Privacy policy

1. Introduction

At Ex Nunc Intelligence SA (we, our or Ex Nunc), we recognize the importance of your privacy and of transparency.

This privacy policy (the “Privacy Policy”) describes how we process your personal data when you interact with our Silex solution, accessible via the web application at https://app.silex.legal/ (“our Solution” or “Silex”) or via the website https://silex.legal/, as well as with the services we provide in this context (together with the provision of Silex, “our Services”). Silex is a SaaS (Software as a Service) solution that provides artificial intelligence services (research, chatbot, etc.) designed to assist legal professionals in their legal research and tasks.

By using our Services, you expressly acknowledge that we may process your personal data in accordance with this Privacy Policy.

The Privacy Policy forms an integral part of, and is incorporated into, the General Terms of Use of Silex (“GTC”), available at: https://silex.legal/en/terms-conditions. Capitalized terms that are not defined in the Privacy Policy have the meaning given to them in the GTC.

2. Summary

The following summarizes, without replacing, the content of this Privacy Policy. We recommend that you read it in full.

• Our role. We, Ex Nunc Intelligence SA, act as the controller of your personal data for our own activities, but not for those of third-party providers (see section 3); however, where we process your data to provide our Services to an organization with which you are affiliated (“your Organization”), we generally act as a processor on behalf of your Organization. Please refer to your Organization’s data protection policies for information on how it processes your data (see section 7);
• The data we collect. We collect the personal data that you provide to us, that your Organization transmits to us or that third parties provide to us. We also automatically collect certain information when you interact with the Services (see section 4);
• How we use it. We process your personal data in accordance with Swiss law and the other data protection laws applicable to us. In particular, we only process your data when we have a valid reason to do so (see section 5) and only for specific purposes, mainly to provide our Services, to operate Silex and for the other legitimate purposes described in this Privacy Policy (see section 6);
• Storage, processing and transfers. Persistent data, including the database, documents and encrypted backups, is stored in Switzerland with Infomaniak in Geneva. Azure Switzerland North in Zurich is used solely for computing, application processing and AI inference: no data is stored there. LLM inference involves a temporary in-memory decryption window, which results in residual exposure to the US CLOUD Act during that window only. A migration to Swiss GPUs is planned for 2027. Other processors and the safeguards applicable to transfers are described in sections 8 and 9;
• Retention. Data is retained for as long as the account is active. Upon explicit request or when the account is closed, it is deleted from the active database without delay, and at the latest within 14 days; residual copies in encrypted backups are purged 14 days after actual deletion. Technical logs are kept for 30 days and then permanently deleted. Certain data must be retained for longer periods under legal obligations (see section 10);
• Security. We implement appropriate security measures and strive to protect your personal data. However, no IT infrastructure is completely secure and we cannot guarantee that ours is (see section 11);
• Your rights. You may contact us at data@silex.legal to exercise your rights regarding your personal data (see sections 13 and 14).

3. Who is responsible for the processing of your personal data?

Ex Nunc Intelligence SA, CHE-439.808.328, EPFL Innovation Park, Building I, 1015 Lausanne, Switzerland, is the controller of your personal data. Our contact details are set out in section 14 below.

The Privacy Policy only applies to the processing of personal data carried out by us or on our behalf. We may provide links to third-party websites, content or services. However, we are not responsible for their data protection policies. The collection and use of your personal data by these third-party providers is governed by their respective data protection policies, which we recommend that you read carefully.

As described in more detail in this Privacy Policy, we may process your personal data in connection with the professional services we provide to your employer or your Organization. The Privacy Policy does not govern how your Organization processes your personal data through the Services. Please refer to your Organization’s policies for information on how your data is processed in this context. Please see section 7 below for further information in this regard.

4. How do we collect your personal data?

We collect the personal data that you or your Organization provide to us.

We collect the personal data that you or your Organization provide to us when using the Services, for example when you use our Solution, create or manage a user account, fill in forms, subscribe to our newsletter or take part in a transaction.

