Privacy Policy
Last updated October 16, 2026
Who We Are
AIstrova Technologies Inc. provides this privacy notice for TruLexa, our product, to explain how we handle your personal information when you use our services, visit our websites, or interact with us through sales, marketing, or events.
Main Points
Your Personal Information
- We may collect personal information, such as account, profile, billing, contact, login, device, and technical information, depending on how you use TruLexa and only as reasonably needed to create, administer, bill for, and secure your account.
- We do not require sensitive personal information for account/profile setup. Legal matter content submitted by authorized users may contain sensitive or privileged information and is processed transiently only as needed to perform the requested TruLexa workflow.
- We do not sell personal information or disclose it to third parties for their own marketing, advertising, AI-model training, resale, viewing, independent access, or unrelated commercial purposes.
Client Matter Content
Legal matter content and legal workflow content submitted by authorized users may contain sensitive or privileged information. TruLexa processes that content transiently only as needed to perform the requested workflow and return the response.
When the workflow ends, TruLexa does not retain prompts, chats, documents, uploaded files, selected context, or generated workflow content in TruLexa-controlled server-side systems. Copies of prompts, documents, uploaded files, selected context, and generated workflow content sent to approved AI workflow providers are deleted from the provider environment when processing ends, subject to the applicable service configuration and legal requirements.
How We Use Your Information
- We do not use customer data submitted through TruLexa or related support channels — including account data, legal matter content, prompts, chats, documents, uploaded files, selected context, support communications, or generated legal content or workflow outputs — to train TruLexa models or third-party AI models.
- We use account, profile, billing, contact, login, device, and technical information to:
- create and administer accounts;
- authenticate users;
- provide service communications;
- process billing and payment matters;
- maintain security;
- prevent abuse; and
- support TruLexa.
- Legal matter content, including prompts, chats, documents, uploaded files, selected context, and generated legal content or workflow outputs, is processed transiently only as needed to perform the requested TruLexa workflow and return the response. TruLexa does not retain completed matter content as a product record.
- Where an approved external AI workflow provider is used, submitted workflow content is processed on AIstrova's behalf under written contracts or equivalent privacy and security terms. TruLexa does not authorize external AI providers to use Client Data for AI-model training, advertising, resale, viewing, independent access, or unrelated commercial purposes.
- Core AI workflow processing is configured for Canadian data-centre regions where supported by the applicable service configuration. Copies of prompts, chats, documents, uploaded files, selected context, and generated workflow content sent to AI workflow providers are deleted when processing ends, subject to the applicable service configuration and legal requirements.
AI Processing
For AI-assisted workflows, TruLexa may use proprietary AI models running on servers managed by AIstrova and approved external AI workflow providers, including Google's Gemini Enterprise Agent Platform where configured. Legal matter content is processed only as needed to perform the requested workflow and return the response. TruLexa does not authorize external AI workflow providers to use Client Data for AI-model training, advertising, resale, viewing, independent access, or unrelated commercial purposes.
Data Sharing
We do not sell personal information or disclose it to third parties for their own marketing, advertising, AI-model training, resale, viewing, independent access, or unrelated commercial purposes.
Personal information is transferred to approved service providers/subprocessors only for limited processing on AIstrova's behalf and only where required for a specific TruLexa service function, such as Canadian cloud hosting, authentication, AI workflow processing, service communications, billing/payment processing, security, or customer support. These providers are restricted by written contracts or equivalent privacy and security terms and may process personal information only for the authorized service purpose.
Confidential legal matter content — including prompts, documents, uploaded files, selected context, and generated legal content or workflow outputs — is not provided to ancillary providers such as billing or service-email providers for matter-content processing. The advertising-measurement exception is limited to optional public-website measurement described in section 6 of this Privacy Policy, with the specified choice controls and data limits. It does not authorize disclosure of account or matter information for advertising, or sale, AI-model training or unrelated exploitation of Client Data.
