GDPR Privacy Policy

Lexaris — PII Anonymization Platform
Document Reference: Anon-Legal-INT-24
Replaces: N/A (Initial Issue)

This document is dynamically generated based on settings configured by the Operator in the Platform Admin Panel. Values shown in italics represent current settings and may be modified by the Operator within legally permitted limits.

---

1. Introduction and Controller Identity

This Privacy Policy ("Policy") is issued pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("General Data Protection Regulation" or "GDPR"), and applicable national implementing legislation.

Lexaris is a PII anonymization platform. It is designed to help users achieve GDPR compliance by detecting and anonymizing personal data in their documents. This creates a dual compliance obligation: Lexaris helps users comply with data protection law, while itself complying with GDPR with respect to its own users' personal data.

Data Controller:

The Controller determines the purposes and means of processing personal data collected through the Lexaris platform ("Platform") and is responsible for ensuring that processing activities comply with applicable data protection law.

---

2. Data Protection Officer

Lexaris (IE Kudryavtsev S.A.) has appointed a Data Protection Officer ("DPO") in accordance with Article 37 GDPR.

Contact Details:

• Email: privacy@lexaris.ru
• Postal: Data Protection Officer, Saint-Petersburg, Russia

Data subjects may contact the DPO directly regarding any matter relating to the processing of their personal data or the exercise of their rights under applicable data protection law. The DPO operates independently and is bound by professional secrecy obligations.

---

3. Scope of This Policy

This Policy applies to:

(a) All natural persons who register for or use the Platform as individual users ("End Users");

(b) Employees, contractors, and authorised representatives of organisations that subscribe to the Platform as legal entities ("Subscriber Personnel");

(c) Natural persons whose personal data is contained within documents uploaded to the Platform for anonymization ("Data Subjects of Uploaded Content");

(d) Visitors to the Controller's websites at lexaris.ru.

Important distinction regarding uploaded content: When End Users upload documents containing third-party personal data for anonymization, the Platform processes that data solely for the purpose of detecting and anonymizing PII. The Platform does not retain uploaded content or the personal data contained therein beyond the user-configured session retention period. End Users are responsible as independent data controllers for the documents they upload and must ensure they have a lawful basis for processing the personal data contained in those documents.

---

4. Categories of Personal Data Processed

4.1 Account and Identity Data

• Full name, email address, telephone number (where provided)
• Username and encrypted password credentials (passwords stored using bcrypt with minimum cost factor 12; plaintext passwords are never retained)
• Preferred language, interface preferences
• Two-factor authentication method and associated metadata (not the authentication secret itself)

4.2 Subscription and Billing Data

Fiat Payments (Paddle — Merchant of Record):
- Paddle acts as the Merchant of Record for fiat payments. The Controller does not collect or store payment card data. Paddle processes billing data in its capacity as an EU-based Merchant of Record, which simplifies GDPR compliance for payment processing as payment data remains within the EU under Paddle's control.
- Data received from Paddle: subscription tier, billing cycle, transaction identifiers, country of residence (for tax purposes), invoice records.

Cryptocurrency Payments (NOWPayments):
- Cryptocurrency payments involve minimal personal data. The Controller receives: wallet address (pseudonymous), transaction hash, payment amount, and cryptocurrency type.
- No name, email, or identity verification data is collected through the cryptocurrency payment channel beyond what is already held as Account Data.

4.3 Uploaded Document Data (Transient Processing)

• Documents uploaded by End Users for anonymization (text, DOCX, XLSX, PDF, images)
• Personal data contained within uploaded documents, including but not limited to: names, addresses, identification numbers, dates of birth, telephone numbers, email addresses, financial account numbers, and any other PII present in the source material
• Special category data that may incidentally appear in uploaded documents (health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning sexual orientation)

Transient nature: Uploaded documents and their contents are processed in-session and retained only for the duration of the user-configured retention period (default: session-based). They are not stored for long-term analytics, model training, or any purpose beyond providing the anonymization service.