You must complete the data fields marked as mandatory. If one or more of these fields are not completed, we will not be able to give you access to the Services. You are not required to complete optional data fields to access the Services. These fields may be completed later via your user account.

Some personal data about you may also be provided to us directly by our users.

Even if you are not a user of our Services, we may collect certain information about you if it is provided to us by one of our users. This information may be transmitted through prompts (queries) submitted to Silex or through files uploaded to Silex by our users. The data collected depends entirely on the content that our users choose to submit or upload to Silex.

Some personal data is also collected automatically, in particular to monitor the use of the Services.

We may also collect personal data automatically, in particular by means of cookies and other similar technologies, as well as by means of an internal tracking system, in order to monitor the use of the Services and measure their consumption, as described further in this Privacy Policy.

You can set certain permissions regarding the automatic collection of your personal data when you configure your device or web browser, depending on the features available. You can also adjust certain settings for the automatic collection of your personal data through the cookie settings tool available on Silex.

The data we process may include sensitive data.

The information you provide may include sensitive data about you, in particular data relating to criminal records, criminal convictions, court decisions, ongoing or past legal proceedings, health, political opinions, religious or philosophical beliefs, trade union membership, as well as biometric data or data concerning sex life or sexual orientation (“Sensitive Data”). This may be the case in particular when a user submits legal documents, client files or other content in the course of using Silex. In particular, since our users are free to ask questions relating to their matters, we may indirectly process, through these questions, personal data relating to convictions or any other sensitive data that they have themselves entered.

We process such Sensitive Data in accordance with applicable data protection laws and this Privacy Policy.

5. How do we process your personal data?

We process your personal data in accordance with applicable law and only if we have a valid reason to do so.

We process your personal data in accordance with applicable law, in particular the Swiss Federal Act on Data Protection and, to the extent applicable to us, other data protection legislation, in particular the EU General Data Protection Regulation (“GDPR”), either manually or automatically using IT tools.

This means that we only process your personal data for specific purposes (see section 6) and only if we have a valid reason to do so.

Additional information on our legal bases

• What are our legal bases?

• Contractual Necessity. The processing of data is necessary to perform our contractual obligations towards you or to take pre-contractual steps at your request. This is particularly the case where the processing is necessary to provide you with the Services, as set out in section 6 below. Where the GDPR applies, this type of processing is based on Article 6(1)(b) GDPR.
• Legitimate Interests. The processing is necessary for the purposes of our legitimate interests, and only to the extent that your interests or fundamental rights and freedoms do not require that the processing be refrained from. Where the GDPR applies, this type of processing is based on Article 6(1)(f) GDPR.
• Consent. We obtain your prior consent in a clear and unambiguous manner. Consent may be withdrawn at any time. However, the withdrawal of Consent does not affect the lawfulness of processing carried out before its withdrawal. For children under the age of 16, Consent must be given by an adult holding parental responsibility. Where the GDPR applies, this type of processing is based on Article 6(1)(a) GDPR.
• Legal Obligation. The processing is necessary to comply with our legal or regulatory obligations. Where the GDPR applies, this type of processing is based on Article 6(1)(c) GDPR.

What about Sensitive Data?

In addition, we only process your Sensitive Data if we have obtained your explicit consent for one or more specific purposes, or if we can rely on another justification in accordance with applicable data protection laws.

What happens when we act as a processor?

When we act as a processor for the Organization with which you are affiliated, our processing of your data is governed by the contract between us and your Organization (see section 7).

If you are not a client or user of our Services, but your personal data is contained in our users’ files, we process your personal data as a processor in order to provide our Services to our users. In this case, our processing of your personal data is governed by a contract between us and the user concerned. The Privacy Policy does not address how our users use your personal data. Please refer to the policy of the user who provided us with your data and contact that user directly with any questions about their use of your personal data.

Additional information on profiling and automated decision-making

We do not process your personal data to create a profile about you (profiling).

Nor do we make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (automated individual decisions).

