Privacy Policy

Last updated: June 3, 2026

1. Introduction

Lexful, Inc. ("the Company," "we," "us," or "our") operates the website lexfui.com and the Lexful platform (collectively, the "Service"). Lexful is a knowledge-operations platform built for managed service providers: it stores and organizes runbooks, credential vaults, and per-client asset records on behalf of the MSP businesses that subscribe to it. Because that data includes operational secrets -- stored credentials, client system inventories, and access procedures -- we treat data protection as a first-class obligation, not a compliance footnote.

This Privacy Policy describes what personal information we collect from people who visit lexfui.com, create an account, or interact with our marketing and support channels. It does not govern the MSP client data that subscribing businesses upload through the platform -- that is addressed in our customer agreements.

We are based at 800 Brazos Street, Suite 410, Austin, TX 78701 and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

Contact details (name, work email, phone number) when you fill out a form, request a demo, or subscribe to our operator newsletter;
Company information you choose to share (company name, MSP size, PSA tool in use, role);
Account registration details (name, email, password hash) when you create a Lexful account;
The content of any messages you send us through the contact form or support channels.

2.2 Information Collected Automatically

When you visit lexfui.com, we automatically collect limited technical information:

IP address and approximate location (city/region level);
Browser type, operating system, device class;
Pages visited, referring URLs, time on page;
Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.3 Platform Operational Data

If you use the Lexful platform as an MSP subscriber, the Service processes operational knowledge records you and your team upload -- including runbook documents, credential entries (stored encrypted, never in plaintext), and asset inventory data. This data is processed solely to provide the knowledge-operations features you signed up for. We do not use customer-uploaded operational content to train machine learning models or for any purpose beyond operating and improving the Service as described in your customer agreement.

2.4 We Do Not Knowingly Collect Children's Data

Lexfui.com is a business-to-business platform not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it promptly.

3. How We Use Information

We use the information we collect to:

Respond to inquiries, provide requested information, and deliver the platform to subscribing MSPs;
Operate, maintain, and improve the Service, including its runbook, credential vault, and asset-records features;
Send transactional communications (account notices, product updates) and, with your consent where required, marketing communications such as our monthly operator newsletter;
Detect, investigate, and prevent unauthorized access, fraud, or abuse of the platform -- especially important given that the platform holds sensitive operational credentials on behalf of MSP businesses;
Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

Service providers acting on our behalf (for example, cloud hosting, email delivery, error monitoring, product analytics) under contractual confidentiality terms that prohibit those providers from using data for their own purposes;
Authorities, when required by law, legal process, or to protect the rights, safety, or property of the Company, our customers, or others;
A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy and prior notice to you.

We do not sell personal information to third parties.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For full details and your opt-out choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described above, to comply with legal or accounting obligations, and to resolve disputes. Inactive marketing-list contacts are removed after 24 months of no engagement. Server access logs are retained for 90 days, then aggregated. Credential and operational records held on behalf of MSP subscribers are retained for the term of the customer agreement and deleted within 30 days of account termination upon request.

7. Security

Protecting operational data -- credentials, runbooks, asset records -- is the core reason Lexful exists, and we apply the same rigor to personal information. Our safeguards include AES-256 encryption at rest for all stored credentials, TLS 1.3 for data in transit, role-based access controls that limit who can see what within your account, and immutable access logs for credential reveals. We operate with least-privilege access controls on our own infrastructure. No system is perfectly secure; we cannot guarantee absolute security, but protecting your data is built into every layer of our architecture.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing of your personal information. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. Texas Residents (TDPSA)

Under the Texas Data Privacy and Security Act ("TDPSA"), Texas residents have the rights described below regarding personal data we control or process.

9.1 Your TDPSA Rights

Right to Confirm and Access: confirm whether we are processing your personal data and obtain access to it.
Right to Correct: correct inaccuracies in your personal data.
Right to Delete: request deletion of personal data we have collected from or about you.
Right to Data Portability: obtain a portable copy where we maintain it electronically and where technically feasible.
Right to Opt Out: opt out of targeted advertising, sale of personal data, and profiling for decisions producing legal or similarly significant effects. We do not engage in any of these activities.

9.2 Sensitive Data Consent

If we ever process sensitive data as defined under TDPSA (for example, precise geolocation, biometric, or health data), we will obtain your prior consent. The Service does not currently process such sensitive data for its own marketing or analytics purposes.

9.3 How to Exercise

Email [email protected]. We respond within 45 days; one 45-day extension is available with notice to you.

9.4 Appeal

If we deny your request you may appeal by replying to our response. If denied on appeal, contact the Office of the Texas Attorney General Consumer Protection Division.

9.5 California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to:

Lexful, Inc.
800 Brazos Street, Suite 410
Austin, TX 78701
Email: [email protected]
Phone: +1 (512) 771-0148