4.4 Anonymization Processing Data

• NER (Named Entity Recognition) pipeline outputs: detected entity types, positions, confidence scores
• Token mappings: the correspondence table between original PII and anonymization tokens (e.g., [PERSON_1], [ADDRESS_1])
• Anonymized output documents generated by the Platform
• Detection pipeline configuration selected by the End User (entity types enabled/disabled, sensitivity thresholds)

4.5 AI Interaction Data (Where Ollama Processing Is Enabled)

• Text segments submitted to the optional Ollama LLM module for enhanced NER
• LLM response metadata (model identifier, processing timestamp)
• Ollama processing is performed entirely on the Controller's own infrastructure; no data is transmitted to external AI providers

4.6 Usage and Technical Data

• IP address, device type, operating system, browser type and version
• Session identifiers, authentication tokens (stored client-side; server retains only cryptographic hashes)
• Pages visited, features accessed, anonymization jobs initiated and completed
• API request logs (endpoint, HTTP method, response code, latency) — retained for 90 days
• Error logs and crash reports

4.7 Telegram Bot Interaction Data

• Telegram user ID, username, and chat ID (for users interacting via @anondocbot)
• Documents and text submitted through the Telegram bot for anonymization
• Bot command history and interaction metadata

4.8 Cookies and Similar Technologies

The Controller uses cookies and similar technologies as follows:

---

5. Purposes of Processing and Legal Bases

The Controller processes personal data on the following legal bases pursuant to Article 6 GDPR:

5.1 Performance of a Contract — Article 6(1)(b)

Processing necessary to provide the Platform services to which the End User or Subscriber is party, including:

• Creating and maintaining user accounts
• Performing PII detection and anonymization on uploaded documents
• Generating token mappings and anonymized output documents
• Processing subscription payments (via Paddle for fiat, NOWPayments for cryptocurrency)
• Providing technical support
• Delivering anonymization results via the web interface or Telegram bot

5.2 Compliance with Legal Obligations — Article 6(1)(c)

Processing necessary to comply with legal obligations to which the Controller is subject, including:

• Retention of financial records and invoices as required by applicable tax and commercial law
• Responding to lawful requests from competent public authorities
• Maintaining security and access logs as required by applicable information security regulations

5.3 Legitimate Interests — Article 6(1)(f)

Processing necessary for the Controller's legitimate interests, where such interests are not overridden by the interests or fundamental rights of data subjects, including:

End Users may object to processing based on legitimate interests pursuant to Article 21 GDPR. See Section 10.6.

5.4 Consent — Article 6(1)(a)

Where the Controller processes data on the basis of consent, including:

• Non-essential cookies and similar technologies
• Optional Ollama AI-enhanced NER processing (where the user explicitly enables this feature)
• Participation in beta programmes, research studies, or satisfaction surveys

Consent is obtained through clear, affirmative action and may be withdrawn at any time without detriment to the provision of core Platform services. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

5.5 Special Categories of Personal Data — Article 9

The Controller does not intentionally collect special category data as a direct purpose of the Platform. However, End Users may upload documents that incidentally contain such data (e.g., medical records submitted for anonymization, documents referencing health conditions, political affiliations, or religious beliefs). Where this occurs:

• The Platform's sole purpose in processing such data is to detect and anonymize it — the processing is protective in nature
• Processing is on the basis of Article 9(2)(g) GDPR (substantial public interest — data protection compliance) or Article 9(2)(a) (explicit consent of the End User who uploads the content)
• End Users, as data controllers for the documents they upload, must satisfy themselves that they have a valid basis under Article 9 for uploading content containing special category data
• The Controller implements enhanced technical safeguards: special category data within uploaded documents is subject to the same session-based retention and secure deletion as all uploaded content
• The anonymization pipeline is specifically designed to detect and redact special category data identifiers

---

6. Recipients and Disclosure of Personal Data

6.1 Internal Access

Access to personal data within the Controller's organisation is restricted on a strictly need-to-know basis, governed by role-based access controls.

6.2 Data Processors

The Controller engages the following categories of sub-processors, each bound by data processing agreements meeting the requirements of Article 28 GDPR:

A current list of sub-processors is maintained and available upon written request to privacy@lexaris.ru.

6.3 Ollama AI Processing (On-Premise, Optional)

Where End Users enable Ollama-enhanced NER, document text is processed by a locally deployed open-source language model (qwen3:8b) running on the Controller's own infrastructure. No data is transmitted to external AI providers. The Ollama model is used solely for enhanced entity detection accuracy and does not retain or learn from user data.