6. For what purposes do we process your personal data?

1. For what purposes do we process your personal data?

We process your personal data for the following purposes:

To provide our Services and operate Silex

We mainly process your personal data to operate Silex and/or provide you with the Services, including to enable you to create and manage a user account.

We never use your personal data to train, fine-tune or improve the artificial intelligence and/or machine learning models underlying our Services.

Additional information

• To process subscriptions and payments. To place an order, you must provide the information requested from you (e.g. contact details, billing and delivery addresses, payment information).

We also automatically collect data relating to your use of Silex in accordance with our Cookie Notice.

We use third-party services for payments. Depending on the payment method selected, you may for example be redirected to the website of an online payment provider responsible for processing the payment. We only transmit to these third parties the data necessary for the operations they carry out.

The processing of order-related data is based on our Contractual Necessity to provide you with the products and Services requested.

We are required by law to retain certain information, such as contracts and other accounting records, for a certain period, generally at least 10 years.

• For maintenance and support operations. We use data to maintain our Services, troubleshoot and diagnose issues, and provide support services to our users.

What if you are not a client or user of our Services?

If you are not a user, we process your personal data if it is provided to us by one of our users, for example because you are a client of an organization with which that user is affiliated. In this case, we mainly process your personal data in order to provide Silex and the Services to your Organization, on the basis of a contract between us and your Organization. The Privacy Policy does not govern how your Organization processes your personal data or how we process your data on behalf of your Organization. Please refer to your Organization’s policies and contact it directly with any questions about the use of your personal data.

For our legitimate business interests related to the provision of the Services, including to ensure the security of the Services, to improve our Services, and for monitoring or statistical purposes.

We may also process your personal data for our legitimate business operations related to the provision of our Services, in order to (i) ensure that our Services are provided efficiently and securely, for example through internal analyses of their stability and security, updates and troubleshooting; (ii) ensure the security of our IT infrastructure and networks; (iii) obtain services required for the provision of our Services from third parties at a competitive price, for example where we choose to use certain services offered by third-party providers rather than performing them in-house; and (iv) improve and develop the Services, in particular by monitoring their performance or use and for statistical purposes.

In this context, we generally rely on our Legitimate Interests. We may also process your data if we have obtained your prior Consent. You may withdraw your Consent or object to these processing activities at any time.

More information

Additional information on the processing of your personal data for our legitimate business interests:

To ensure the efficient and secure provision of our solution. In addition to the personal data that you or your Organization provide to us when logging in to your user account or when you interact with Silex or post content, we automatically collect technical information about your interactions with Silex, such as your IP address, the date and time of access, information about your web browser, your preferences and other information relating to your interactions with Silex, including your browsing information on Silex.

We process this data to establish a connection with your device over the internet, to identify you when you use Silex, to monitor the use of Silex and to manage its stability and security.

To protect the security of our IT systems, architecture and networks. We use data to protect the security of our IT systems, architecture and networks, for example to detect and prevent the operation of malware by analyzing content in a systematic and automated manner.

• For internal analysis and statistical purposes, to improve our Services. Unless you object to such processing, we may process your personal data, in particular data relating to your use of the Services and your habits and preferences, for example the content you have viewed, the date and time of access and your preferences, for internal analysis and statistical purposes, in order to better understand our users’ needs, optimize their experience and improve the usability and functionality of the Services in general. You may object to such processing activities at any time (see section 13 for further information on your rights).
• In this context, we use analytics tools provided by well-known providers on the market, including audience measurement tools. The data protection policy of these service providers applies in this context.

Further information on the use of cookies for this purpose, including how long the data collected is retained, can be found in our Cookie Notice. Data collected by other means is deleted or anonymized 30 days after collection.

Anonymization of data. We may combine your personal data with other information, aggregate it or remove any information that could identify you, or anonymize it, so that it is no longer considered personal data under applicable data protection law. In this case, this Privacy Policy will no longer apply to such data and we may use it for purposes not provided for in this Privacy Policy, for example for analytics, benchmarking, data mining or to develop and market new services. You may object to the anonymization or aggregation of your personal data for this purpose at any time (see section 13 below for further information on your rights).

