Privacy Policy
Last updated: August 21, 2026
Gingham Holdings, Inc. d/b/a Lex ("Lex," "we," "us," or "our") is committed to protecting your privacy. This policy explains what we collect, why, and what happens to it — across our website (getlex.com) and the Lex mobile app, a non-custodial digital wallet.
1. Information We Collect
Through the website, when you request an invitation or join a waitlist, we collect your contact details, country, application answers, and referral information. Through the app, we collect your sign-in and profile details, verified phone, public wallet address, transaction history, saved bank and recipient details, and information required for enabled financial products. With separate optional choices, the app may also collect PostHog product analytics; IP-derived location and network information from ipapi.co, including precise latitude and longitude; and device/security diagnostics including IDFV, model, operating system, hardware, display, locale, timezone, biometrics availability, jailbreak result, and battery state. Each optional category is off until you allow it and can be withdrawn in Privacy & Data.
2. Your Wallet Is Non-Custodial
The Lex app is a non-custodial wallet. Your funds live in a blockchain wallet controlled by a cryptographic key that is secured by a passkey on your device, managed through our key-infrastructure provider (Turnkey). Lex does not hold your funds and cannot move them without your device's authorization. Because of this design, we do not have — and never collect — your private keys. If you lose access to your passkey and your recovery methods, Lex cannot recover your funds for you.
3. Identity Verification (KYC)
To offer bank transfers and virtual account numbers, our regulated partners must verify your identity. Bridge and its verification provider collect information through their hosted flows. For Manteca bank rails, the Lex app directly collects your legal ID, government ID front and back, selfie, country, and related account information and uploads the images to Manteca-authorized storage. Before this begins, Lex presents a separate notice naming the information and recipient; you may decline and continue using the wallet without that Manteca rail. Lex receives verification status and provider identifiers. Partners retain verification records as required by their notices and applicable anti-money-laundering and know-your-customer laws.
4. Blockchain Data Is Public
Transactions made with your wallet are recorded on public blockchain networks. Your wallet address and its transaction history are publicly visible to anyone, are replicated across the network, and cannot be altered or deleted — by you or by Lex. Do not share your wallet address if you do not want your transaction history associated with you. Deletion rights described in this policy cannot apply to data recorded on a public blockchain.
5. How We Use Your Information
We use your information to: operate the app and website, create and secure your account, verify your phone number, provide transfers and virtual accounts through our partners, evaluate invitation requests and manage waitlists, communicate with you about your account and service updates, understand product usage so we can improve it, prevent fraud and abuse, and comply with legal obligations.
6. Service Providers
We use third-party providers to operate Lex. In the app: Turnkey (wallet key infrastructure), Bridge and Manteca (banking rails and identity verification), Alchemy (blockchain infrastructure), Postmark (transactional email), Sendblue and Twilio (verification delivery), Stripe (payments), PostHog (optional product analytics), and ipapi.co (optional IP-based location and network context). On the website: PostHog, Meta Pixel (website advertising measurement only), and Cloudflare Turnstile. Each provider processes data for the stated service and subject to the applicable agreement and notice.
7. Cookies and Analytics
The website uses cookies, pixels, and similar technologies for essential functionality, analytics, and advertising measurement. In the app, PostHog analytics, ipapi.co location, and device/security diagnostics are three separate optional choices and remain off until you allow them. You can withdraw any choice in Account → Privacy & Data; collection stops immediately and Lex applies the applicable deletion and retention process. The app contains no advertising SDKs and does not use app data for cross-app tracking as defined by Apple's App Tracking Transparency.
8. Data Sharing
We do not sell your personal information. We share it only with: the service providers listed above; our banking and financial partners to provide the services you request and to meet their regulatory obligations (including anti-money-laundering rules and, for certain crypto transfers, Travel Rule requirements); professional advisors; and authorities when required by law. If Lex is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
9. Data Retention
We retain your information for as long as your account exists and as needed afterward to comply with legal obligations, resolve disputes, and enforce agreements. Financial-services regulations require our partners to retain identity-verification and transaction records for several years after account closure. Blockchain records are permanent and outside anyone's control (see Section 4).
10. Your Rights
Depending on your location, you may have the right to access, correct or delete personal data, restrict or object to processing, withdraw optional choices, and receive a portable copy. The app provides analytics, location, device-diagnostics, and marketing controls plus data export and account deletion under Account → Privacy & Data. You may also email support@getlex.com. Public blockchain records cannot be deleted, and Lex or its partners may retain records where legally required.
11. International Data Transfers
Your information may be transferred to and processed in the United States and other countries where we or our providers operate. These countries may have data-protection laws that differ from those of your country of residence.
12. Security
We use industry-standard measures to protect your information, including encryption in transit and at rest, hardware-backed key management for wallets, access controls, and audit logging. Saved bank details are encrypted with managed keys. No method of transmission or storage is completely secure; protect your device and your passkey.
13. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal information from children, and we delete any such information we discover.
14. Changes to This Policy
We may update this policy from time to time. Changes take effect when posted; we will notify you of material changes through the website, the app, or by email.
15. Contact
Questions about this policy or our data practices: support@getlex.com.