Last updated 10 October 2026
What we collect when you use LexCases, how we use it, and how we protect it.
Research tool, not legal advice
This Privacy Policy explains what information Radwan Hajjar trading as LexCases AI (“LexCases”, “we”, “us”, or “our”) collects when you use the Services, how we use it, and how we protect it.
LexCases does not sell your data, does not train generalised AI models on your search history, and does not share the personal details of clients or other identified individuals that you might inadvertently include in a prompt.
LexCases provides services to individual users (students, researchers, and qualified lawyers) and to enterprise customers under separate written agreements.
For individual users, Radwan Hajjar trading as LexCases AI acts as the controller of personal information. For users provisioned through an enterprise agreement (for example a law-school subscription), the enterprise customer may act as the controller and LexCases as a processor on its behalf.
We do not share your information with universities, firms, or other organisations unless they are formal enterprise customers and you are in their approved user group.
Account information (name, email address, profile image, and authentication identifiers received from our auth provider), limited billing information from our payment processor, the search prompts you submit and the case results generated for them, usage counts used to apply plan limits, the optional personalisation profile you save in Account settings (your selected role, primary jurisdiction, areas of focus, and the free text description of your work), support and feedback submissions, log/device/usage data, and limited data from sign-in and service providers used to operate the Services.
If you use the study schedule, we also store the study profile you give us: your year of study, jurisdiction, goal, the hours you can study each week, when and how long you like to study, where you tend to fall behind, the modules you are taking this term with their exam dates and deadlines, and a record of the study sessions you mark as done. Signed out, this stays in your browser tab and is deleted when you close it.
Some of what you build in LexCases stays on your own device rather than on our servers. Your saved cases, notes, stars, and folders (your workspace) are stored locally in your browser, which means they are tied to that device and are not synced across your other devices or held on our systems.
We do not knowingly collect, and we do not want to receive, the personal details of clients, opposing parties, or other identified individuals that you might inadvertently include in a prompt. You agree not to paste such material into LexCases.
We use information to operate and maintain the Services, authenticate users, prevent abuse, enforce plan limits, run searches and surface their results, keep your search history available to you, tailor case rankings and Foundations to the personalisation profile you have saved (role, jurisdiction, areas of focus, and free text context), improve reliability and search quality, communicate service notices, and comply with legal obligations.
We use your study profile to build your schedule and daily plan, to pitch searches, mock exams, recall questions, flashcards and the Question Advisor to your year and your jurisdiction, and to show your progress. It never changes what your plan includes.
Weekly study emails are off unless you turn them on in Account settings. Each one has a link to stop them. If you create a calendar link, anyone with that link can see your study dates and module names, so you can revoke it at any time.
Your personalisation profile is attached to your account only; it is never combined with another user's prompt and you can edit or clear it at any time from Account settings. If you leave the personalisation fields blank, no profile context is sent with your searches.
Aggregated, de-identified usage statistics may be used to prioritise product work and to publish anonymous benchmarks.
LexCases does not hold or licence a case-law database. Your prompt is sent to our AI model provider, which proposes candidate cases, and a second, separate pass checks each one before it is shown to you. Anything that cannot be confirmed is dropped rather than displayed.
Your prompt is not sent to any case-law database, publisher or court service. Where a result carries a source link, that link points to a publicly available record and you open it yourself; we do not fetch it on your behalf, so opening it is a request from your browser to that site, not from us.
We do not transmit your account identifiers or billing information to the model provider beyond what is needed to run the request.
We do not use the personal data of our users to develop, train, or improve generalised AI or machine-learning models. Anonymised, aggregated query patterns may be used internally to tune ranking and retrieval quality.
We use cookies and similar technologies primarily for authentication, session integrity, account security, CSRF protection, and remembering your preferences (such as the cookie banner choice).
Authentication and session providers used in the product may set cookies needed for sign-in and secure account access.
Optional analytics and ad measurement are only enabled after you accept them in the cookie banner. Until you accept, nothing is sent to our analytics provider (PostHog) or to Meta, and neither sets a cookie or browser storage. If you accept, PostHog counts page views and basic feature usage, and may record a replay of your screen with every text field masked; it does not follow you across other sites. If you accept, the Meta pixel also tells Meta that a page was viewed and, once, that a new account was created, so we can see whether our ads on Facebook and Instagram lead to sign-ups. It sends no name, email address or account identifier, but Meta may link these events to a Facebook or Instagram account you are signed into in the same browser, under its own privacy policy. If you decline, or never answer, both stay off, and withdrawing your consent later switches both off.
We may share information with the service providers listed in the next section, with enterprise customers under contract for users they have provisioned, in connection with business transfers (such as a merger, acquisition, or sale of assets), or when required for legal or safety purposes.
We do not sell personal information, and we do not allow service providers to use your data for their own marketing purposes. The one exception is Meta: only if you accept optional cookies, it receives the page-view and sign-up events described below and handles them under its own privacy policy.