To send you our newsletter and other promotional information.

If you subscribe to our newsletter, we collect your contact details, namely your name and email address, and use them to send you our newsletter, on the basis of your consent. You may unsubscribe from the newsletter service at any time, in which case your contact details will be deleted.

We also keep the date and time of your subscription and consent, on the basis of our legal obligation to be able to demonstrate compliance with applicable requirements. We also analyze your use of our newsletter, for example whether you have opened it or clicked on certain links, and process this data to optimize and improve our newsletter, on the basis of our Legitimate Interest.

Independently of your newsletter subscription, if you have subscribed to our Services, we may use the email address you provided to us at that time to inform you about our activities and similar services. You may object to this use when your email address is collected and at any time thereafter, in particular by using the unsubscribe link included in each of our emails or by contacting us (see contact details in section 14). This processing activity is based on our Legitimate Interest in promoting certain offers and activities of our company to our existing clients or users.

To comply with our legal obligations or for other Legitimate Interests.

We may also process your personal data where we are legally required to do so or for other legitimate reasons. This will be the case, for example, if we need to disclose certain information to authorities, retain it for tax or accounting purposes, or use it for the establishment, exercise or defense of legal claims. The personal data we process for this purpose is the data we have collected for one of the purposes set out elsewhere in this section 6. We retain personal data for the duration of the legal obligation imposed on us.

7. Our activities with your Organization

If you are an end user of a Service that we provide to your Organization, or if we otherwise process your personal data on behalf of your Organization, for example if you are not a user but your personal data is provided to us by your Organization, please read the following:

• In the situations described above, our processing of your personal data is governed by a contract between us and your Organization. We will process your personal data as a processor in order to provide our Services to our clients or, in certain cases, as a controller for our legitimate business operations related to the provision of those Services, as detailed in this Privacy Policy.
• The Privacy Policy does not address how your Organization collects and uses your personal data or how we process your data when we act as a processor for your Organization. Please refer to your Organization’s data protection policy for information on its processing activities.
• Certain information about you may be provided to us directly by your Organization. In this case, it is your Organization’s responsibility to ensure that your personal data is collected and transferred to us in accordance with all applicable laws and on the basis of an appropriate legal ground.
• If you have any requests or questions regarding our processing of your personal data on behalf of your Organization, please contact your Organization directly. For example, if you wish to request access to, correction, amendment or deletion of inaccurate personal data originally provided by your Organization, please address your request to your Organization. If your Organization asks us to delete your personal data, we will act on that request as soon as possible and in accordance with the applicable legal framework.
• If you have any questions about our legitimate business operations related to the provision of our Services to your Organization, please contact us as set out in section 14.
  

8. Under what circumstances do we share your personal data with third parties?

We may disclose your personal data to third parties where this is necessary for the provision of the Services or for other legitimate reasons.

• Service providers. We may disclose your personal data to processors to the extent strictly necessary for the operation of the Services. Each of them is bound by a data processing agreement (DPA). They are: (i) Infomaniak (Switzerland, Geneva), for storage of the database, documents and encrypted backups: all persistent data, in encrypted form; (ii) Microsoft Azure (Azure Switzerland North, Zurich), for computing, application processing and AI inference: account data (last name, first name, email, position, telephone number), feedback, as well as queries and documents submitted to Silex, processed in memory only and never stored on Azure; (iii) HubSpot, for customer relationship management (CRM): last name, first name, email, position, telephone number, billing address and communication history; (iv) Resend, for sending transactional emails: last name, first name and email; (v) Stripe, for payments: last name, first name, email and billing address. No Client Data is used to train or fine-tune AI models. The countries and safeguards applicable to any transfers are set out in section 9.
• Events. If you register for events that we organize, the providers we engage to organize them will have access to the information necessary to provide their services.
• Your Organization. If you use a Service that we provide to your Organization, we share certain data with it, such as interaction data and diagnostic data, to enable it to manage the Services.
• Legal necessity. We may also disclose your personal data where we have a legal obligation or a legitimate interest to do so, for example (i) to respond to a request from a judicial authority or in accordance with an obligation imposed by law; (ii) to bring or defend a legal claim; or (iii) in the context of a restructuring, in particular if we transfer our assets to another company.

