Privacy Policy
Last updated: October 12, 2026
Gingham Holdings, Inc. d/b/a Lex ("Lex," "we," "us," or "our") is committed to protecting your privacy. This policy explains what we collect, why, and what happens to it — across our website (getlex.com) and the Lex mobile app, a non-custodial digital wallet.
1. Information We Collect
In the app, we collect sign-in and profile details, verified phone number, account country, public wallet address, holdings, and transfer, vault and market-order history. We also store historical portfolio valuations, asset quantities, timestamps, blockchain references, and incoming and outgoing cash-flow values to display charts and estimate returns. For tokenized-stock trades, we record your account country, three yes/no confirmations (18 or older, not a U.S. person, outside the United States), disclosure version, locale and acceptance time. Saved bank and recipient details and identity information depend on the financial service you select. The app also reports its installation and each time it is opened, with app and device details and, where your device permits, its advertising identifier, for advertising measurement as described in Sections 6 and 7. Website applications collect contact details, country, language, referrals and application answers, including income, net worth, card spending, premium-card use, USD or USDC holdings and travel cities. When you submit, we collect a browser fingerprint identifier, browser and device attributes, IP address and IP-derived city, region, country, latitude/longitude, network and timezone. Website analytics and advertising collection are described below. Mobile telemetry choices do not control this website collection. When you use Ask Lex, we store your questions, AI answers, calculator inputs and results, feedback, and saved conversations. We record the AI notice version and acceptance time at signup or sign-in.
2. Your Wallet Is Non-Custodial
The Lex app is a non-custodial wallet. Your funds live in a blockchain wallet controlled by a cryptographic key that is secured by a passkey on your device, managed through our key-infrastructure provider. Lex does not hold your funds and cannot move them without your device's authorization. Because of this design, we do not have — and never collect — your private keys. If you lose access to your passkey and your recovery methods, Lex cannot recover your funds for you.
3. Identity Verification (KYC)
Lex does not require a new identity document or date of birth just to create a wallet or use its self-directed market interface. Optional financial programs may require verification. Some financial partners collect identity information through hosted flows. For routes with in-app identity verification, the app collects legal ID, ID front and back, selfie, country and account context and uploads the images to storage authorized by the applicable partner after a separate notice. You can decline that program and continue using the wallet. Lex receives provider identifiers and verification status. Tokenized-stock issuers may separately require identity checks and other conditions before recognizing ownership or allowing redemption or voting rights. Lex’s eligibility confirmations do not satisfy those issuer requirements. Provider notices and terms govern their own verification and records.
4. Blockchain Data Is Public
Wallet addresses, asset movements, amounts and transaction history are visible on public blockchains, replicated across the network and permanent. Swaps and vault deposits, withdrawals and share transfers expose wallet and transaction data to the blockchain network and relevant smart contracts. Lex cannot erase those records. A payment link or QR code exposes the recipient wallet address, selected asset (including vault shares) and any requested amount to anyone who receives or opens it. Links can be forwarded and copied. Opening a payment page also involves the website collection described below; its URL can reveal those payment details to website analytics and advertising providers. Share only the details you intend others to see. A link alone does not authorize a payment.
5. How We Use Your Information
We use your information to: operate the app and website; create and secure your account; verify your phone number; display your portfolio and activity; prepare the market quote and transaction you request; record market orders and required disclosures; connect you to transfers, fiat conversions, virtual accounts, and card programs provided by our partners; evaluate invitation requests and manage waitlists; communicate with you; analyze mobile app use where you have allowed analytics, analyze website use, and measure advertising on the website and in the app as described in Sections 6 and 7; prevent fraud and abuse; and comply with legal obligations. Ask Lex uses your questions and relevant Lex holdings, valuations and activity to provide financial education, factual explanations and calculations. You can also describe holdings outside Lex; these remain information you supplied, not verified account data.
6. Who Receives Information, and Why
Recipients depend on the feature you use. Necessary account and transaction processing is separate from optional mobile telemetry, and from mobile advertising measurement, which is on unless you turn it off. The provider and terms shown for your particular financial route also apply.
Hosting and storage
Our cloud hosting providers host Lex’s API, database infrastructure and website. They process the records stored with them, requests and network/log metadata to run and secure those services. This infrastructure supports the account and website features you use.