Redaction of Personal Information
Identifier masking is designed to reduce the personal identifiers transmitted in messages and attachments to approved external AI providers. Coverage depends on the workflow, format, language and recognition quality; not every identifier or confidential detail will be detected or masked. This safeguard supports, but does not replace, professional review and oversight.
Security
We maintain physical, organizational, and technological safeguards appropriate to the sensitivity of the information processed through TruLexa, including controls designed to protect confidential legal matter content, client records, account information, and service infrastructure against loss, theft, unauthorized access, disclosure, copying, use, or modification. These safeguards include access restrictions, encryption, administrative controls, security monitoring, and incident-response procedures. No online service can guarantee absolute security, but TruLexa maintains safeguards intended to reduce risk and support confidentiality, integrity, and availability.
Privacy Officer
Fred Zhang is AIstrova's designated Privacy Officer for TruLexa. Privacy questions, access or correction requests, and security-review requests should be sent to privacy@aistrova.com.
Breach Response
AIstrova maintains documented incident-response and breach-record procedures designed to support compliance with PIPEDA's breach of security safeguards obligations. Breach records involving personal information under AIstrova's control are retained for at least 24 months from the date AIstrova determines that the breach occurred, or longer where required by applicable law.
Your Rights
- You have specific privacy rights based on your location.
- Exercise your rights by contacting privacy@aistrova.com or through Discord @ our Discord community.
- We handle all requests according to applicable data protection laws.
Questions? If you have concerns or disagree with our practices, please contact privacy@aistrova.com.
Cookies
Essential storage supports the service. Optional public-website measurement and your choices are described in section 6 of this Privacy Policy.
TABLE OF CONTENTS
- What information do we collect?
- What do we do with information we collect?
- What gives us the right to use your personal information?
- Who gets to see your personal information?
- How do we protect your data when using AI features?
- Do we track your activity with cookies and similar tools?
- How do we manage Google and Microsoft sign-in?
- For how long do we store your information?
- How do we protect your data?
- Do we collect information from minors?
- What control do I have over my personal information?
- How do we handle Do-Not-Track (DNT) requests?
- What privacy rights do US residents have and how can they exercise them?
- Will we update this Privacy Notice?
- How can I contact you about privacy?
- How can I see, change, or delete my personal information from our systems?
1. What information do we collect?
We collect information you voluntarily share when you:
- Sign up for our services
- Request information from us
- Interact with our services
- Contact us
What We Collect
The basic information we collect includes:
- Your email address
- Your username
- Your password
We do not require sensitive personal information for account/profile setup. Legal matter content submitted by authorized users — including prompts, documents, evidence, privileged communications, litigation strategy, and client records — may contain sensitive personal information and is processed only as needed to perform the requested TruLexa workflow. When the workflow ends, TruLexa does not retain prompts, chats, documents, uploaded files, selected context, or generated workflow content in TruLexa-controlled server-side systems, and copies sent to approved AI workflow providers are deleted from the provider environment.
Payment Information
For B2B or legal firm offers, please reach out to our sales team at sales@aistrova.com for tailored inquiries. Simply email them with your details, and they'll guide you through the process at your convenience.
Google and Microsoft Sign-In
Google and Microsoft sign-in is available only to users already registered with TruLexa. Before proceeding, you must confirm that you accept our Terms of Service and acknowledge this Privacy Policy. When you sign in, we may receive profile information from the provider, such as your name and email address, according to the permissions granted. Section 7 of this Privacy Policy provides more details.
Your Responsibility
You must not use disposable temporary emails to sign up for our services.
Information We Collect Automatically
When you use our services through a browser like Google Chrome, we automatically collect:
Technical data about your device and how you use our services, including:
- Your IP address
- Your device and browser details
- Your operating system
- Language settings
- Websites that referred you to us
- When and how you use our services
We collect this data to:
- Keep our services secure and working properly
- Analyze how our services are used
- Create internal reports
This automatic collection does not, by itself, provide us with your name or contact details. We use cookies and similar tracking technologies, like many other businesses.