9. Under what circumstances is your personal data transferred abroad?

Persistent data, including the database, documents and encrypted backups, is stored exclusively in Switzerland with Infomaniak in Geneva. Azure Switzerland North in Zurich is used solely for computing, application processing and AI inference; no data is stored there.

As some of our processors are companies established or controlled abroad, personal data may be made accessible outside Switzerland. Such disclosure only takes place to a country recognized as providing an adequate level of protection, or subject to appropriate safeguards, in particular standard contractual clauses. The safeguards applicable to each processor are as follows:

1. Infomaniak (Switzerland, Geneva): no transfer abroad;
2. Microsoft Azure (Azure Switzerland North, Zurich; operated by Microsoft, a US company): standard contractual clauses incorporated into Microsoft’s DPA. LLM inference involves a temporary in-memory decryption window, during which residual exposure to the US CLOUD Act remains; a migration to Swiss GPUs is planned for 2027;
3. Stripe (United States): certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses;
4. Resend (United States): standard contractual clauses provided for in Resend’s DPA;
5. HubSpot (account hosted in the European Union, in Frankfurt; HubSpot Inc., United States): certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses.

You may obtain further information and a copy of the relevant safeguards by contacting us at the address set out in section 14.

10. How long do we keep your personal data?

Your data is not kept longer than necessary. We delete or anonymize your personal data as soon as it is no longer necessary for the purposes set out in section 6 above. This period varies depending on the type of data concerned and the applicable legal requirements. Further information for each type of processing can be found in section 6.

Information relating to your user account is retained for as long as your account is active. It is deleted within a maximum of 14 days after an explicit deletion request or the closure of the account, unless the law requires it to be retained. Residual copies in encrypted backups are purged 14 days after actual deletion. Technical logs are kept for 30 days and then permanently deleted. Where we act as a processor, data may be retained for the period provided for in the contract concluded with your Organization, subject to applicable legal obligations.

Due to our legal obligations, certain information relating in particular to the contractual relationship must be retained for at least 10 years.

11. What security measures are in place?

We are committed to ensuring the security of your personal data and have put in place physical, technical and organizational measures to protect it and prevent unauthorized access. Where possible, we use two-factor authentication methods. We restrict access to your personal data to those who need access for the purposes described in this Privacy Policy. In addition, we use standard security protocols and mechanisms for the transmission of sensitive data. When you enter sensitive information on our solution, it is encrypted using Transport Layer Security (TLS) technology.

Although we take appropriate measures to protect your personal data, no digital service is completely secure. Consequently, we cannot guarantee that the data you provide to us is protected against any unauthorized access or theft by third parties. We accept no liability in this respect.

The internet is a global environment. Consequently, when you send us information electronically, that data may be transferred internationally over the internet depending on your location. The internet is not a secure environment and this Privacy Policy applies to our use of your personal data only once it is under our control. Given the nature of the internet, any transmission of data via the internet is at your own risk.

If we have reasonable grounds to believe that an unauthorized person has accessed your personal data, we will promptly inform you of this event by email, if we have your address, and/or through any other appropriate communication channel, including by posting a notice on Silex, in accordance with applicable legal requirements.

How do we use cookies or other analytics tools?

We and our third-party service providers use cookies and other similar technologies (“Cookies”) in connection with our Solution in order to provide our Services, ensure that they function properly, analyze our performance and personalize your experience. These technologies may automatically process data on your electronic device and/or transfer personal data about you to us or to third parties.

Please see our Cookie Notice for further information on our use of Cookies and how you can control them.