Wallet and blockchain infrastructure
Our wallet key-infrastructure provider receives account email, wallet and organization identifiers, public passkey registration and signed authorization data to create, secure and recover wallets and submit transactions. Our blockchain infrastructure provider receives wallet addresses and blockchain queries to retrieve balances, transactions and historical state. These transfers are necessary for the wallet features you request. They do not give Lex your plaintext private key.
Financial and identity partners
When you select an enabled financial route, our financial partners and their banking or verification providers receive the contact, identity, wallet, bank/recipient and transaction information needed for verification, conversion, settlement and legal compliance. The applicable identity-verification partner receives ID images and selfies as described above. You may choose not to use a route; its required verification cannot be disabled while using it. Our payment processor processes payment and customer details for any separate payment it handles, and Lex receives payment status and references.
Service messages and support
Our email delivery provider receives email addresses and service-message content. Our phone verification delivery providers receive phone numbers and verification-message content when used for delivery. Lex receives the information you send to support. These messages enable sign-in, recovery, verification and requested support. Optional marketing preferences are separate from necessary service messages.
Optional mobile analytics
With analytics enabled, our product analytics provider, PostHog, receives a Lex user ID or analytics identifier, app/device metadata and permitted product-interaction events. iOS also enables automatic screen and lifecycle events; Android disables those automatic events. This supports product analysis. Analytics is off until allowed; withdrawing it stops new analytics and resets the local analytics identity.
Optional mobile location and diagnostics
With location telemetry enabled, our IP-location provider, ipapi.co, receives your IP address and supplies location coordinates, city, region, country, network and timezone to Lex for security and support. With separate device diagnostics enabled, Lex collects IDFV on iOS or Android ID on Android, model, OS, hardware, display, language, timezone, app/build, biometric availability/type, device-compromise indicators and battery state. These are device attributes, not fingerprint or face templates. Collection stays off until you confirm sharing, and each choice can be withdrawn independently.
Mobile advertising measurement
The mobile apps include a software development kit from Meta, our advertising measurement provider. From the first time the app is opened, it tells Meta that the app was installed, each time it is opened and how long each session lasted, so that we can measure which advertisements led to installs. Meta receives an identifier the kit creates for the installation, app and device details (such as app version, operating system, device model, language, time zone, mobile carrier, screen size and storage), your IP address and, where your device settings permit, the device’s advertising identifier. On iOS the advertising identifier is sent only if you allow tracking when Apple asks, and the app also registers the install with Apple’s ad attribution service, which reports installs to ad networks without identifying you. On Android, Meta also receives the Google Play install referrer when the install came from one of its ads, the name of the app that opened Lex when another app did, and, on Android 10 and earlier, an attribution identifier from the Facebook app if that app is installed. On both platforms the kit can also send Meta reports of crashes in its own code. We do not send your name, email, phone number, wallet address, balances, transactions or identity information to Meta from the app. Meta may combine what it receives with other information under its own policy. This measurement does not depend on the sharing prompt. You can turn it off under Account → Privacy & Data → Ad measurement; that stops new reports, from the next time the app is opened at the latest, but cannot recall what was already sent.
Website analytics, advertising and abuse prevention
PostHog receives page views, interactions, browser/device metadata, identifiers and application-event attributes such as country, referral source and card-spending range for website analysis. Google Analytics also measures public page views and download-link clicks using cookies and browser/device data. We do not send phone-verification details, payment-request addresses or account-deletion form data to Google Analytics. Our advertising measurement provider receives pixel and server-side PageView and Lead events, event time/ID, page URL, IP and browser user agent for advertising measurement and matching. Application Lead events also send hashed email, first and last name and country to that provider. Hashing does not make these identifiers anonymous. The advertising measurement provider may combine events with other information under its own policy. Our bot-protection provider processes browser, device and network signals to check for automated abuse. Website application IP lookups also use our IP-location provider. The next section explains website choices.
Public market data and protocols
Market-data providers supply token prices, reference prices and public vault data. Lex requests asset, pool or contract data from these sources rather than sending your account profile for price information. On-chain operations expose addresses and transaction data to the blockchain network and relevant swap and vault protocols; that is different from providing a customer profile to a market-data supplier. Issuers can observe public token activity and may collect information directly if you ask them to verify or redeem a holding.
Ask Lex AI processing
Ask Lex sends your questions, relevant conversation history and the Lex account facts needed for an answer to Anthropic, our AI provider. Public web research uses general topics, countries and public asset names; it does not send your portfolio or messages to search providers. Do not include passwords, private keys, identity documents or bank credentials. AI-provider processing and retention are governed by our provider arrangements and applicable legal requirements.
