Privacy Policy
Last updated October 16, 2026
This policy explains how SBT Capital LLC ("we") handles personal information in LexFlow. Law firms use LexFlow to manage their practice. The information a firm enters about its clients and matters belongs to the firm: we process it on the firm's behalf and only as described here and in our Terms of Service.
What we collect
- Account information: the names, email addresses, roles and job titles of your firm's users, their password hashes (never the passwords themselves) and, if they turn on two-step verification, an encrypted authenticator key.
- Your firm's content: contacts, matters, calendar entries, tasks, time and expenses, bills, bank and trust ledger entries, documents information and communications that your users enter.
- Security and operations data: sign-in attempts with IP addresses (to stop password guessing), an audit log of important changes, whether emails we send were delivered, bounced or marked as spam, and error reports (with page addresses but not their query strings).
How we use it
- to provide LexFlow: sign-in, storing and showing your records, and sending the emails your users ask for (invitations, password links, bills);
- to keep it secure and reliable: preventing abuse, investigating problems, and backing up data;
- to support you when you ask for help;
- to meet legal obligations.
We do not sell personal information, use it for advertising, or train artificial intelligence models on your firm's content.
Who we share it with
We share information only with the service providers that run LexFlow, and only as they need it:
- Amazon Web Services: database hosting, encrypted backups and email delivery (United States, Oregon region);
- Vercel: hosting of the application itself (United States).
We may also disclose information when the law requires it. Where we lawfully can, we will tell the affected firm first so it can object, for example to protect privileged material.
How we protect it
- Encryption in transit (TLS, including between our servers and the database, with the database certificate verified) and at rest.
- Sign-in protections: password rules, rate limiting, optional or firm-required two-step verification, and session timeouts.
- Each firm's data is kept separate from every other firm's; money records and the audit log cannot be altered after the fact.
- Continuous backups with 14-day point-in-time recovery, and monitoring with alerts.
How long we keep it
We keep your firm's data while it uses LexFlow. After an account is closed, the firm can export its data for 30 days, then we delete it from the live service within 90 days, after which it ages out of backups. Sign-in attempt records are kept for about a day, and error reports for 90 days. Your firm decides how long to keep its own records and may need to keep some (such as trust account records) for years under professional rules.
Your choices and rights
Users can see and update their profile in Settings. Because a firm controls its own data, requests about information a firm holds about you (for example, as its client) should usually go to that firm, and we will help the firm respond. You can also write to us at serhiy.tkach@sbtcap.com to ask about, correct or delete personal information we hold, and we will respond as the law requires. A data processing agreement is available to firms on request.
Children
LexFlow is a professional service and is not intended for children.
Changes
We will update this page when our practices change and notify firms by email or in the app of material changes.
Contact
SBT Capital LLC · serhiy.tkach@sbtcap.com