Usage Data: We use account-administration records, such as request counts, and technical diagnostic details, such as processing stages and error codes, to operate and support the Services. Optional measurement of visits to eligible public pages follows the consent choices and data limits in section 6 of this Privacy Policy; it does not include account or product pages or client-matter content.
Payment credentials are handled by Stripe. Account and subscription-administration records are handled separately in Supabase. Neither function includes confidential matter-content processing. Passwords are handled by the sign-in provider; do not send passwords or confidential client files to support. Acknowledgement of this Privacy Policy does not authorize optional measurement.
2. What do we do with information we collect?
We use your information to:
-
Run Your Account We use your data to create and maintain your account, including login capabilities.
-
Provide Customer Support We use your information to answer your questions and resolve any problems you have with our services.
-
Get Your Feedback We may contact you to ask how we're doing and learn about your experience with our services.
-
Send Product Updates We may use your information to send you product updates. You can stop receiving these at any time.
-
Improve Our Services We analyze how people use our services to make them better and identify areas for improvement.
This information is also used to:
- Operate and enhance our services
- Keep in touch with you
- Maintain security and prevent fraud
- Meet legal requirements
Any use of your information beyond the purposes described in section 2 of this Privacy Policy requires your explicit consent unless applicable law specifically permits or requires that use without consent. Such an exception does not authorize an unrelated use. Optional public-website measurement is limited to section 6 of this Privacy Policy and is not authorized by accepting the Terms or submitting a support request.
3. What gives us the right to use your personal information?
We process your personal information only when we have a valid legal reason under applicable law. Depending on the requirements of that law, these reasons may include:
- Your consent
- Legal compliance requirements
- Providing you our services
- Fulfilling our contract with you
- Protecting your rights
- Serving our legitimate business interests
Special Rules for Canadian Residents
For Canadian users, we can process your information in two main ways:
- With your explicit permission for specific purposes
- Where your consent can be reasonably implied and applicable law permits it
You always have the right to withdraw your consent.
We may also process your information without consent in specific situations permitted by Canadian law, such as:
- When urgent individual interests are at stake
- To prevent fraud or conduct investigations
- During certain business transactions
- To handle insurance claims using witness statements
- To contact next of kin in emergencies
- To protect potential victims of financial abuse
- When gathering consent would compromise information accuracy
- To comply with legal orders
- When processing work-related information
- For journalism, art, or literature
- When information is already publicly available as specified by regulations
Each exception is limited to its statutory conditions; a contract or claimed legitimate business interest is not by itself a substitute for consent where Canadian law requires it. Withdrawal of consent remains subject to lawful contractual restrictions, legal requirements and reasonable notice where applicable.
4. Who gets to see your personal information?
AIstrova’s personnel-access rules authorize access only to account-administration information (account and subscription status and usage counts) and technical diagnostic details (such as processing stages and error codes), only where necessary for customer support, investigation of suspected misuse, legal compliance or service security. These rules do not authorize personnel to access sensitive information or client-matter content, including prompts, chats, documents, uploaded files, selected context and generated results. This restriction defines permitted access; it is not a guarantee that unauthorized access can never occur.
We limit sharing your information to rare, specific occasions.
We may (or may not, depending on our agreements with third parties) share your personal information when:
- We're involved in business changes like mergers, selling our company assets, or if another company buys us or parts of our business (including during negotiations for these changes).
When you request support, we rely on your implied consent to access only the account-administration information and technical diagnostic details reasonably necessary to handle that request, where permitted by applicable law. We obtain express consent where the law requires it. Any access needed for security, investigation of misuse or legal compliance remains limited to account-administration information and technical diagnostic details and to the circumstances permitted by the Privacy Policy and applicable law. Provider processing is limited to the functions described in our service-provider disclosure. Business-transaction disclosures must satisfy the applicable statutory conditions and confidentiality requirements; negotiations alone do not authorize unrestricted disclosure.