7. Website and Mobile Privacy Choices
In the mobile app, analytics, IP-derived location and device/security diagnostics have separate controls under Account → Privacy & Data. The sharing prompt may preselect undecided options, but collection under these three choices starts only after you confirm them. You can decline all three or change individual choices. Selecting or dismissing the prompt alone does not grant consent. Marketing is a separate preference. You can withdraw optional choices without losing basic wallet access. Mobile advertising measurement (Section 6) is separate from those three choices: it starts when the app is first opened and has its own switch, Ad measurement, under Account → Privacy & Data. On iOS, Apple’s tracking permission decides whether the advertising identifier is sent; on Android, your device’s advertising ID setting does. Turning the switch off, or declining Apple’s permission, does not affect wallet access. The website uses cookies, pixels and similar technologies and currently starts configured analytics and advertising tracking without an on-site consent or opt-out control. The app’s switches do not change website tracking. Browser settings and blockers may limit browser cookies or requests, but do not necessarily stop server-side advertising measurement events or erase previously collected data. The advertising measurement provider’s own privacy settings apply to its services. Contact support@getlex.com to exercise applicable privacy rights. If you allow mobile analytics, PostHog receives Ask Lex usage metadata such as topic, content module, helpfulness, latency, token counts, estimated operating cost, errors and navigation actions. We do not send chat content, portfolio values or calculator amounts to PostHog.
8. Other Disclosures and Advertising Sharing
We disclose information to the recipients described above for the stated purposes, to professional advisers, and to authorities where legally required. Financial partners may make legally required disclosures, including for anti-money-laundering and applicable Travel Rule obligations. Information may also transfer in a merger, acquisition or sale of assets. Website and mobile app disclosures to our advertising measurement provider can constitute “sharing” for cross-context behavioral advertising, or a “sale,” under applicable privacy law even without a monetary payment. Depending on where you live, you may have the right to opt out of such processing. The website limitations described in Section 7 also apply; the mobile switches, including Ad measurement, are not a website advertising opt-out.
9. Data Retention
Account deletion ends Lex access after confirmation. Cleanup is scheduled within 30 days, subject to settlement of pending financial activity and records that must be retained. Cleanup removes Lex’s stored portfolio valuation points, holdings history, cash-flow history and associated synchronization records, along with unnecessary profile, recipient and session information. Transaction, market-order, financial-risk and eligibility-acceptance evidence may remain for compliance, disputes and other legal requirements. Providers separately retain their own identity and financial records under their notices and applicable obligations; deleting Lex does not automatically erase every provider’s records. Public blockchain records remain permanent. By default, deletion preserves a limited, encrypted wallet-recovery locator separately from the active account so that wallet recovery remains possible through the supported process. This is not an active account or a guarantee that lost credentials or assets can be recovered. Export and safeguard your recovery information before deleting. Contact support for questions about retained records. Lex saves Ask Lex conversations across devices until you delete the conversation or your account. Deleting a conversation removes it from the active Lex database. Backup retention, legally required records and data already processed by providers follow the retention rules in this policy and the applicable provider arrangements. You can obtain your saved conversations through the account data export.
10. Your Rights
Depending on your location, you may request access, correction, deletion or a portable copy of personal data, restrict or object to processing, withdraw optional consent, or opt out of applicable advertising sale/sharing. Use Account → Privacy & Data for the app’s controls, data export and deletion, or contact support@getlex.com. You can also start account deletion on the website without reinstalling the app. We may need to verify a request. Public blockchain records cannot be deleted, and required financial and compliance records may be retained.
11. International Data Transfers
Your information may be transferred to and processed in the United States and other countries where we or our providers operate. These countries may have data-protection laws that differ from those of your country of residence.
12. Security
We use industry-standard measures to protect your information, including encryption in transit and at rest, hardware-backed key management for wallets, access controls, and audit logging. Saved bank details are encrypted with managed keys. No method of transmission or storage is completely secure; protect your device and your passkey.
13. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal information from children, and we delete any such information we discover.
14. Changes to This Policy
We may update this policy from time to time. Changes take effect when posted; we will notify you of material changes through the website, the app, or by email.
15. Contact
Questions about this policy or our data practices: support@getlex.com.