you have. By using the Service you agree to this Policy.

1. Who this Policy covers

LexShield is built for licensed attorneys and law firms. This Policy applies to two kinds of information:

• Your information — the account and practice information of the attorneys and firms who use the Service.
• Your clients’ information — information an attorney enters about their own clients and matters (for example, client names used to run conflict checks). For that information the attorney or firm is the controller and LexShield acts as a service provider on their behalf. See Section 9.

2. Information we collect

Information you provide

• Account & identity: name, email address, password, and, for attorneys, bar number, licensing jurisdiction, and firm details.
• Authentication credentials: if you enable a passkey, we store the public-key credential used to verify you. The private key and any biometric (fingerprint, face, or device PIN) never leave your device and are never sent to us.
• Practice data you enter: clients and matters, trust-account (IOLTA) ledgers and transactions, CLE records, deadlines, calendar entries, and related notes.
• Support communications: messages you send us and their contents.

Information from your use of the Service

• Payment information: subscriptions are processed by our payment processor, Stripe. We receive your plan and billing status and a Stripe customer identifier; we do not receive or store your full card number.
• Bank-connection data: if you use the optional feature to check a trust-account balance through your bank, we receive a limited, minimized set of data from Plaid — see Section 4.
• AI assistant: if you ask the in-app bar-rules assistant a question, the text of that question is sent to our AI provider to generate a response.
• Technical & log data: IP address, browser and device type, pages accessed, and timestamps, collected automatically to operate and secure the Service.

3. How we use information

• Provide, maintain, and improve the Service and its compliance features.
• Authenticate you and secure your account, including passkey-based multi-factor sign-in.
• Process subscriptions and payments.
• Respond to support requests and communicate with you about the Service.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Bank connections & Plaid

LexShield offers an optional feature that lets you connect a bank account to verify a trust-account balance. We use Plaid Inc. to facilitate that connection. When you link an account:

• You enter your banking credentials directly with Plaid. LexShield never sees, receives, or stores your banking username, password, or full account number.
• From Plaid we receive only a minimized result: a masked account number (last four digits only), the institution or account name, and a point-in-time balance. We do not retrieve or store your transaction history, and we do not retain the Plaid access token after the balance check completes.
• Plaid’s handling of your information is governed by Plaid’s End User Privacy Policy. By using the bank-connection feature you agree to Plaid’s privacy practices.

5. How we share information

We share information only as described here:

• Service providers (subprocessors) who help us operate the Service, under contract and only for that purpose — currently: Stripe (payment processing), Plaid (bank connectivity), Anthropic (AI assistant responses), Microsoft Azure (secure key management), and SmarterASP.NET (application hosting).
• Legal & safety — when required by law, subpoena, or legal process, or to protect the rights, property, or safety of LexShield, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell personal information or share it for cross-context behavioral advertising.

6. How we protect information

• Encryption in transit: all traffic between you and the Service is encrypted using industry-standard TLS.
• Encryption at rest: financial data received through the bank-connection feature is encrypted with AES-256-GCM; the encryption keys are stored in a dedicated key vault, separate from the database.
• Credential protection: passwords are stored only as salted, one-way hashes, and we support phishing-resistant passkey (WebAuthn/FIDO2) multi-factor sign-in.
• Access controls & auditing: role-based access limits who can see data, and trust-account activity is recorded in a tamper-evident audit trail.
• Data minimization: we collect and retain only what the Service needs to function.

No method of transmission or storage is completely secure, but we work to protect your information using the safeguards above.

7. Data retention

We retain your account and practice data for as long as your account is active and as needed to provide the Service, meet legal and compliance obligations, resolve disputes, and enforce our agreements. Balance-check results are retained only as long as needed for your trust-account compliance records. When you close your account, we delete or de-identify your personal information within a reasonable period, except where we are required to retain it by law.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can update much of your account information directly in the Service, or contact us at support@mylexshield.com to make a request. We will not discriminate against you for exercising these rights.

9. Your clients’ data

When you enter information about your own clients and matters, you (the attorney or firm) are the controller of that information and are responsible for having any necessary rights or consents. LexShield processes it on your behalf to provide the Service and does not use it for our own purposes. If one of your clients asks us to access or delete information you entered, we will direct them to you.

10. Cookies

We use only the cookies necessary to sign you in and keep your session secure. We do not use third-party advertising or cross-site tracking cookies.

11. Children

The Service is intended for licensed attorneys and is not directed to anyone under 18. We do not knowingly collect information from children.

12. Where data is processed

LexShield is operated in the United States, and your information is processed and stored there. If you access the Service from outside the United States, you consent to that processing.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after an update means you accept the revised Policy.

14. Contact us

Questions about this Policy or your information? Contact us at support@mylexshield.com.

LexShield provides compliance-tracking tools for informational purposes only and does not provide legal advice.