1. Data we process
Depending on how you use Lexsentra, we may process account details such as name, work email, organization/workspace membership and role; billing identifiers and subscription state; URLs and domains you ask us to monitor; scan results, screenshots and redacted technical evidence; alert destinations; and basic security/operational logs.
Network evidence is intentionally minimized. The scanner is designed not to retain request or response bodies or headers in the network manifest, and stored request URLs are stripped of query strings and fragments.
To understand whether the product is delivering value, Lexsentra also keeps aggregated first-party counts of key product milestones such as completed scans, account creation, verification, property or monitor creation and checkout intent creation. These funnel counters are aggregated by day, plan tier and jurisdiction and are not designed to store a visitor ID, user ID or IP address.
2. Why we process it
- to provide scans, monitoring, evidence reports and alerts;
- to authenticate users and protect accounts;
- to administer subscriptions, quotas and billing;
- to detect abuse, troubleshoot incidents and improve service reliability;
- to meet legal, security and accounting obligations where applicable.
3. Customer-controlled scans
You should only submit websites, test environments and digital properties that you are authorized to assess. Lexsentra is designed for bounded QA of public or authorized surfaces. You are responsible for ensuring that your use of the service is lawful and appropriately authorized.
4. Payments
Payments are processed through Paddle. Paddle may process payment, tax, invoice and buyer information under its own privacy terms. Lexsentra receives the billing identifiers and subscription events needed to provision the service, but does not need to store full card details.
5. Retention
Evidence retention depends on product tier and operational/legal requirements. Lexsentra includes automated retention controls for stored evidence. Some billing, security or audit records may need to be retained longer where required for fraud prevention, accounting, disputes or legal compliance.
6. Service providers
Lexsentra may use infrastructure, payment, email-delivery, security and monitoring providers to operate the service. We aim to limit each provider to the data required for its function and will expand the public subprocessor information as the service matures.
7. International processing
Service providers may process data in multiple jurisdictions. Where data-protection law requires safeguards for international transfers, we intend to use appropriate contractual or statutory mechanisms.
8. Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or obtain a copy of personal data, and to object to certain processing. Mandatory rights are not limited by this notice.
9. Security
Current technical controls include TLS, least-privilege runtime roles, tenant-scoped authorization, bounded scanning, SSRF protections, hashed session tokens, evidence redaction and retention enforcement. See the Security & Trust page for current, evidence-based claims.
10. Contact
For support, privacy or data-protection questions, contact support@lexsentra.com. Billing records and receipts are also available through Paddle where applicable.
11. Changes
We may update this notice as the service, subprocessors and legal requirements evolve. The date above identifies the current version.