.webp){kind=icon}
Contact us
US privacy rights
The Lexer Privacy Policy
This Privacy Policy is our privacy policy for the purposes of the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It also provides the information we are required to give you under the EU and UK General Data Protection Regulation (GDPR) and applicable United States state privacy laws. Sections that apply only in particular places are labelled.
.svg){kind=icon}
When this Policy applies to you
Our responsibilities
For personal information held and managed on behalf of our clients using our services (Client Data), we act as a “data processor” under the GDPR and as a “service provider” or “processor” under US state privacy laws. In most cases we did not collect your personal information from you directly; it was collected by our client in accordance with its own privacy policy and collection notices. We process Client Data only on our client’s documented instructions and in accordance with our agreement with that client.
Australian privacy law does not distinguish between controllers and processors. Where we hold Client Data, we also comply with the APPs in relation to that information.
Our clients are usually best placed to answer questions and requests about Client Data, because they collected it and decide how it is used. You can contact the relevant client directly, or contact us (see “Your privacy choices and rights” below).
Your responsibilities
- Read this Privacy Policy
- If you are our client, please also check the written terms of agreement between us: they may contain further details on how we collect and process your data
- If you provide us with personal information about other people, or if others give us your information, we will only use that information for the specific reason for which it was provided to us. By submitting the information to us, you confirm that you have the right to authorise us to process it on your behalf in accordance with this Privacy Policy
- You should not use our services if you are under 18 years old
You may also be subject to third party privacy terms
Our Privacy Policy applies to our websites, products and services only. Our services often provide integrations with other third party platforms, such as Facebook, Instagram and other social media platforms, as well as other third party products and services (Third Parties). This means that other privacy terms may also apply to you.
We do not take any responsibility for informing you of, or policing your compliance with any Third Party terms.
When and how we collect data
Here’s when and how we do this:
Types of data we collect
Contact details
More information
Account information
More information
Content from your use of the services or website
More information
Logs, usage, and support data
More information
Client Data in the Lexer platform
More information
Lexi and other AI features
More information
Surveys, events, and marketing information
More information
Applying for employment
More information
Browsing our websites or making an online purchase
More information
Cookies
More information
What we don’t collect
How and why we use your data
Keeping Lexer running
Improving Lexer
Customer Support
.webp){kind=icon}
Marketing Purposes (with your consent)
Providing Lexi and other AI features
Recruitment
Read more
Where we send your information
When we send your information across borders, we take steps to protect your information, and we take reasonable steps to ensure that we send your information to countries that have strong data protection laws.
Our hosting and data integration providers (including Fivetran) are configured to process Client Data in Australia or the United States, consistent with the hosting region in our agreement with the relevant client. Unless a client’s agreement requires processing in a specific region, some features (including some AI features) may process that client’s data in either Australia or the United States.
Transfers outside of Europe, UK and Switzerland
If you are in Europe, the UK, or Switzerland, your personal information is transferred to our processing regions, being Australia or the United States (as requested by our client by contract). Australia has not been found to provide an adequate level of data protection by the European Commission or the UK Government. Where we receive personal information from the EU, the UK or Switzerland on behalf of our clients, that transfer is governed by our Data Processing Addendum. The Addendum incorporates the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss amendments where applicable. Where we transfer that information onwards, including to our service providers in the United States, we put equivalent safeguards in place: Standard Contractual Clauses or, where the recipient is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions. You can request a copy of the relevant safeguards by emailing privacy@lexer.io.
Finally, while we do what we can to protect your information, we may at times be legally required to disclose your personal information (for example, if we receive a valid court order).
Your privacy choices and rights
Requests about Client Data
If your request relates to personal information we hold on behalf of one of our clients, the client is usually best placed to respond, because it collected the information and controls how it is used. You can make your request to the client directly or to us. If you are in the EU, the UK or the United States and you contact us, we will forward your request to the relevant client, or help it to respond. If you are in Australia, you can also make an access or correction request to us under the APPs, and we will respond to it in accordance with the Privacy Act. We may notify or consult the relevant client about your request, but we will not make our response depend on the client’s consent.