5. How do we protect your data when using AI features?
We use artificial intelligence (AI) technology in our services to provide you with better features and tools.
Our AI Features Include But Are Not Limited to:
- Legal document drafting
- Case law verification
- Lightning-fast research
- Citation checks
- AI inaccuracy checks
- Integration controls
Redaction of Personal Information
Our redaction feature automatically masks the personal identifiers it detects in user messages and file attachments before sending them to an approved external AI workflow provider, such as Google's Gemini Enterprise Agent Platform. For example, the user sees John Doe, while the AI receives {{PERSON-1}}.
This feature does not guarantee detection or masking of every personal identifier. Some identifiers may remain depending on context, formatting, language, scan quality or how the user enters the content. It supports, but does not replace, legal professionals' and users' independent review and oversight.
The feature aims to redact the following types of PII:
- Names (first and last names)
- Usernames
- Email addresses
- Phone numbers
- Street addresses, building numbers, cities, states, countries, and ZIP/postal codes
- Company and organization names
- Dates of birth and age indicators
- Credit card numbers
- National IDs and social insurance/social security style identifiers
- Passport IDs, driver license numbers, and ID card numbers
- Tax numbers and IBAN/account-style financial identifiers
- API/security tokens and password-like secrets
- License plate numbers
- URLs that may include identifying context
Data Protection and Privacy
- We apply the safeguards described in this Privacy Policy to information processed through our Services
- We do not use your data to train our AI systems
- Approved external AI workflow providers, such as Google's Gemini Enterprise Agent Platform, process selected content on Canadian servers for the requested workflow. Temporary processing copies follow the deletion rules in the Client Matter Content subsection of this Privacy Policy; they are not used for AI-model training.
The redaction example illustrates a detected identifier; it does not promise that every identifier is detected or irreversibly anonymized. Approved external providers process only configured workflows; proprietary Company-operated models are separate.
6. Do we track your activity with cookies and similar tools?
We use essential cookies and similar technologies, including local storage, to:
- maintain security and support sign-in;
- keep the service operating reliably;
- support basic website functions;
- remember your preferences, including language, appearance and privacy choices; and
- store workspace data on your device.
Optional public-website measurement is separate from these essential functions. It helps us understand visits to our public website associated with our advertising. Declining it does not prevent access to the service.
Third-party measurement
On eligible public marketing pages, we load the Google tag only after you select Allow in the measurement choices. The tag is used for Google Ads measurement on those public pages.
The measurement receives a public page category and technical information, including IP address and browser information. We exclude account and product pages, query strings, URL fragments, sign-up events, customer identifiers, prompts, documents and generated work. The tag runs in an isolated frame rather than the application window. Advertising and analytics cookie storage, ad-user-data consent and ad personalization remain disabled in that frame. This limits measurement and attribution.
Your choices and rights
Allow and Decline are offered without a preselected opt-in. Use Privacy choices on an eligible public page or on this Privacy Policy page to change your choice. The preference is stored on your device for up to 180 days; blocked storage may limit it to the current tab. Withdrawal stops future optional measurement and does not undo a request already sent.
If your browser sends a Global Privacy Control (GPC) signal, TruLexa blocks optional Google measurement even if you previously selected Allow. A legacy Do Not Track (DNT) signal does not override an explicit choice made through our Privacy choices controls. Neither signal enables measurement without your consent or authorizes disclosure of matter content. Section 12 of this Privacy Policy explains our handling of these signals.
You can also contact privacy@aistrova.com to exercise applicable privacy rights, including any right to opt out of the sale or sharing of personal information. You do not need to email us to decline optional measurement; use the Privacy choices controls.
Google Analytics
We may use Google Analytics to understand visits to our public website. Any such use is subject to the consent choices and data limits in section 6 of this Privacy Policy. You can decline optional Google measurement using Privacy choices. Google also offers a Google Analytics Opt-out Browser Add-on that applies specifically to Google Analytics.