LexCases relies on the following third-party processors to deliver the Services. Each processor receives only the data needed for its specific role. Their own privacy policies govern their handling of that data; the links below take you to each processor's current policy.
Clerk (authentication): receives your name, email address, profile image, and authentication identifiers. Privacy policy: https://clerk.com/legal/privacy.
Stripe (payment processing): receives your billing details (name, billing address, last-four card digits, and payment-method tokens) when you subscribe to LexCases Pro. LexCases never sees or stores your full card number. Privacy policy: https://stripe.com/privacy.
Resend (transactional email): receives your email address and the body of operational emails (account, billing, and security notices). Privacy policy: https://resend.com/legal/privacy-policy.
Vercel (frontend hosting): serves the LexCases web application. Receives your IP address and request headers for routing purposes. Privacy policy: https://vercel.com/legal/privacy-policy.
Railway (backend hosting and database): hosts the LexCases API server and PostgreSQL database. Stores your account record, search history, and Library entries. Privacy policy: https://railway.app/legal/privacy.
OpenAI (AI processing): your search prompt, selected jurisdictions, and writing-style preference are sent to OpenAI's gpt-4o model to generate case results. The separate check described above sends the same provider the identity of each candidate case (its name, citation, court, jurisdiction and year) and no further information about you. OpenAI does not use API inputs to train models. Privacy policy: https://openai.com/policies/privacy-policy.
Google Sheets (operational logging): a controlled subset of sign-up and support events is appended to a private Google Sheet for operational follow-up. Receives the email address tied to the event and the event timestamp. Privacy policy: https://policies.google.com/privacy.
PostHog (product analytics and session replay, after consent only): if and only if you accept analytics cookies in the cookie banner, PostHog receives page views, feature-usage events (for example that a search finished or a note was created, never the words in it), and, for a signed-in account, your account identifier, email address and name so that visits from the same person can be counted once. It may also receive a session replay: a recording of what your screen showed, in which every text field is masked before it leaves your browser, so anything you type or paste (a search, a question, a note, an essay) is never sent. We use replays to find what breaks or confuses students. PostHog stores this data in the European Union. No analytics events and no replay are sent before consent. Privacy policy: https://posthog.com/privacy.
Meta Platforms Ireland (ad measurement, after consent only): if and only if you accept optional cookies in the cookie banner, the Meta pixel loads and sends Meta two kinds of event: that a page on LexCases was viewed, and, once, that a new account was created. Neither event carries your name, email address or account identifier, and we do not use Meta's advanced matching. Meta still receives what any web request carries (your IP address, browser details and the address of the page) and sets its own cookie, and it may connect these events to a Facebook or Instagram account you are signed into. We use this only to see whether our ads lead to sign-ups. Nothing is sent to Meta before consent. Privacy policy: https://www.facebook.com/privacy/policy.
We use reasonable technical and organisational safeguards including encryption in transit, encryption at rest for stored search history, scoped access controls, and secure hosting in the European Economic Area.
No system is completely secure. You remain responsible for keeping your account credentials safe and for not sharing your sign-in details with others.
We retain personal information as long as needed to provide the Services and satisfy legal obligations. Your search history is retained for the lifetime of your account so that your past searches remain accessible; you can delete individual searches at any time. Your saved workspace (cases, notes, stars, and folders) lives in your browser rather than on our servers, so clearing it is done from your own device.
Your study profile, schedule and session history are kept for the life of your account. You can edit or clear them in Account settings, and they are deleted with your account.
When you request account deletion, we remove your profile, search history, and billing identifiers from our production systems within thirty days. Some information may be retained in anonymised or aggregated form, or in encrypted backups and archives, for a limited additional period required by law or by our backup retention schedule.
You may request access, correction, export, or deletion of the personal data we hold about you by contacting support@lexcases.ai from the email address on the account, subject to identity verification.
Depending on your location, additional privacy rights may apply under local law - for example the GDPR in the EEA, the UK GDPR in the United Kingdom, and comparable rights in other jurisdictions. You also have the right to lodge a complaint with your local data-protection authority.
We do not currently respond to Do Not Track browser signals due to the lack of a consistent standard. Our cookie banner provides a clear opt-out of optional analytics and ad measurement cookies that you can use instead.
The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16.
If you believe such information was collected, contact support@lexcases.ai and we will take appropriate steps, including closing the account.
Radwan Hajjar trading as LexCases AI is operated from the Republic of Ireland. Information may be transferred to and processed in Ireland, in other countries within the European Economic Area, or in other countries where our service providers operate, in each case subject to appropriate transfer safeguards where required by law.
Questions about this policy can be sent to support@lexcases.ai. We aim to reply within five working days.
This page is for informational purposes only and does not constitute legal advice.
Effective 10 October 2026. Read the Terms of service →