6.4 No External AI Data Transmission by the Platform

The Platform does not transmit uploaded document content, token mappings, or any user data to commercial AI APIs (OpenAI, Anthropic, Google, or others). All NER processing occurs locally using spaCy, regex, and optionally Ollama. End Users may independently choose to use anonymized output documents with external AI services, but this is the End User's own decision and is outside the scope of the Platform's processing activities.

6.5 Legal and Regulatory Disclosure

The Controller may disclose personal data to competent courts, law enforcement agencies, regulators, or other public authorities where required by applicable law or pursuant to a lawful court order. Where legally permitted, the Controller will notify affected data subjects of such disclosure.

6.6 No Sale of Personal Data

The Controller does not sell, rent, or otherwise commercially exploit personal data to third parties for their own purposes.

---

7. International Data Transfers

7.1 General Architecture

The Platform's primary infrastructure is hosted within the Russian Federation. Personal data processed by the Platform (account data, uploaded documents, anonymization outputs) is stored and processed on servers located in the Russian Federation.

7.2 EU Users — Transfer Considerations

When EU-based users upload documents containing personal data to the Platform, this constitutes a transfer of personal data from the EEA to the Russian Federation. The Russian Federation does not hold a European Commission adequacy decision under Article 45 GDPR.

The Controller relies on the following transfer mechanisms:

(a) Standard Contractual Clauses (Article 46(2)(c) GDPR): The Controller offers Standard Contractual Clauses (Module Two — Controller to Processor) for EU-based Subscribers.

(b) Supplementary Measures:
- Encryption: All data in transit is protected by TLS 1.3. Uploaded documents are encrypted at rest using AES-256.
- Session-based retention: Uploaded documents and token mappings are automatically destroyed at the end of the user-configured retention period, minimizing the exposure window.
- Purpose limitation: Uploaded content is processed exclusively for anonymization and is not used for any secondary purpose.
- Access controls: Strict role-based access; no third-party access to uploaded content.

(c) Risk Assessment: The nature of the Platform's processing significantly mitigates transfer risk: uploaded documents are processed for the specific purpose of removing personal data from them, and the processing results (anonymized documents) contain reduced or no personal data. The retention period for source documents is session-based, creating a very limited exposure window.

7.3 Payment Data Transfers

Paddle (Fiat): As an EU-based Merchant of Record, Paddle processes payment data within the EU. No payment card data is transferred to the Russian Federation.

NOWPayments (Cryptocurrency): Cryptocurrency transactions involve pseudonymous data (wallet addresses, transaction hashes). The minimal personal data involved in cryptocurrency payments significantly reduces transfer risk.

7.4 Further Information

A full description of international transfer mechanisms is set out in the International Data Transfer Mechanism document (Document 26). Data subjects may request copies of applicable transfer documentation by contacting privacy@lexaris.ru.

---

8. The Anonymization Pipeline — How Lexaris Processes Data

8.1 Detection Pipeline Architecture

The Platform's core function is PII detection and anonymization. The detection pipeline operates as follows:

Layer 1 — Regex Detection (Deterministic, Local)
Pattern-based detection of structured PII: Russian passport numbers (with checksum validation), SNILS, INN, phone numbers, email addresses, dates, bank account numbers, and other structured identifiers. This layer is fully deterministic and operates locally.

Layer 2 — spaCy NER (Statistical, Local)
Named Entity Recognition using trained spaCy models (ru_core_news_lg for Russian, en_core_web_trf for English). Identifies persons, organizations, locations, and other entity types. Models run locally on the Controller's infrastructure.

Layer 3 — Ollama LLM (Optional, Local)
Enhanced NER using a locally deployed open-source language model (qwen3:8b). Provides contextual understanding for ambiguous entities. This layer is optional and requires explicit user activation. The model runs entirely on the Controller's servers; no data leaves the infrastructure.

Layer 4 — EasyOCR / Tesseract (Local)
For image-based documents and scanned PDFs, OCR processing extracts text before NER analysis. All OCR processing is performed locally using open-source models.