Google's privacy practices
Google processes information under the terms applicable to the measurement service. Optional public-website measurement may be processed outside Canada; this does not authorize transferring confidential matter content to the measurement service. See Google’s Privacy Policy for Google's practices.
7. How do we manage Google and Microsoft sign-in?
You must already be registered with TruLexa to sign in with Google or Microsoft. Before proceeding with either provider, you must confirm that you accept our Terms of Service and acknowledge this Privacy Policy. If you use this option:
- We receive basic account information, such as your name and email address, that you authorize the provider to share with us
- Any additional information you choose to share with us is handled according to this privacy policy
8. For how long do we store your information?
We retain your personal information only as long as:
- It's needed for the purposes described in this Privacy Notice
- Your account remains active and the information is needed to administer it
- It's required by law (such as for tax, accounting, or legal purposes)
When we no longer have a legitimate business need for your data, we will:
- Delete it, or
- Anonymize it, or
- If deletion or anonymization cannot be completed immediately—for example, in backup copies—we restrict access and further use until deletion can be completed, subject to applicable legal requirements.
These retention provisions concern categories such as account, billing, support and security records. The temporary-processing model and deletion limits in the Client Matter Content subsection of this Privacy Policy also apply. Closing your TruLexa account does not delete copies saved on your device, files you have exported or content in accounts you connect to TruLexa.
9. How do we protect your data?
Our security measures are designed to reduce risks to personal information in our custody or control. They include technical and organizational measures, with their scope depending on the relevant service and configuration. These measures do not replace the safeguards required by applicable law or your responsibility for your devices, credentials and authorized use.
These safeguards do not guarantee prevention of every loss, attack or interruption.
10. Do we collect information from minors?
We do not:
- Knowingly collect or request data from anyone under 18
- Market to anyone under 18
- Sell personal information of anyone under 18
TruLexa accounts are intended for people aged 18 or older who meet the applicable professional-account eligibility requirements. Parental or guardian consent does not authorize a minor to bypass those requirements.
If we discover we've collected information from someone under 18, we will:
- Deactivate their account
- Delete their data from our systems
If you find out that we may have data from someone under 18, please email us at privacy@aistrova.com.
The statements about accounts for minors in section 10 of this Privacy Policy do not prohibit lawful matter records about minors submitted by an authorized professional. They do not require deletion solely because such a record concerns a minor. Parental permission does not dispense with legal capacity or professional-account eligibility requirements. Deletion remains subject to lawful preservation and retention requirements.
11. What control do I have over my personal information?
Your rights vary based on where you live (especially in Canada and specific US states). Here's what you should know:
If you live in Canada, depending on applicable law, you have the right to:
- Access and get copies of your personal information
- Request corrections or deletion of your data
- Limit how we process your information
- Request data portability
- Exercise rights concerning automated decisions where provided by applicable law
- Object to how we process your information in certain cases
To exercise any of these rights, contact us at privacy@aistrova.com or through Discord @ our Discord community.
Consent and Marketing:
- You can withdraw your consent for us to process your data at any time
- You can opt out of marketing communications while still receiving important account-related messages
- Withdrawing consent won't affect any processing that already happened
- We may continue processing your data if we have other legal grounds to do so
Managing Your Account:
- You can review and update your account information by logging into your account settings
- You can request account termination
- After account termination, we may keep some information to prevent fraud, handle investigations, enforce our terms, or comply with laws
Cookies:
- Browsers typically accept cookies by default
- You can choose to remove or reject cookies, but this might affect our services
Note: We'll handle all requests according to applicable data protection laws.
The rights available to you depend on the law applicable to your information and its processing. Identity verification, exceptions, extensions and assistance follow that law. Do not submit confidential documents or identity records through public community channels; use the designated privacy email for sensitive request materials. Declining optional measurement does not prevent use of TruLexa.
