Privacy Policy

Effective Date: August 16, 2026

This Privacy Policy describes how Berkman LLC, a Wyoming limited liability company doing business as Berkman Solutions (“Berkman,” “we,” “us,” or “our”), collects, uses, and protects personal information through the Lextree compliance management platform (“Platform”) and the lextree.ai website (“Website”).

This Privacy Policy is part of the Terms of Service (“Agreement”). Capitalized terms not defined here have the meanings given in the Agreement.

1. What This Policy Covers

This Policy applies to:

(a) Visitors — people who browse the Website;

(b) Customers — organizations that subscribe to the Platform; and

This Policy does not apply to information that third parties collect through their own websites or services, even if linked from the Website or Platform.

2. Information We Collect

2.1 Information You Provide

Account information. When a Customer creates an Account, we collect the name, email address, organization name, and billing information provided during registration.

Contact form submissions. When you submit a form on the Website, we collect the information you enter — including your name, work email address, company name, and message. We also collect technical context submitted with the form: your timezone, browser language, the page you submitted from, your referring URL, and any UTM campaign parameters.

IP address and approximate location. When you submit a form, our server records your IP address and derives an approximate location from it — city, state or region, and country. This is a coarse estimate produced by a geolocation database (MaxMind GeoLite2) hosted on our own server; it is not precise GPS location, and your IP address is not sent to a third party for this lookup. We use this to understand where inquiries come from and to detect spam and abusive submissions.

Marketing preferences. If you opt in to receive marketing communications, we record that consent along with the date and context.

Support requests. When you contact us for support, we collect the information you provide in your request.

Customer Data. Customers and Authorized Users enter data into the Platform — including entity records, compliance documents, contact information, and file attachments. Section 4 of the Agreement governs Customer Data. We process Customer Data on the Customer’s behalf as a data processor.

2.2 Information We Collect Automatically

Website analytics. We use Umami, a self-hosted, cookie-free analytics tool, to collect anonymous usage data about Website visits. This includes pages viewed, referring websites, browser type, device type, and general geographic region (country level). Umami does not use cookies, does not track individuals across sessions, and does not collect personally identifiable information.

Platform usage data. When Authorized Users use the Platform, we collect information about how the Platform is used — including features accessed, actions taken, and performance data. We use this to maintain, improve, and troubleshoot the Platform.

Session cookies. The Platform uses cookies for session management and authentication. These cookies are necessary for the Platform to function and cannot be disabled while using the Platform.

Bot protection. We use Cloudflare Turnstile on forms to verify that submissions come from real people, not automated scripts. Turnstile may set cookies or use browser signals as part of this verification. We do not control what data Cloudflare collects through Turnstile; see Cloudflare’s privacy policy for details.

Local storage. The Website stores your dark/light mode preference in your browser’s local storage. This data stays on your device and is never sent to our servers.

2.3 Information We Do Not Collect

We do not collect Social Security numbers, payment card numbers, health information, biometric data, or other Prohibited Data as defined in Section 4.4 of the Agreement. Customers must not enter such data into the Platform.

3. How We Use Your Information

We use personal information for the following purposes:

(a) Providing the Platform. Processing Account information and Customer Data to deliver, maintain, and support the Platform.

(b) Communicating with you. Responding to support requests, sending service announcements, and providing information you request through contact forms.

(c) Marketing. Sending product updates, newsletters, and promotional materials — only if you have opted in. You can unsubscribe at any time (see Section 7).

(d) Improving our services. Analyzing usage patterns to improve the Platform and Website. We use only aggregated or de-identified data for this purpose, as described in Section 4.7 of the Agreement.

(e) Security. Protecting the Platform and its users from unauthorized access, fraud, and abuse, including screening Website form submissions for spam.

(f) Legal compliance. Meeting our legal obligations, responding to lawful requests, and enforcing our agreements.

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

We share personal information only in these circumstances:

4.1 Service Providers

We use third-party service providers to help operate the Platform and Website. These providers process personal information on our behalf under contracts that require them to protect it. Our current sub-processors are listed at lextree.ai/legal/sub-processors.

4.2 At Your Direction

We share information when you direct us to — for example, when you use an integration or connect a third-party service to your Account.