8.2 Token Mapping

Each detected PII entity is assigned a deterministic anonymization token within the session scope (e.g., [PERSON_1], [ADDRESS_1], [PASSPORT_1]). The token mapping table enables:
- Consistent anonymization across the document (same entity always receives the same token)
- Optional de-anonymization by the End User (reversing tokens back to original values)
- Export of the token mapping for the End User's records

8.3 13 Entity Types

The Platform currently detects and anonymizes 13 entity types:

8.4 Output

The Platform generates:
- Anonymized document (original format where possible, or PDF)
- Token mapping table (JSON export available)
- Detection report (entity counts, confidence scores, flagged ambiguities)

---

9. Retention Periods

The Controller retains personal data for no longer than is necessary for the purposes for which it was collected, in accordance with the following schedule:

Session-based retention model: The Platform's default retention model is session-based. Uploaded documents, token mappings, and detection results are destroyed upon session completion. End Users may configure extended retention (e.g., 24 hours, 7 days) for convenience, but the default minimizes data retention.

Upon expiry of the applicable retention period, personal data is securely deleted using methods that render recovery technically infeasible (overwriting, cryptographic erasure, or certified destruction).

---

10. Rights of Data Subjects

Data subjects have the following rights under Chapter III GDPR. Requests should be submitted to privacy@lexaris.ru or via lexaris.ru/account/privacy. The Controller will respond within one calendar month of receipt of a valid request, with a possible extension of two further months where requests are complex or numerous (with notification of the extension within the first month).

10.1 Right of Access — Article 15

Data subjects have the right to obtain confirmation of whether the Controller processes their personal data, and if so, to receive a copy of that data together with information on: processing purposes, categories of data, recipients, retention periods, and the existence of automated decision-making.

10.2 Right to Rectification — Article 16

Data subjects have the right to obtain correction of inaccurate personal data and completion of incomplete data without undue delay. Corrections to account data may be made directly within the Platform interface.

10.3 Right to Erasure — Article 17

Data subjects have the right to request erasure of their personal data where the grounds set out in Article 17(1) apply.

Account data: Erased within 30 days (configured by Operator) of a valid erasure request, with propagation through backup systems completed within 90 days (configured by Operator).

Session data (uploaded documents, token mappings): Due to the session-based retention model, uploaded documents and token mappings may already have been automatically destroyed before an erasure request is received. Where session data still exists at the time of the request, it is destroyed immediately upon processing the request.

Exceptions: The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims. Article 17(3) exemptions are less likely to apply in the context of an anonymization service, as the Platform does not maintain case files or legal records on behalf of users.

10.4 Right to Data Portability — Article 20

Where processing is based on consent or contract performance, and carried out by automated means, data subjects have the right to receive their personal data in a structured, commonly used, machine-readable format (JSON or CSV).

The portability right applies to:
- Account profile data
- Anonymized output documents generated during the user's sessions
- Token mapping tables (where still within the retention period)
- Detection pipeline configuration and preferences

10.5 Right to Restriction of Processing — Article 18

Data subjects may request restriction of processing in the circumstances set out in Article 18(1). During restriction, data is stored but not otherwise processed (except with consent, for legal claims, or for protection of rights of others).

10.6 Right to Object — Article 21

Data subjects have the right to object to processing based on legitimate interests (Article 6(1)(f)) on grounds relating to their particular situation. The Controller shall cease processing unless it can demonstrate compelling legitimate grounds which override the data subject's interests, rights, and freedoms.

10.7 Withdrawal of Consent — Article 7(3)

Where processing is based on consent, data subjects may withdraw consent at any time through the Platform's privacy settings or by contacting privacy@lexaris.ru. Withdrawal does not affect the lawfulness of prior processing.

10.8 Verification of Identity

To protect against unauthorised disclosure, the Controller will verify the identity of persons making data subject rights requests. Verification may be conducted through confirmation of account credentials, email verification, or other reasonable means proportionate to the sensitivity of the request.

A comprehensive description of data subject rights procedures is set out in the Data Subject Rights Policy (Document 25).

---

11. Automated Decision-Making and Profiling — Article 22

11.1 No Fully Automated Decisions with Legal Effect

The Platform does not make fully automated decisions which produce legal effects or similarly significantly affect data subjects within the meaning of Article 22(1) GDPR. The anonymization pipeline produces outputs (anonymized documents) that are presented to End Users for review; End Users decide how to use the anonymized output.