12. How do we handle Do-Not-Track (DNT) requests?
A legacy Do Not Track (DNT) signal does not override an explicit Allow or Decline choice made through our Privacy choices controls. Optional measurement still requires your consent. Global Privacy Control (GPC) is handled separately: when your browser sends that signal, TruLexa blocks the optional Google measurement described in section 6 of this Privacy Policy, including after a previous Allow choice. Essential sign-in, security and requested workflow processing remain available. You do not need an account or identification to use these controls.
13. What privacy rights do US residents have and how can they exercise them?
Where the relevant state law applies to the Company and the processing concerned and you live in certain US states (CA, CO, CT, DE, FL, IN, IA, KY, MN, MT, NE, NH, NJ, OR, TN, TX, UT, or VA), you have specific privacy rights regarding your personal information.
What We Collect
The categories we process are described in section 1 of this Privacy Policy and can include:
- Basic identifiers (name, email, account name)
- Commercial information (transaction and payment status)
- Device, network and usage information
- Authorized matter content, which may include sensitive information
Data Retention
Account and commercial records follow the purpose-based retention limits in section 8 of this Privacy Policy, including applicable legal preservation requirements. Account closure or withdrawal of consent does not itself require deletion of billing or other records that the law requires us to retain.
Your Core Rights
You can:
- Ask if we're processing your data
- Access your data
- Fix incorrect information
- Request data deletion
- Get a copy of your shared data
- Exercise these rights without discrimination
- Opt out of targeted advertising, data sales, and automated profiling
State-Specific Additional Rights
Depending on your state, you may have extra rights to:
- Review data processing categories
- See lists of third parties who received your data
- Understand and correct how your data is profiled
- Limit use of sensitive data
- Opt out of voice/facial recognition data collection
How to Exercise Your Rights
- Contact: privacy@aistrova.com or through Discord @ our Discord community
- Use Global Privacy Control (GPC) browser settings
- Authorize an agent to act on your behalf (proper documentation required)
Verifying your identity for privacy requests
- We use verification appropriate to the request where permitted or required by applicable law
- Additional information may be required for verification
- Authorized agents may be asked for evidence of authority where permitted by applicable law
Appeals
If we decline your request:
- Email an appeal to privacy@aistrova.com
- We'll respond in writing with our decision
- If denied, you can complaint to your state attorney general
California residents can request annual information about third-party data sharing for marketing purposes at no cost.
The listed rights, appeals, notices and time limits apply only as required by the particular applicable statute. Retention remains subject to section 8 of this Privacy Policy and mandatory preservation requirements. We do not require identity verification for an opt-out where law prohibits it. Exercising a privacy right does not, by itself, authorize us or third parties to use your information for advertising, AI-model training or sale, or to view or independently access it for any purpose unrelated to handling your privacy request. Do not send sensitive request materials through public community channels.
14. Will we update this Privacy Notice?
We will update this Privacy Notice when needed to follow the law. The current version will show the latest revision date at the top. For major changes, we'll let you know through a visible notice on our site or by sending you a direct message. Please check this Privacy Notice regularly to stay informed about how we protect your information.
Where applicable law requires a particular notice method, advance notice or express consent for a new purpose or disclosure, that requirement controls. Public posting or continued use does not replace separately required consent or retrospectively authorize an unlawful use.
15. How can I contact you about privacy?
For any questions or comments about our privacy policies, you can reach us:
- By email: privacy@aistrova.com
- Through Discord messaging
Public community channels are not a place to submit identity records, passwords or confidential client documents. Send privacy requests involving sensitive information to the designated Privacy Officer at privacy@aistrova.com.
16. How can I see, change, or delete my personal information from our systems?
You can ask us to:
- Show you what personal information we have about you
- Explain how we've used your information
- Fix any incorrect information
- Delete your information
- Stop using your information (withdraw consent)
Your specific rights depend on the laws in your country or US state. Some laws may limit these rights.
To make any of these requests, email privacy@aistrova.com.
A privacy or account-deletion request is distinct from subscription cancellation and a refund request. The applicable cancellation and refund provisions govern those separate requests.