Privacy Policy

The data controller is MEDIA SMART, publisher of the CyberLex platform and the Lexy AI module.

Address: UV 07 / UV 20, Nouvelle Ville Ali Mendjeli, Constantine, Algeria.

Contact: contact@cybrlex.com.

The processing of your personal data is governed by:

Law 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended by Law 25-11 of 24 July 2025;

the normative acts of the National Authority for the Protection of Personal Data (ANPDP).

The processing has been the subject of a prior declaration to the ANPDP, in accordance with Article 12 of Law 18-07.

We distinguish data you give us voluntarily from data collected automatically.

• Data you provide when creating an account: email address, full name, professional capacity (lawyer, notary, judge, in-house counsel, academic, law student, other), organisation (optional), wilaya (self-declared, optional), interface language. The password is never kept in clear — only its argon2 hash is stored.
• Data you provide afterwards: phone number and billing address, questions put to Lexy AI and the conversations they belong to, files placed in your workspace, payment receipts.
• Proof of acceptance: the date and time you accepted the Terms of Service and this policy, together with the version of the documents accepted.
• Data collected automatically: IP address (hashed, never stored in clear), browser, operating system, device type, pages viewed, time on page, referrer, UTM parameters, browser language, timezone.

Each processing purpose is mapped to a legal basis (performance of the contract, legal obligation, consent or legitimate interest):

Creating and managing your account, verifying your email address, providing the Service and applying your plan's allowances: performance of the contract formed by accepting the Terms of Service.

Invoicing, reviewing payment receipts and keeping invoices: legal obligation and performance of the contract.

Keeping proof that you accepted the Terms and this policy: legal obligation (proof of compliance).

Product improvement and news/offers: explicit, optional and revocable consent (separate checkbox).

Anonymous and pseudonymous audience measurement: legitimate interest in understanding platform usage, subject to your choice via the consent banner.

Email open and click tracking: explicit marketing consent, separate from policy acceptance. Recipients who declined this consent have their engagement signals discarded — their opens and clicks are never stored.

Responding to rights-exercise requests: legitimate interest and legal obligation.

CyberLex places analytics and session cookies only after your consent via the consent banner. Strictly necessary cookies (remembering your choice, your sign-in session) are placed without consent, in accordance with Article 30 of Law 18-07.

The full list of cookies, their purpose, lifetime and type is set out in our dedicated Cookie Policy.

Our emails are sent through Resend, which emits signed webhook events (delivered, opened, clicked, bounced) to our server. When you have explicitly granted marketing consent, we record open and click signals linked to your user identifier, retained in accordance with the retention table in section 9.

For recipients who did not grant marketing consent, we still receive operational events (delivered, bounced) but we DO NOT store open or click signals — their engagement is never measured. You can withdraw this tracking at any time: by unticking the marketing consent box in the form, via the unsubscribe link in every email, or by writing to contact@cybrlex.com.

Note: Apple Mail Privacy Protection and Gmail's image proxy pre-fetch images, which may artificially inflate open rates. Our statistics are therefore directional, not exact. Clicks are the reliable engagement signal.

Your data is accessible to:

MEDIA SMART, as data controller;

Resend, a transactional email provider based in the United States (see section 8);

our hosting provider (Algeria/European Union) for database storage and operation.

No data is sold or transferred to any third party for commercial purposes.

Sending confirmation emails via Resend involves transferring the recipient's email address to the United States. This transfer is covered by the appropriate safeguards under Article 36 of Law 18-07 and by the processing contract concluded with Resend, acting as a processor.

Other personal data is hosted within our infrastructure (Algeria/European Union) and is not transferred outside that zone.

Your data is retained for the following periods, calculated from collection:

• Page views and analytics events: 14 months, then deleted.
• Sessions: 14 months, then aggregated to daily counts and deleted.
• Visitors not linked to a signup: 14 months.
• Account and profile (full name, professional capacity, organisation, wilaya): for as long as the account exists, then 12 months after it is closed, or until erasure is requested.
• Lexy conversations and workspace content: for as long as the account exists; deleted with it.
• Invoices, payment receipts and proof of acceptance of the Terms: 10 years, under accounting and evidential obligations.
• Waitlist users (EarlyUser): 24 months from platform launch, or until erasure is requested.
• Consent records and admin audit log: 5 years (proof of compliance).

We apply the following technical and organisational measures:

TLS encryption of all communications;

password hashing with argon2;

IP address hashing (SHA-256 + server-side pepper) — the raw IP is never persisted;

administration access protected by password, mandatory TOTP 2FA, and restricted to authorised accounts;

least-privilege principle, logging of administrative actions.

In accordance with Article 38 of Law 18-07, you have the following rights over your personal data:

right of access;

right to rectification;

right to erasure;

right to object;

right to withdraw consent;

right to data portability.

To exercise these rights, write to contact@cybrlex.com specifying the email address concerned. We respond within a maximum of 30 days. You may also lodge a complaint with the ANPDP.

CyberLex is a service for legal professionals and is not directed at persons under 18. We do not knowingly collect data relating to minors.

This policy may be changed. Each version is identified by a policyVersion string (shown at the top of the page). In the event of a material change, fresh consent will be requested. The last-updated date is shown at the top of this page.

For any question relating to this policy or the processing of your data: contact@cybrlex.com.

CyberLex and Lexy AI provide legal information, not legal advice. The content does not constitute legal advice and is not a substitute for consulting a legal professional.