Privacy policy

1. Introduction

At Ex Nunc Intelligence SA (we, our or Ex Nunc), we recognize the importance of your privacy and transparency.

This data protection statement (Statement) describes how we process your personal data when you interact with our Silex solution, accessible via the web application at: https://app.silex.legal/ (Silex), or with the services we provide in this context (collectively with the provision of Silex, our Services). Silex is a SaaS (Software as a Service) solution that provides artificial intelligence services (research, chatbot, etc.) designed to assist legal professionals with their research and legal tasks.

By using our Services, you expressly acknowledge that we may process your personal data in accordance with this Statement.

This Statement is an integral part of and is incorporated into the Terms of Use for Silex (ToU). Capitalized terms not defined in this document have the meanings given to them in the ToU.

2. Summary version

The following summarizes, without replacing, the content of this Statement. We recommend that you read it in its entirety.

• Our role. We, Ex Nunc Intelligence SA, act as the controller of your personal data (for our own activities, but not those of third-party providers) (see section 3);

However, if we process your data to provide our services to an organization with which you are affiliated (your Organization), we generally act as a processor for your Organization. Please refer to your Organization's data protection policies for information on how it processes your data (see section 7);

• Data we collect. We collect the personal data that you provide to us, that your Organization transmits to us, or that third parties provide to us. We also automatically collect certain information when you interact with the Services (see section 4);

• How we use your data. We process your personal data in accordance with Swiss law and other applicable data protection laws. In particular, we only process your data when we have a legitimate reason to do so (see section 5) and only for specific reasons (primarily to provide our Services, operate Silex, and for other legitimate purposes described in this document) (see section 6);

• Hosting and transfers. We host your personal data in Switzerland and/or the European Union. We do not share it with third parties or transfer it abroad unless it is both necessary for the operation of our Services and permitted by applicable laws. This may be the case, for example, when we use service providers or need to interact with third parties to carry out our business activities (see sections 7 and 9);

• Retention. We do not retain your personal data longer than is necessary to achieve the purposes defined in this Statement (see section 1);

• Security. We implement appropriate security measures and strive to protect your personal data. However, no IT infrastructure is completely secure, and we cannot guarantee that ours is (see section 11);

• Your rights. You can contact us via the email address data@silex.legal to exercise your rights regarding your personal data (see sections 12 and 13).
  

3. Who is responsible for the processing of your personal data?

Ex Nunc Intelligence SA, EPFL Innovation Park, Bâtiment C, 1015 Lausanne, is responsible for the processing of your personal data. You will find our contact details below in section 13.

This Declaration applies only to the processing of personal data carried out by us or on our behalf. We may provide links to third-party websites, content, or services. However, we are not responsible for their data protection policies. The collection and use of your personal data by these third-party providers are governed by their respective data protection policies, which we recommend you read carefully.

As stated in more detail in this Declaration, we may process your personal data in the context of the professional services we provide to your employer, or to the organization to which you are otherwise affiliated (your Organization). This Declaration does not govern how your Organization processes your personal data through the Services. You should refer to your Organization's policies for information on how your data is processed in this context. Please refer to section 7 below for more information in this regard.

4. How do we collect your personal data?

We collect the personal data that you or your Organization provide to us.
We collect the personal data that you or your Organization provide to us when using the Services, for example when you use our Solution, create or manage a user account, fill out forms, subscribe to our newsletter, or participate in a transaction.

It is mandatory that you complete the data fields identified as such. If one or more mandatory data fields are not completed, we will not be able to provide access to the Services. You are not required to complete the optional data fields in order to access the Services. These fields can be completed later via your user account.

Certain information about you may also be provided to us directly by our users.
Even if you are not a user of our Services, we may collect certain information about you if it is provided to us by one of our users. This information may be transmitted via prompts submitted to Silex or via files uploaded to Silex by our users. The data collected depends entirely on the content that our users choose to submit or upload to Silex.

Certain personal data is also collected automatically, in particular to monitor the use of the Services.
We may also collect personal data automatically, including through cookies and other active elements such as an internal tracking system to monitor the use of the Services and determine their consumption, as described further in this Declaration.

You can define certain permissions regarding the automatic collection of your personal data when you configure your device or Internet browser according to the available features. [You can also set certain parameters for the automated collection of your personal data through the cookie settings plugin available on Silex.]

The data we process may contain sensitive data.
The information you provide may contain sensitive data about you, in particular data relating to criminal records, criminal convictions, court decisions, ongoing or past legal proceedings, health, political opinions, religious or philosophical beliefs, trade union membership, as well as biometric data or data concerning sex life or sexual orientation (Sensitive Data). This may be the case, for example, when a user submits legal documents, client files, or other content as part of using Silex. In particular, as our users are free to ask questions related to their cases, we may indirectly process, through their questions, personal data concerning convictions or any other sensitive data they have provided themselves.

We will process this Sensitive Data in accordance with applicable data protection laws and as stated in this Declaration.

5. How do we process your personal data?

We process your personal data in accordance with applicable laws and only if we have a valid reason to do so.
We process your personal data in accordance with applicable laws, in particular the Swiss Data Protection Act and, to the extent they apply to us, other data protection legislation, in particular the EU General Data Protection Regulation (GDPR), either manually or automatically using IT tools.

This means that we only process your personal data for specific reasons (see section 6) and only if we have a valid reason to do so.

6. For what purposes do we process your personal data?

To provide our Services and operate Silex
We primarily process your personal data to operate Silex and/or provide you with the Services, including enabling you to create and manage a user account.