How to make a request
Email privacy@lexer.io. We will acknowledge your request within 5 business days.
Verifying your identity
We need to verify your identity before we act on a request, so that we do not disclose or change information about you at someone else’s request. What we ask for will be proportionate to the nature of the request and the information involved.
You can choose not to provide us with personal data
Read more
You can turn off cookies in your browser by changing its settings
Read more
You can ask us not to use your data for marketing
Read more
You have the right to access information we hold about you
Read more
You have the right to correct any inaccurate personal data about you
Read more
Automated decision-making and profiling
Read more
You have the right to be ‘forgotten’ by us
Read more
You can ask us to restrict or stop processing your data
Read more
You have the right to lodge a complaint regarding our use of your data
Read more
How secure is the data we collect?
We take reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Client Data is logically segregated by client, and access is restricted on a least-privilege basis.
You can see more information about our security measures and policies here.
Where do we store the data?
The personal data we collect is processed in Australia and the United States and in data processing facilities operated by our service providers (see “Third parties who process your data” below).
If we transfer or store your information outside of Australia or the United States, we will take steps to ensure that your privacy rights continue to be protected as outlined in this Privacy Policy.
How long do we store your data?
For personal data processed by Lexer on behalf of our clients, we will delete your personal data within 30 days of our client terminating its services with us, or as agreed with our client by contract.
For personal data which we collect directly from you (via our websites, chat functions or potential job applicants), we will delete this personal data on request by you, or otherwise hold it only for so long as is required for our legitimate interest, or for the period necessary to comply with our legal obligations to store specific types of records or information.
In particular: we keep job applicant information for 12 months after the recruitment process ends, or longer with your consent so that we can consider you for future roles; we keep records of privacy requests and complaints, including how we verified your identity, for 2 years; we do not keep copies of identity documents we sight to verify your identity; and we keep Lexi prompts, outputs and logs for 30 days unless the client’s agreement provides otherwise. Our data integration providers hold Client Data only while transferring it into our platform, apart from limited troubleshooting and configuration data that they keep for short periods.
Third parties who process your data
We often use third parties to help host our services, communicate with clients, power our emails etc. We partner with third parties who are some of the best in their field at what they do.
When we do this, sometimes it is necessary for us to share your data with them in order to get these services to work well. Your data is shared only when strictly necessary and according to the safeguards and good practices detailed in this Privacy Policy.
The main categories of service providers we use are: cloud hosting and infrastructure; data integration (for example, Fivetran, which transfers data from our clients’ systems into the Lexer platform); infrastructure that powers Lexi and our other AI features; customer support and communications; marketing and advertising; recruitment; and payments and finance. A current list of the sub-processors that process Client Data is available at https://www.lexer.io/data-processing-addendum. We require our service providers to protect personal information and to use it only to provide services to us.
We do not sell personal information for money. We may also disclose personal information to our professional advisers, to a buyer or potential buyer of our business, or where we are required or authorised by law to do so.
Contact us
Privacy Officer, Lexer Pty Ltd, 285 St Kilda Road, St Kilda, Victoria 3182. Email: privacy@lexer.io.
Changing this Privacy Policy
We try not to change our privacy policy too often, but sometimes we need to, for example, if the law changes or if we change the way we collect or use your information. When we change our privacy policy, we will put the updated version on our website straight away. We will also put a notice on our website when we make significant updates, so you will know this has happened.
This privacy policy was last reviewed on 23 October 2026 with material change.
US privacy rights
This section applies to residents of the United States and supplements the rest of this Privacy Policy. Several US states have privacy laws that give residents rights over their personal information. Rather than offering different rights depending on where you live, we offer the rights below to all US residents, subject to verifying your identity and to the exceptions allowed by law.
