Privacy Policy
Last updated: September 2, 2026
Gingham Holdings, Inc. d/b/a Lex ("Lex," "we," "us," or "our") is committed to protecting your privacy. This policy explains what we collect, why, and what happens to it — across our website (getlex.com) and the Lex mobile app, a non-custodial digital wallet.
1. Information We Collect
Through the website, when you request an invitation or join a waitlist, we collect your contact details, country, application answers, and referral information. Through the app, we collect your sign-in and profile details, verified phone, public wallet address, transaction and market-order history, saved bank and recipient details, and information required for enabled financial products. If you buy or sell tokenized stocks, we record the disclosure version, locale, timestamp, and your three yes/no eligibility confirmations. We do not collect a new date of birth, citizenship, identity document, sanctions-screening consent, IP location, or device profile merely to create a wallet or use self-directed markets. Data collected for an optional card or bank program is unchanged and is governed by that program's notice. With separate optional choices, the app may also collect PostHog product analytics; IP-derived location and network information from ipapi.co, including precise latitude and longitude; and device/security diagnostics including IDFV, model, operating system, hardware, display, locale, timezone, biometrics availability, jailbreak result, and battery state. Each optional category is off until you allow it and can be withdrawn in Privacy & Data.
2. Your Wallet Is Non-Custodial
The Lex app is a non-custodial wallet. Your funds live in a blockchain wallet controlled by a cryptographic key that is secured by a passkey on your device, managed through our key-infrastructure provider (Turnkey). Lex does not hold your funds and cannot move them without your device's authorization. Because of this design, we do not have — and never collect — your private keys. If you lose access to your passkey and your recovery methods, Lex cannot recover your funds for you.
3. Identity Verification (KYC)
Identity verification is not required merely to create the non-custodial wallet or use the self-directed market interface. To offer optional provider-run fiat deposits, withdrawals, conversions, virtual account numbers, or card programs, Bridge, Iron, Manteca, a card-program partner, or their verification providers may need to verify your identity. Bridge and Iron collect information through their hosted flows. For Manteca bank rails, the Lex app directly collects your legal ID, government ID front and back, selfie, country, and related account information and uploads the images to Manteca-authorized storage. Before this begins, Lex presents a separate notice naming the information and recipient; you may decline and continue using the wallet without that program. Lex receives verification status and provider identifiers. Partners retain verification and transaction records as required by their notices and applicable law.
4. Blockchain Data Is Public
Transactions made with your wallet are recorded on public blockchain networks. Your wallet address and its transaction history are publicly visible to anyone, are replicated across the network, and cannot be altered or deleted — by you or by Lex. Do not share your wallet address if you do not want your transaction history associated with you. Deletion rights described in this policy cannot apply to data recorded on a public blockchain.
5. How We Use Your Information
We use your information to: operate the app and website; create and secure your account; verify your phone number; display your portfolio and activity; prepare the market quote and transaction you request; record market orders and required disclosures; connect you to transfers, fiat conversions, virtual accounts, and card programs provided by our partners; evaluate invitation requests and manage waitlists; communicate with you; improve the product where you have allowed analytics; prevent fraud and abuse; and comply with legal obligations.
6. Service Providers
We use third-party providers to operate Lex. In the app: Turnkey (wallet key infrastructure); Bridge, Iron, and Manteca (provider-run bank rails, fiat conversions, settlement, and identity verification); Alchemy (blockchain infrastructure); Aerodrome (user-authorized on-chain swaps); Chainlink (public reference-price data); digital-asset issuers and their underlying infrastructure; Postmark (transactional email); Sendblue and Twilio (verification delivery); Stripe (payments); PostHog (optional product analytics); and ipapi.co (optional IP-based location and network context). A market transaction publishes your wallet address and transaction data to Base and the protocol; Lex does not send your account profile to Aerodrome or Chainlink. On the website: PostHog, Meta Pixel (website advertising measurement only), and Cloudflare Turnstile. Each provider processes data for the stated service and subject to the applicable agreement and notice.
7. Cookies and Analytics
The website uses cookies, pixels, and similar technologies for essential functionality, analytics, and advertising measurement. In the app, PostHog analytics, ipapi.co location, and device/security diagnostics are three separate optional choices and remain off until you allow them. You can withdraw any choice in Account → Privacy & Data; collection stops immediately and Lex applies the applicable deletion and retention process. The app contains no advertising SDKs and does not use app data for cross-app tracking as defined by Apple's App Tracking Transparency.
8. Data Sharing
We do not sell your personal information. We share it only with: the service providers listed above; our banking and financial partners to provide the services you request and to meet their regulatory obligations (including anti-money-laundering rules and, for certain crypto transfers, Travel Rule requirements); professional advisors; and authorities when required by law. If Lex is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
9. Data Retention
We retain your information for as long as your account exists and as needed afterward to comply with legal obligations, resolve disputes, and enforce agreements. Market-order evidence and accepted financial-risk or eligibility disclosures are retained under the applicable versioned retention policy; unnecessary locale and profile data are removed during account deletion. Financial-services regulations may require our partners to retain identity-verification and transaction records for several years after account closure. Blockchain records are permanent and outside anyone's control (see Section 4).
10. Your Rights
Depending on your location, you may have the right to access, correct or delete personal data, restrict or object to processing, withdraw optional choices, and receive a portable copy. The app provides analytics, location, device-diagnostics, and marketing controls plus data export and account deletion under Account → Privacy & Data. You may also email support@getlex.com. Public blockchain records cannot be deleted, and Lex or its partners may retain records where legally required.
11. International Data Transfers
Your information may be transferred to and processed in the United States and other countries where we or our providers operate. These countries may have data-protection laws that differ from those of your country of residence.
12. Security
We use industry-standard measures to protect your information, including encryption in transit and at rest, hardware-backed key management for wallets, access controls, and audit logging. Saved bank details are encrypted with managed keys. No method of transmission or storage is completely secure; protect your device and your passkey.
13. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal information from children, and we delete any such information we discover.
14. Changes to This Policy
We may update this policy from time to time. Changes take effect when posted; we will notify you of material changes through the website, the app, or by email.
15. Contact
Questions about this policy or our data practices: support@getlex.com.