4.3 AI Features

If you use Third-Party AI Services (as described in Section 19 of the Agreement), certain Customer Data may be transmitted to the AI provider you select. You control which provider you connect, and the provider’s own privacy policy governs how it handles that data. Lextree AI Services process data on Berkman’s infrastructure and are subject to this Privacy Policy.

4.4 Legal Requirements

We may disclose personal information if required by law, regulation, legal process, or government request. Where permitted, we will notify you before disclosing.

4.5 Business Transfers

If Berkman is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We may share information with your consent or at your direction for purposes not described in this Policy.

5. Data Retention

Account and Customer Data. We retain Account information and Customer Data for the duration of the Subscription Term. After the Agreement ends, we make Customer Data available for export for thirty (30) days, then delete it from production systems within a commercially reasonable time. Encrypted backup copies are purged within ninety (90) days. (See Sections 4.5 and 4.6 of the Agreement.)

Contact form submissions. We retain contact form data in our CRM for as long as needed to respond to your inquiry and maintain the business relationship. You may request deletion at any time.

Website analytics. Umami analytics data is anonymous and aggregated. It does not contain personal information and is not subject to individual deletion requests.

Marketing communications. If you subscribe to marketing communications, we retain your email address and consent record until you unsubscribe. We delete your information from our mailing list promptly after you unsubscribe.

6. Data Security

We maintain administrative, technical, and physical security measures to protect personal information. These include encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, audit logging, and network security controls. For more detail, see Section 5.1 of the Agreement and Annex 2 of the Data Processing Agreement.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect your information.

7. Your Rights and Choices

7.1 All Users

Marketing opt-out. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting us at team@lextree.ai. Unsubscribing from marketing does not affect service-related communications.

Contact form data. You can request that we delete information you submitted through a contact form by emailing team@lextree.ai.

7.2 Platform Users (Authorized Users)

Authorized Users should direct requests about Customer Data to their organization (the Customer). The Customer controls the data and decides how it is used. We will assist Customers in responding to data requests as described in the Data Processing Agreement.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under applicable data protection law:

(a) Access. Request a copy of the personal information we hold about you.

(b) Rectification. Request correction of inaccurate or incomplete information.

(c) Erasure. Request deletion of your personal information, subject to legal retention requirements.

(d) Restriction. Request that we restrict processing of your information in certain circumstances.

(e) Portability. Request your information in a structured, machine-readable format.

(f) Objection. Object to processing based on legitimate interests.

(g) Withdraw consent. Where processing is based on consent, withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise these rights, contact us at privacy@lextree.ai. We will respond within thirty (30) days. If we need more time, we will notify you.

You also have the right to lodge a complaint with your local data protection supervisory authority.

7.4 Rights Under US State Privacy Laws

If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with a comprehensive privacy law, you may have rights to access, delete, or correct your personal information, and to opt out of certain data practices. We do not sell personal information, share it for cross-context behavioral advertising, or use it for automated decision-making or profiling.

To exercise your rights, contact us at privacy@lextree.ai.

Where the GDPR applies, we process personal information on the following legal bases:

Purpose	Legal Basis
Providing the Platform and support	Performance of a contract (Article 6(1)(b))
Processing Customer Data on behalf of Customers	Processor acting on controller’s instructions (Article 28)
Website analytics (anonymous)	Legitimate interest in improving our services (Article 6(1)(f))
Marketing communications	Consent (Article 6(1)(a))
Security and fraud prevention	Legitimate interest in protecting our services (Article 6(1)(f))
Legal compliance	Legal obligation (Article 6(1)(c))

9. International Data Transfers

Personal information is stored and processed in the United States. If you are in the EEA, UK, or Switzerland, transfers to the US are governed by the Standard Contractual Clauses as described in Section 11 of the Data Processing Agreement.

10. Children’s Privacy

The Platform and Website are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at privacy@lextree.ai and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least thirty (30) days’ advance notice by email or by posting a notice on the Website. Non-material changes take effect when posted. Continued use after changes constitutes acceptance.

The “Effective Date” at the top of this page reflects the date of the most recent update.

12. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights:

Email: privacy@lextree.ai

Mail: Berkman LLC 109 East 17th Street, Suite 4137 Cheyenne WY 82001

For general support: team@lextree.ai

This Privacy Policy is part of the Terms of Service.