11.2 NER as Automated Processing

The Platform uses automated processing (NER pipeline) to detect personal data in uploaded documents. This constitutes automated processing but does not constitute solely automated decision-making within the meaning of Article 22, as:
- The output is a tool for the End User, not a decision affecting a data subject
- End Users can review, adjust, and override all detection results before finalizing anonymization
- The Platform does not act on detection results without End User confirmation

11.3 Meaningful Information

Where data subjects wish to receive meaningful information about the logic of AI processing activities that affect them, requests may be submitted to privacy@lexaris.ru. The Controller will provide a general explanation of the NER pipeline's function, the entity types detected, and the safeguards in place. See also the International AI Processing Notice (Document 29).

---

12. Security of Processing — Article 32

The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Technical Measures:
- Encryption in transit: TLS 1.3 minimum for all data transmissions
- Encryption at rest: AES-256 for all stored data including uploaded documents and backups
- Access control: Role-based access controls, authentication enforcement
- Session isolation: Each user's uploaded documents and token mappings are isolated from other users' data
- Secure deletion: Session data destroyed using cryptographic erasure upon retention expiry
- Vulnerability management: Regular security assessments, dependency scanning
- Audit logging: Comprehensive access and modification logs

Organisational Measures:
- Data protection training for all personnel with access to personal data
- Confidentiality obligations for all personnel
- Incident response and data breach notification procedures (see Document 27)
- Regular review and testing of security measures

---

13. Right to Lodge a Complaint — Article 77

Data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that processing of their personal data infringes applicable data protection law.

Data subjects are encouraged to contact the Controller or the DPO in the first instance. However, this does not affect their right to lodge a complaint with a supervisory authority directly.

Information about supervisory authorities within the EU/EEA is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

---

14. Lexaris as a GDPR Compliance Tool

14.1 How Lexaris Helps Users Comply with GDPR

Lexaris is designed to assist users in meeting their own GDPR obligations:

• Data minimisation (Art.5(1)(c)): By anonymizing documents before sharing or processing, users can reduce the volume of personal data in circulation
• Privacy by design (Art.25): Anonymization is a recognised privacy-enhancing technology recommended by data protection authorities
• Lawful basis for secondary processing: Anonymized data is no longer personal data under GDPR Recital 26, enabling secondary processing without a separate legal basis
• Data protection impact mitigation: Anonymization reduces the risk profile of processing activities, potentially eliminating the need for a DPIA

14.2 Limitations

Lexaris is a tool, not legal advice. The Platform:
- Does not guarantee 100% detection of all PII (NER models are statistical and may miss unusual identifiers)
- Does not determine whether a document is adequately anonymized for a specific legal purpose — this assessment remains the responsibility of the End User
- Does not replace the need for legal counsel on GDPR compliance questions

---

15. Changes to This Policy

The Controller reserves the right to update this Policy to reflect changes in applicable law, regulatory guidance, or processing activities. Material changes will be notified to registered End Users by email at least 30 days before taking effect. The version date at the head of this document indicates the date of the last update. Continued use of the Platform following notification of material changes constitutes acceptance, subject to data subjects' right to object or withdraw consent where applicable.

The current version of this Policy is always available at lexaris.ru/legal/privacy.

---

16. Relationship to Russian Data Protection Law

This Policy addresses GDPR compliance for international (primarily EU/EEA) users. The Controller also complies with Federal Law No. 152-FZ "On Personal Data" of the Russian Federation. Where requirements of Russian law and GDPR overlap, the Controller applies the higher standard. A separate Privacy Policy addressing Russian law obligations is maintained at lexaris.ru/legal/privacy-ru.

---

17. Contact Information

---

Configurable parameters

The following parameters are configured by the Operator in the Platform Admin Panel. Values shown below are defaults.

All parameters are configured in: Admin Panel → Settings → Retention Periods

---

This Privacy Policy was prepared in accordance with GDPR Articles 13 and 14, the European Data Protection Board Guidelines 04/2019 on Article 25 Data Protection by Design and by Default, and EDPB Guidelines 01/2022 on Data Subject Rights. This document constitutes a draft requiring review and approval by qualified legal counsel before publication.

Document Reference: Anon-Legal-INT-24 | Version Date: 2026-03-19