Draft, under review: these terms have not yet been approved by counsel.

LexBooks: Data Processing Agreement (for each firm)

Version 2026-10-29. This agreement forms part of the LexBooks Terms of Service, during the free trial and on the paid plan. It is written to meet Article 28 of the GDPR and the UK GDPR, and to serve as the service-provider contract that US state privacy laws ask for.

1. Roles

The Firm is the controller of the personal data it puts into LexBooks.
We (RINDOGATAN LLC) are its processor. We process that data only to provide LexBooks, and only on the Firm's documented instructions. These terms, the Firm's settings and its use of the service are those instructions.
If we think an instruction breaks data protection law, we say so and may pause that processing until it is resolved.

2. What we process

Item	Detail
Subject matter	Practice management for a law firm
Duration	The term of the Terms of Service, then the export and deletion period in clause 9
Nature and purpose	Storing, organizing, displaying, sending (e-mail notices, client portal) and, where the Firm switches it on, AI-assisted drafting and summarizing
People concerned	The Firm's users; its clients and prospective clients; their contacts; opposing and third parties named in matters
Kinds of data	Names, contact details, matter descriptions, time and billing records, documents and their contents, signatures and acceptance records (with IP address and browser), portal access records
Special categories	Possible, because matters may reveal health, criminal, or other sensitive facts. The Firm decides what to record.

3. Our duties

Confidentiality. Everyone who can reach the data is bound to keep it confidential, and reaches it only as clause 1 allows.
Security. We keep the measures in the Annex. We may improve them but never lower their overall level.
Help with requests. We help the Firm answer requests from the people concerned (access, correction, deletion, portability, objection) by providing the export and deletion tools and, where they are not enough, by doing it for the Firm within 10 working days.
Help with duties. We give the Firm what it reasonably needs for its own security, breach notification, impact assessments and consultations with authorities.
Breach. We tell the Firm of a personal data breach without undue delay and in any case within 72 hours of becoming aware of it, with what we know (what happened, what data, how many people, likely effects, what we are doing), and we update it as we learn more.
No other use. We do not sell or share the data, use it for our own purposes, combine it with other data, or use it, or anything derived from it, to train or improve any AI model.
Records and audits. We keep records of our processing and make available what the Firm needs to check we keep this agreement: our security summary, test and rehearsal records, and answers to reasonable written questions. An on-site audit, if the law requires one, is on 30 days' notice, at the Firm's cost, at most once a year unless a breach calls for it.

3A. California

For personal information subject to the California Consumer Privacy Act, as amended (Civil Code 1798.100 and following, and 11 CCR 7000 and following), we act as the Firm's service provider (Civil Code 1798.140(ag)), and:

Business purposes. We process it only for these specified business purposes: hosting, storing and displaying the Firm's workspace; sending the e-mail and client pages the Firm uses; taking the Firm's payments; optional AI drafting the Firm switches on; security, backup and restore; support the Firm asks for; and fixing errors.
No selling or sharing. We do not sell or share it, as those words are defined in the Act.
No other use. We do not retain, use or disclose it for any purpose other than those business purposes, for any commercial purpose other than them, or outside the direct business relationship between the Firm and us; and we do not combine it with personal information we receive from anyone else or collect ourselves, except as the regulations allow for a business purpose.
Same protection. We comply with the Act and give it the same level of privacy protection the Act requires of the Firm.
Checks. The Firm may take reasonable and appropriate steps to make sure we use it in a manner consistent with the Firm's obligations under the Act, including the records and answers in clause 3.7.
Notice. We tell the Firm within 5 working days if we decide we can no longer meet our obligations under the Act.
Stop and remediate. On notice, the Firm may take reasonable and appropriate steps to stop and remediate any use of it that the Firm has not authorized, and we cooperate.
Consumer requests. We help the Firm answer consumers' requests as clause 3.3 says.
Sub-processors. We bind each sub-processor by a written contract with the same terms.
Certification. We certify that we understand these restrictions and will comply with them.

4. Sub-processors

The Firm gives general authorization for the sub-processors below. We bind each by written terms giving at least the protection of this agreement, and we stay responsible to the Firm for them.

