Privacy Policy

Last updated: August 10, 2026

Gingham Holdings, Inc. d/b/a Lex ("Lex," "we," "us," or "our") is committed to protecting your privacy. This policy explains what we collect, why, and what happens to it — across our website (getlex.com) and the Lex mobile app, a non-custodial digital wallet.

1. Information We Collect

Through the website, when you request an invitation or join a waitlist, we collect: your name, email address, phone number, country of residence, and the answers you give on the application form (such as profession, income range, spending patterns, and referral information). Through the app, we collect: your email address (your sign-in identity), your name, your phone number (verified by a code we send you), your wallet's public blockchain address, your transaction history with Lex, bank account details you save for transfers (encrypted at rest), and — if you join the card waitlist — self-reported financial information such as profession, annual income, and estimated net worth. We also collect technical information described in the Analytics and Cookies sections below.

2. Your Wallet Is Non-Custodial

The Lex app is a non-custodial wallet. Your funds live in a blockchain wallet controlled by a cryptographic key that is secured by a passkey on your device, managed through our key-infrastructure provider (Turnkey). Lex does not hold your funds and cannot move them without your device's authorization. Because of this design, we do not have — and never collect — your private keys. If you lose access to your passkey and your recovery methods, Lex cannot recover your funds for you.

3. Identity Verification (KYC)

To offer bank transfers and virtual account numbers, our regulated partners must verify your identity. Verification — including government ID documents and a selfie — is collected and processed directly by Bridge (a Stripe company) and its verification provider in their own hosted flows, under their privacy policies. Lex receives your verification status and limited profile information; we do not receive or store your identity documents. Our partners retain verification data as required by anti-money-laundering and know-your-customer laws.

4. Blockchain Data Is Public

Transactions made with your wallet are recorded on public blockchain networks. Your wallet address and its transaction history are publicly visible to anyone, are replicated across the network, and cannot be altered or deleted — by you or by Lex. Do not share your wallet address if you do not want your transaction history associated with you. Deletion rights described in this policy cannot apply to data recorded on a public blockchain.

5. How We Use Your Information

We use your information to: operate the app and website, create and secure your account, verify your phone number, provide transfers and virtual accounts through our partners, evaluate invitation requests and manage waitlists, communicate with you about your account and service updates, understand product usage so we can improve it, prevent fraud and abuse, and comply with legal obligations.

6. Service Providers

We use third-party providers to operate Lex. In the app: Turnkey (wallet key infrastructure), Bridge, a Stripe company (banking rails, virtual accounts, and identity verification), Alchemy (blockchain infrastructure), Postmark (transactional email), Sendblue and Twilio (delivery of phone verification codes via iMessage or SMS), Stripe (card membership payments), and PostHog (product analytics). On the website: PostHog (analytics), Meta Pixel (advertising measurement, website only), and Cloudflare Turnstile (bot protection). Each provider processes data only as needed to provide its service.

7. Cookies and Analytics

The website uses cookies, pixels, and similar technologies for essential functionality, analytics, and advertising measurement. The app uses PostHog, a first-party analytics tool, to record screen views, feature usage, and crash diagnostics tied to your account — we use this to understand and improve the product, not to track you across other companies' apps or websites. The app contains no advertising SDKs and does not use your data for cross-app tracking as defined by Apple's App Tracking Transparency.

8. Data Sharing

We do not sell your personal information. We share it only with: the service providers listed above; our banking and financial partners to provide the services you request and to meet their regulatory obligations (including anti-money-laundering rules and, for certain crypto transfers, Travel Rule requirements); professional advisors; and authorities when required by law. If Lex is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

9. Data Retention

We retain your information for as long as your account exists and as needed afterward to comply with legal obligations, resolve disputes, and enforce agreements. Financial-services regulations require our partners to retain identity-verification and transaction records for several years after account closure. Blockchain records are permanent and outside anyone's control (see Section 4).

10. Your Rights

Depending on your location, you may have the right to access, correct, or delete your personal data, restrict or object to its processing, and receive a portable copy. Residents of Brazil (LGPD), Mexico (LFPDPPP), and certain other jurisdictions have specific statutory rights. To exercise any right, email support@getlex.com. Note that we cannot delete data recorded on public blockchains, and our partners may be legally required to retain verification records even after you close your account.

11. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where we or our providers operate. These countries may have data-protection laws that differ from those of your country of residence.

12. Security

We use industry-standard measures to protect your information, including encryption in transit and at rest, hardware-backed key management for wallets, access controls, and audit logging. Saved bank details are encrypted with managed keys. No method of transmission or storage is completely secure; protect your device and your passkey.

13. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children, and we delete any such information we discover.

14. Changes to This Policy

We may update this policy from time to time. Changes take effect when posted; we will notify you of material changes through the website, the app, or by email.

15. Contact

Questions about this policy or our data practices: support@getlex.com.