12. Data breach notification and impact assessment

In the event of a data security breach likely to result in a high risk to the personality or fundamental rights of the data subjects, we will notify the competent supervisory authority as soon as possible in accordance with applicable law, and will inform the data subjects where required under such law.

Where our processing activities are likely to result in a high risk to the personality or fundamental rights of the data subjects, we carry out a data protection impact assessment in accordance with applicable law.

13. What are your rights regarding the processing of your personal data?

You have the right to access the personal data we process about you and may, in particular, request that it be deleted, updated or corrected.

If you use a Service provided by your Organization, you must address your requests regarding our use of your personal data on behalf of your Organization directly to the contact person designated by your Organization, including any request to exercise your rights regarding your personal data (see section 7).

In other cases, you may contact us directly to exercise your rights. Unless otherwise provided by law, you have the right at any time to know whether we process personal data about you, to know its content and verify its accuracy and, to the extent permitted by law, to request that it be completed, updated, corrected or deleted. You also have the right to ask us to stop any specific processing of personal data that may have been obtained or processed in breach of applicable law, and to object to any processing of personal data based on a legitimate interest. However, if you are not a user of our Services, you must address to your Organization any request relating to its use of your personal data, including any request to exercise your data protection rights.

If you have a user account, you can view, update, correct or delete the personal data available in your user account.

If you ask us to delete your personal data from our systems, we will act on your request within a maximum of 14 days, unless we are required to retain your data for a legal reason or another legitimate reason. Residual copies in encrypted backups are purged 14 days after actual deletion.

Where we rely on your Consent to process your personal data, we obtain your free and specific Consent by providing you with information that is as precise as possible. You may withdraw your Consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

The above does not limit any other rights you may have under applicable data protection law in certain circumstances.

Additional information

In particular, if the GDPR applies to the processing of your personal data, the GDPR grants you certain rights as a data subject where the applicable conditions are met:

• Right of access (Art. 15 GDPR) - you have the right to access your personal data and to request copies of it from us.
• Right to rectification (Art. 16 GDPR) - you have the right to ask us to rectify personal data that is inaccurate. You also have the right to ask us to complete information that is incomplete.
• Right to erasure (Art. 17 GDPR) - you have the right to ask us to erase your personal data in certain circumstances.
• Right to restriction of processing (Art. 18 GDPR) - you have the right to ask us to restrict the processing of your personal data in certain circumstances.
• Right to data portability (Art. 20 GDPR) - you have the right to ask us to transfer the personal data you have provided to us to another organization or to you, in a structured, commonly used and machine-readable format, in certain circumstances.
• Right to object (Art. 21 GDPR) - you have the right to object to the processing of your personal data based on our Legitimate Interest, in certain circumstances. In that case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.

As a rule, no fee is charged for exercising the rights listed above and we respond to requests within one month.

Further details on your rights for each processing activity we carry out can be found in sections 5 and 6 of this Privacy Policy. If you wish to exercise any of your rights or obtain further information about them, please contact us using the contact details set out below (see section 14).

You have the right to lodge a complaint with the competent authority.

If you are not satisfied with the way we process your personal data, you may, in addition to the rights described above, lodge a complaint with the competent data protection supervisory authority, in particular in the Member State of your habitual residence or place of work, or in the State where the alleged infringement took place.

Although this is not mandatory, we recommend that you contact us first (see section 14), as we may be able to address your request directly.

14. How to contact us?

If you believe that your personal data has been used in a manner that is not consistent with this Privacy Policy, or if you have any questions regarding the collection or processing of your personal data, you may contact us at data@silex.legal.

15. Changes to this Privacy Policy

The Privacy Policy may be amended, in which case you will be informed of any changes affecting you regarding our processing of your personal data by any appropriate means, including by email and/or via Silex, for example by means of banners, pop-ups or other notification mechanisms. If you do not accept the changes made, you must stop accessing and/or using the Service concerned.

Last updated: October 8, 2026.