Client Data. Where we process personal information on behalf of our clients, we act as their service provider or processor. If you make a request about Client Data, we will forward it to, or help, the relevant client, which is responsible for responding.
Personal information we collect, use and disclose
In the last 12 months we have collected the following categories of personal information for our own purposes. For each category, we explain where it comes from, why we use it and who we disclose it to:
- Identifiers (such as name, email address, postal address, phone number, IP address, cookie IDs and device IDs). Sources: you, your devices, and our marketing and business information providers. Purposes: providing our services, customer support, security, marketing and recruitment. Disclosed to: our service providers and advertising partners.
- Commercial information (such as services purchased and billing records). Sources: you. Purposes: providing our services and billing. Disclosed to: our service providers, such as payment processors.
- Internet or other electronic network activity (such as your browsing of our website, your interactions with our emails and advertising, and session-recording data). Sources: your devices and our analytics and advertising partners. Purposes: analytics, security and marketing. Disclosed to: our service providers and advertising partners.
- Professional or employment-related information (such as your employer, job title, work history and qualifications). Sources: you, your employer, professional networking sites, business information providers and referees. Purposes: sales, marketing and recruitment. Disclosed to: our service providers.
- Education information (job applicants only). Sources: you. Purpose: recruitment.
- Audio, electronic or visual information (such as call and video recordings and chat transcripts). Sources: you. Purposes: customer support and quality assurance. Disclosed to: our service providers.
- Inferences (such as your likely interest in our services, or an assessment of your job application). Sources: derived from the information above. Purposes: marketing and recruitment.
- Sensitive personal information. We collect sensitive personal information only from job applicants (such as right-to-work and, where a role requires it, background check information). We do not use or disclose it for any purpose other than those permitted under California law, so we do not offer a right to limit its use.
We keep each category of personal information for the periods described in “How long do we store your data?”.
Sale, sharing and targeted advertising
You can opt out by clicking “Your Privacy Choices” in our website footer, or by turning on Global Privacy Control (GPC) in your browser. We treat a GPC signal as a request to opt out for that browser and, where we can identify you, for your account. Some browsers send “Do Not Track” signals. Because there is no common standard for these signals, we do not respond to them, but we honour GPC signals as described above.
Automated decision-making technology
Your US privacy rights
- The right to know and access the personal information we have collected about you, including the categories of sources, the purposes and the categories of recipients, and to receive a copy in a portable format.
- The right to delete personal information we have collected from you.
- The right to correct inaccurate personal information.
- The right to opt out of the sale or sharing of your personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects.
- The right to obtain a list of the specific third parties to which we have disclosed your personal information, where your state’s law provides this right.
- The right not to be discriminated against for exercising any of these rights. We do not offer financial incentives in exchange for personal information.
To exercise these rights, email privacy@lexer.io. We will confirm receipt within 10 business days and respond within 45 days. We may extend this by a further 45 days where reasonably necessary, and we will tell you if we do. We do not charge for these requests unless they are manifestly unfounded, excessive or repetitive. You can use an authorised agent as described under “Verifying your identity”.
Appeals. If we decline your request, you can appeal by replying to our decision or emailing privacy@lexer.io with “Appeal” in the subject line within 45 days. We will respond to your appeal in writing within the period your state’s law requires. If you are not satisfied with our response, you can contact your state Attorney General.
Nevada residents. We do not sell covered information as defined under Nevada law. You can ask us not to sell your covered information in the future by emailing privacy@lexer.io.
California job applicants. Our notice at collection for California job applicants is available on our careers site.
California residents: “Shine the Light” law
California Civil Code Section 1798.83, also known as “Shine The Light” law, permits California residents to annually request information regarding the disclosure of your Personal Information (if any) to third parties for the third parties’ direct marketing purposes in the preceding calendar year. To make such a request of Lexer, please send an email to privacy@lexer.io (you must be able to verify your identity).
Please note that any requests in respect of Personal Information held on behalf of Lexer’s clients should be directed to Lexer’s client in the first instance.