Privacy Policy

Last updated: September 18, 2026

Introduction

Lexicon AI, Inc. (“Lexicon”, “we”, “us”, or “our”) provides an AI-powered operations platform for credit investment managers. This Privacy Policy describes how we collect, use, and disclose personal information when you visit our website (the “Site”) or use the Lexicon platform and related services (together with the Site, the “Services”).

Please read this Privacy Policy carefully. By using the Services, you acknowledge the practices it describes.

Customer Data

Our customers are businesses. When a customer uses the Services, it may connect its own systems and provide business records, documents, and communications for the Services to process (“Customer Data”). Customer Data can include personal information about the customer’s employees, counterparties, and other third parties.

We process Customer Data on behalf of our customer and under the customer’s instructions, as set out in our agreement with that customer. The customer controls its Customer Data and is responsible for its own privacy practices. This Privacy Policy does not govern Customer Data. If your personal information is in Customer Data and you have a question or request about it, please contact the customer that submitted it. We will support the customer in responding.

Customer-Hosted Deployments

A customer may choose to deploy the Lexicon software in its own cloud environment instead of using our hosted Services. In a customer-hosted deployment, the customer operates the software and stores its data, and the customer’s own policies govern that data. We do not receive or access data from a customer-hosted deployment unless the customer grants us access, for example to provide support.

Information We Collect

Information you provide to us

• Account information. When you or your organization sets up an account, we collect your name, business email address, organization, role, and login credentials.
• Communications. When you contact us, request a demo, or ask for support, we collect your contact details and the content of your messages.
• Content you submit. We collect the feedback, instructions, and other content you enter while you use the Services.
• Agent and integration data. In deployments where Lexicon receives or processes data in connection with an agent workflow, the Services may process information needed to perform the requested workflow, such as URLs or page titles, screenshots or representations of visible page elements, uploaded files, data read via enabled API integrations, and interaction context. In customer-hosted deployments, Lexicon does not receive or access this information except to the extent the customer authorizes Lexicon to do so.

Information we collect automatically

• Device and usage information. We collect information about how you access and use the Services, such as your IP address, browser type, operating system, pages viewed, actions taken, and the dates and times of your visits.
• Log and diagnostic information. We collect logs, error reports, and security event records to operate, troubleshoot, and protect the Services.

Information from third parties

• Your organization. An administrator at your organization may give us your name, email address, and role to create or manage your account.
• Sign-in providers. If you sign in through a single sign-on provider, we receive your name, email address, and account identifier from that provider.

Cookies and Similar Technologies

We use cookies only to sign you in, keep you signed in, and secure the Services, for example to protect sign-in requests against forgery. We do not use cookies for analytics or advertising, and our analytics and error monitoring do not rely on cookies. We also use your browser’s local storage to remember preferences, such as your display theme and page layout. If you set your browser to refuse cookies, you will not be able to sign in to the Services. Some browsers send “Do Not Track” signals. We do not currently respond to them.

How We Use Your Information

We use personal information to:

• provide, operate, and maintain the Services;
• create and manage accounts and authenticate users;
• respond to your requests and provide customer support;
• send you service-related notices, such as security alerts and account updates;
• monitor, troubleshoot, and improve the reliability and performance of the Services;
• detect, prevent, and investigate security incidents, fraud, and misuse; and
• comply with legal obligations and enforce our agreements.

We may also create aggregated or de-identified information that does not identify you, and use it for any lawful purpose.

Artificial Intelligence

• AI features. The Services use AI models to analyze information and to produce summaries, findings, and recommendations. AI-generated output can contain errors. It is meant to be reviewed by people and is not a substitute for their final judgment.
• Third-party model providers. Depending on the deployment configuration, AI features may use third-party AI model providers. Where Lexicon selects and contracts with the provider, we send only the information needed to perform the requested task and require the provider not to use that information to train its models. Where a customer uses its own provider account or API key, that processing is governed by the customer’s configuration and agreement with that provider.
• No model training. We do not use Customer Data or your personal information to train AI models.
• No automated decisions about you. We do not use AI to make decisions that produce legal or similarly significant effects about individuals.

How We Share Your Information

We do not sell your personal information. We may share it with:

• Service providers. Companies that provide services on our behalf, such as cloud hosting, AI model processing, error monitoring, email delivery, and analytics. They may use personal information only to provide those services to us.
• Your organization. If you use the Services through your organization, authorized users and administrators at your organization can see information associated with your account.
• Professional advisors. Lawyers, auditors, and other advisors, where needed to obtain advice or protect our interests.
• Legal and safety. Government authorities or other parties, when the law requires it, or when we believe disclosure is needed to protect the rights, property, or safety of Lexicon, our users, or others.
• Business transfers. A buyer, successor, or other party in connection with a merger, acquisition, financing, sale of assets, or similar transaction.
• With your consent. Other parties, when you or your organization direct or permit us to share.

Data Retention

We keep personal information for as long as we need it to provide the Services and for the other purposes in this Privacy Policy, such as meeting legal obligations, resolving disputes, and enforcing our agreements. We retain and delete any Customer Data that Lexicon receives or stores as specified in our agreement with the customer. When we no longer need personal information, we delete it or de-identify it.

We keep audit records of security events and account activity, such as sign-ins and changes to settings, for as long as the organization’s account exists. These records can include a user’s email address, IP address, and browser details. We keep them after an individual user account is deleted, so that the organization has a complete audit history. We delete them when the organization’s account is deleted.

Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit and at rest, access controls, multi-factor authentication, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Rights and Choices

• Account information. You can review and update some account information in the Services. Your organization’s administrator can also update it.
• Privacy rights. Depending on where you live, you may have the right to access, correct, delete, or receive or port your personal information, and to object to or restrict certain processing. Where we rely on your consent, you may withdraw that consent at any time. To make a request, contact us atteam@trylexicon.com. We may need to verify your identity before we act on your request. Where the law permits, we keep the audit records described in Data Retention after a deletion request. We will not discriminate against you for exercising these rights.

If you are in the European Economic Area or the United Kingdom, we process personal information to perform our contract with you or your organization, to pursue our legitimate interests in operating and securing the Services, to comply with legal obligations, or with your consent. You may also lodge a complaint with your local data protection authority.

International Data Transfers

We are based in the United States, and we process information in the United States. Our service providers may process information in other countries. Where the law requires, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or other legally recognized transfer mechanisms, for transfers of personal information out of the European Economic Area, the United Kingdom, and Switzerland.

Third-Party Sites and Services

The Services may link to or integrate with websites and services that third parties operate. This Privacy Policy does not apply to them. Please review their privacy policies.

Children

The Services are intended for business use and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above. If we make material changes, we will notify you by email or through the Services before they take effect.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, or want to report a privacy concern, contact us at team@trylexicon.com.