Privacy policy

1. Who we are

LexaOCR is a service of Arabian AI Lab, Dubai, United Arab Emirates (“we”, “us”). For personal data in your account, we are the controller. Contact for anything in this policy: hello@arabianailab.com.

2. What we collect

• Account data: your email address and sign-in details. LexaOCR and LexaTranslate share one Lexa account.
• Your documents: the files you upload, the page images and text we produce from them, the corrections you make, and the Word files and audio we create for you.
• Usage data: technical logs (time, pages processed, errors, IP address) needed to run and secure the service.

Documents can contain personal data about you or other people, including identity numbers on passports and ID cards and, in letters or certificates, sensitive information. We process this content only to produce your results. Please upload only documents you have the right to process.

3. Why we use it, and on what basis

We do not sell your data and we do not show advertising. Our staff do not open your documents unless you ask us to for support, or it is necessary to keep the service secure or to comply with the law.

4. Documents you upload for others

If you use LexaOCR for your organisation or for clients, for example as a typing centre or law firm, you decide what is uploaded and why, so you are the controller of the personal data in those documents and we process it on your behalf and on your instructions. You are responsible for having a lawful basis and for informing the people concerned. A data-processing agreement is available on request.

5. Who processes your documents

We use carefully chosen service providers, each only for its task and under a written contract that protects your data:

• Cloud hosting, storage and databases.
• AI processing partners that read the page images and check the text. They return the results to us and may not use your content to train their own models.
• Voice generation for listening and audiobooks, when you use them.
• Email delivery, when you ask us to email your files.
• Sign-in, shared with LexaTranslate.

When you click “Send to LexaTranslate”, the text is handed to LexaTranslate, another Lexa service of Arabian AI Lab, under its own terms. We may also disclose data where the law requires it, for example to a court or regulator. You can ask us for the current list of providers at any time.

6. Where your data is

Documents and databases are stored in India (Mumbai region). Pages may be processed by our AI partners in the European Union and other regions. These transfers are protected by contracts with our providers that require security and confidentiality, as the UAE PDPL requires, and, for people in the European Economic Area or the UK, by the European Commission's standard contractual clauses. Data is encrypted whenever it travels.

7. How long we keep it

• Documents: 30 days after upload, a document and every file made from it are deleted automatically. You can delete a document sooner from My documents.
• Corrections are deleted together with their document.
• Account data is kept while your account is open. Ask us to close it and we delete your LexaOCR data within 30 days; because the Lexa account is shared, closing it also closes your LexaTranslate access.
• Logs are kept for up to 90 days, unless needed longer to investigate abuse.
• Invoices and payment records, once paid plans start, are kept for as long as UAE law requires.

8. Security

Files are encrypted in transit (HTTPS) and at rest. Each document is visible only to the account that uploaded it, and links to page images expire. If a breach affects your personal data, we will inform you and the competent authorities as the law requires. More on our security page.

9. Cookies and browser storage

LexaOCR uses only what it needs to work: storage in your browser that keeps you signed in and lets an interrupted upload resume. We use no advertising or tracking cookies. If we ever add analytics, we will update this policy first and ask for consent where required.

10. Your rights

Under the UAE PDPL and the GDPR you can ask to access your personal data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw consent where we rely on it. Email hello@arabianailab.com; we may ask you to confirm your identity, and we answer within 30 days. You can also complain to the UAE Data Office or to the data-protection authority where you live.

11. Children

LexaOCR is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

12. Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change applies. The date at the top shows the latest version.