Sub-processor	What it does for LexBooks	When it applies	Data location
Supabase, Inc. (database host)	Database, sign-in, file storage, server functions	Always	United States (US East)
Vercel, Inc. (web host)	Serves the web application and its server routes	Always	United States
Resend (mail provider)	Sends every LexBooks e-mail from lexbooks.app: sign-in e-mails (account confirmation, invitations, password resets), the firm's notices (proposal answers, online payments), trial and billing reminders, and deletion confirmations	Always	United States
Groq, Inc. (AI gateway)	Runs AI drafting and summaries, without keeping the data or training on it	Only if the Firm switches its AI setting on. With AI off, no data goes to it.	United States
Scaleway SAS (AI gateway, EU option)	Runs AI drafting and summaries for a firm that chooses the EU option, where LexBooks offers it	Only if the Firm's AI setting is the EU option.	France (Paris, EU)
Dropbox, Inc. (backup store)	Holds the encrypted copies of the nightly database backup, which it cannot read; each copy is deleted after 30 days	Always	United States
Stripe, Inc. (payment provider)	Takes the subscription payment on its own hosted page, works out sales tax from the billing address, and issues our invoices; sees the Firm's billing contact, never client data	For a firm on the paid plan	United States

Changes. We give the Firm at least 30 days' notice by e-mail before adding or replacing a sub-processor. The Firm may object on reasonable data protection grounds; if we cannot meet the objection, the Firm may end the Terms of Service for the affected service without penalty and with a pro rata refund of fees paid in advance.

5. International transfers

The data is stored and processed in the United States. Where personal data reaches us or a sub-processor from the European Economic Area, Switzerland or the United Kingdom, we rely on the recipient's certification under the EU-US Data Privacy Framework (and its UK Extension and the Swiss-US framework) where it holds one, and otherwise on the European Commission's Standard Contractual Clauses, module two (controller to processor) between the Firm and us and module three (processor to processor) between us and the sub-processor, together with the UK International Data Transfer Addendum. Those clauses are incorporated into this agreement by reference. We have assessed these transfers and keep that assessment available to the Firm on request.

6. Professional secrecy

We understand that much of the data is covered by legal professional privilege or professional secrecy. We do not claim to waive either, we resist any demand for the data that does not come through the Firm, and, unless the law forbids it, we tell the Firm of any such demand before answering it so the Firm can object. We send that notice to the Firm's administrators by e-mail. The Firm can reach us about it at support@lexbooks.app.

7. Liability

Liability under this agreement is governed by section 8 of the Terms of Service, and counts towards the single cap set there, to the extent the law allows.

8. Order, law and courts

If this agreement and the Terms of Service conflict about personal data, this agreement wins. This agreement is governed by the laws of the State of California, and the courts of the City and County of San Francisco have exclusive jurisdiction, as in section 9 of the Terms of Service, except where the Standard Contractual Clauses or the UK Addendum require another law or forum for a matter they govern.

9. End of processing

At the end of the Terms of Service the Firm may export its data for 30 days. We then delete it from the live service. A workspace that is read-only because a trial ended or a payment failed is deleted after 6 months in that state, with 30 days' notice by e-mail first. Copies in backups are deleted as the backups age out, within 37 more days at most, unless the law requires us to keep something, in which case we keep only that, only for as long as required, and process it for nothing else. We confirm deletion in writing on request.

Annex: security measures

Encryption in transit (TLS) for every connection; encryption at rest by the database host.
Separation of firms enforced by row rules in the database, keyed on the user's firm record rather than on anything the user can edit; tested automatically against access across firms on every change to the code.
Individual accounts. A new firm confirms its e-mail address, and its California bar number is checked before it can send anything to clients. Colleagues join only by invitation from a firm administrator, who alone changes roles.
Two-step sign-in (authenticator app), mandatory for firm administrators, optional or required for other users as the firm decides, enforced by the database; single-use recovery codes; resets only by the firm's own administrator, recorded in the audit trail.
Append-only audit trail of client portal access and agent gateway calls.
Secrets kept out of the code and out of the public bundle.
Daily host backups of the database and a nightly encrypted copy of the database held off the host; recorded restore tests every three months, the first on 15 October 2026. Uploaded files are not yet in these backups.
Monitoring: our hosting and database providers monitor availability and security on their platforms, and we receive a daily summary of security events (such as failed sign-ins) whenever they cross a set threshold.
Contact for security reports: security@lexbooks.app.