Privacy Policy

Last updated: September 27, 2026

Who we are

Mansour Enterprise operates LexFlo, an AI receptionist and intake service for law firms, delivered on the GoHighLevel platform, together with an app for AI intake qualification, document review with email notification and Clio sync. This policy describes information handled for our account holders and for people who contact a law firm through LexFlo. Questions and requests go to support@lexflo.ai.

A law firm decides how to use information submitted to it and which LexFlo features to enable. We process that workspace information to provide the service to the firm. We also handle account, billing, support and security information to operate LexFlo. A firm's own privacy notice and professional obligations may apply to its handling of an inquiry.

Information we handle

Account and firm details: name, email, membership role, practice area, branding, notification preferences and other settings.
Inquiry and workspace content: contact details, matter descriptions, form answers, correspondence, activity history, uploaded documents and AI-generated summaries. Existing customers may also hold content from additional features included in their agreements.
AI receptionist call information: caller details, call times and duration, recordings, transcripts and call summaries when the AI receptionist is enabled.
Documents for review: files a firm uploads for AI document review and the resulting review output.
Connected-service details: credentials, tokens, account identifiers and connection outcomes needed for integrations the firm configures.
Billing records: Stripe customer and subscription identifiers, subscription status, billing periods and recorded offer terms. Stripe collects payment details; LexFlo's checkout does not store full payment-card numbers or security codes.
Technical and support information: IP addresses, browser information, authentication and session information, service logs, error reports and messages sent to support.

Session cookies help maintain sign-in and secure account access. Connected services may use their own cookies or similar technologies under their own notices. Do not include passwords, payment-card details or unnecessary sensitive information in a support email.

How information is used and shared

We use information to operate the workspace, process intake, generate requested summaries, run configured notifications and follow-up, manage subscriptions, provide support, investigate abuse and maintain the service. AI-generated content may be inaccurate and requires attorney review.

Information is shared with service providers as needed for these functions, with the firm's authorized users and configured recipients, and with services the firm chooses to connect. Relevant connections include:

Hostinger for application hosting; Supabase for database, authentication and file storage.
Stripe for payments and billing; Resend for transactional email.
Anthropic for AI processing of selected inquiry or workspace content.
GoHighLevel (HighLevel, Inc.) for CRM, calendar, SMS and email messaging, phone and Voice AI call handling, and call recordings and transcripts.
Clio, when the firm connects it, for practice-management sync.

AI receptionist calls and recording

Every AI receptionist call opens with a disclosure that the call is recorded and transcribed and that the caller is speaking with an AI. We apply two-party (all-party) consent treatment to every call, wherever the caller or firm is located, rather than only in specific states. A caller who does not wish to be recorded can end the call and contact the firm another way.

A feature's actual providers depend on its configuration. Provider handling, retention and processing locations depend on the service and applicable agreement; this policy does not promise a single storage country, zero provider retention or a vendor-wide model-training rule. We can explain the connections relevant to a particular firm on request. Information may also be disclosed when required by law or needed to address fraud, security incidents or legal claims.

Provider notices include Supabase, Stripe, Resend and Anthropic and HighLevel. A provider's public notice does not replace the agreement governing a particular business integration.

Security

Application access checks and database policies restrict access by firm. Administrative credentials and integration secrets are handled separately from ordinary browser settings. We restrict operational access and use protected recovery copies. No online service or security measure can eliminate every risk; contact support if you suspect unauthorized access.

Retention, cancellation and recovery copies

We retain workspace information to provide the service to the firm. Canceling a subscription stops renewal; it is not a request to delete the workspace or confirmation that information has been erased. Retention also depends on the firm's instructions, existing agreements and justified billing, security, dispute or legal obligations.

When processing a deletion request, we identify any information that needs to remain, explain why and describe its retention status. Deleting an item in the application does not necessarily delete recovery copies or information already sent to another provider or the firm's own systems. Recovery copies remain restricted to recovery and related operational needs. We review their status as part of a request and do not promise that every copy is immediately erased or purged on a fixed universal date.

Access, correction, export and deletion requests

The firm owner can contact support@lexflo.ai to request access, correction, an export or deletion. Include the firm name and the scope of the request. We verify identity and authority before releasing or deleting firm information, review the affected records and connected services, and confirm the completed work and any retained exceptions. These are manually handled requests; a dashboard delete action is not a complete account-erasure procedure.

If you submitted information to a law firm through LexFlo, contact that firm about your inquiry information. We assist the firm with requests concerning information we process for it. You may also contact us about information we handle directly, such as a support message. This process does not limit rights or response deadlines that apply under law.

Policy updates

We identify revisions with the date above and communicate material changes through an appropriate service notice or account contact. This notice does not override an existing customer agreement or rights required by applicable law.