For our legitimate business interests related to the provision of the Services, including ensuring the security of the Services, improving our Services, as well as for tracking or statistical purposes.
We may also process your personal data for our legitimate business operations related to the provision of our Services to (i) ensure that our Services are provided efficiently and securely (e.g., through internal analysis of the stability and security of the Services, updates, and troubleshooting); (ii) ensure the security of our IT infrastructure and networks; (iii) benefit from or use services necessary for the provision of our Services from third parties at a competitive rate (e.g., we may choose to use certain services offered by third-party providers rather than performing them in-house); (iv) improve and develop the Services (including monitoring the performance or use of the Services, as well as for statistical purposes).

In this context, we generally rely on our Legitimate Interests. We may also process your data if we have obtained your prior Consent. You may withdraw your Consent or object to these processing activities at any time.

To send you our newsletter and other promotional information.
If you subscribe to our newsletter, we collect your contact details (name and email address) and use them to provide you with our newsletter, based on your consent. You may unsubscribe from the newsletter service at any time, in which case your contact details will be deleted.

We also retain the time of your registration and consent, based on our legal obligation to demonstrate our compliance with applicable requirements. We also analyze your use of our newsletter, such as whether you opened it or clicked on certain links, and process this data to optimize and improve our newsletter, based on our Legitimate Interest.

Regardless of your newsletter subscription, we may contact you by email to inform you of our activities if you have previously purchased a similar service and have not opted out of the use of your email address for this purpose. You may object to the use of your email address for this purpose at any time by contacting us (see contact details in section 13). This processing activity is based on our Legitimate Interest in promoting certain offers and activities of our company that relate to our previous interactions with you.

To comply with our legal obligations or other legitimate interests.
We may also process your personal data if we are legally required to do so or for other legitimate reasons. This would be the case, for example, if we are required to disclose certain information to authorities, retain it for tax or accounting purposes, or for the establishment, exercise, or defense of legal claims. The personal data we process for this purpose is that which we have collected for one of the purposes indicated elsewhere in this section 6. We retain personal data for the duration of the legal obligation imposed upon us.  

7. Our activities with your Organization

If you are an end user of a Service that we provide to your Organization, or if we process your personal data for any other reason on behalf of your Organization (for example, if you are not a user, but your personal data is provided to us by your Organization), please read the following:

• In the situations described above, our processing of your personal data is governed by a contract between us and your Organization. We will process your personal data as a processor for the provision of our Services to our clients or, in some cases, as a controller for our legitimate business operations related to the provision of these Services, as detailed in this Statement.

• This Statement does not address how your Organization collects and uses your personal data or how we process your data when acting as a processor for your Organization. Please refer to your Organization's data protection policy for information on its processing activities.

• Certain information about you may be provided to us directly by your Organization. If this is the case, your Organization is responsible for ensuring that your personal data is collected and transferred to us in accordance with all applicable laws, based on an appropriate legal basis.

• If you have requests or questions regarding our processing of your personal data on behalf of your Organization, please contact your Organization directly. For example, if you wish to request access to, correct, modify, or delete inaccurate personal data originally provided by your Organization, please direct your request to your Organization. If your Organization asks us to delete your personal data, we will respond to that request promptly after verification and in accordance with the applicable legal framework (e.g., the 30-day period under Swiss law or the GDPR).

• If you have questions regarding our legitimate business operations related to the provision of our Services to your Organization, please contact us as indicated in section 13.
  

8. Under what circumstances do we share your personal data with third parties?

We may share your personal data with third parties if necessary for the provision of the Services or for other legitimate reasons.

• Service providers. We may share your personal data with third parties as part of our Service operations and with subcontractors such as IT service providers, cloud service providers, database providers, automated marketing solution providers, and consultants, including Microsoft Azure (cloud/storage), Hubspot (storage/CRM),  Resend (email delivery), Stripe (payments). More detailed information about these providers can be found in the previous chapter.

• Events. If you register for events that we organize, the service providers we use to organize them will have access to the information necessary to provide their services.

• Your Organization. If you use a Service that we provide to your Organization, we share certain data with your Organization, such as interaction data and diagnostic data, to enable it to manage the Services.

• Legal necessity. We may also disclose your personal data when we have a legitimate interest in doing so, for example (i) to respond to a request from a judicial authority or in accordance with a legal obligation; (ii) to initiate or defend a legal claim; or (iii) in the context of a restructuring, particularly if we transfer our assets to another company.
  

9. Under what circumstances is your personal data transferred abroad?

We host your personal data on servers located in Switzerland and/or the European Union.

In principle, we do not transfer or make your personal data accessible to other countries. However, in certain circumstances, particularly in the context of our relationships with subcontractors, your personal data may be made available to recipients located abroad (for example, in the United States, where some data may be available). In such cases, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws, for example by relying on standard contractual clauses adopted by the European Commission.

If you transmit data to us, you are deemed to consent to these data transfers. You may request additional information in this regard and obtain a copy of the relevant safeguards upon request by sending a query to the contact address indicated in section 13.

10. How long do we keep your personal data?

Your data is not kept longer than necessary. We erase or anonymize your personal data as soon as it is no longer needed for the purposes referred to in section 6 above. This duration varies depending on the type of data concerned and applicable legal requirements. You will find more information for each type of processing in section 6.

Information related to your user account is kept as long as your account is active. If you delete your user account, we will delete or anonymize your personal data within 30 days, unless the data must be retained for a legitimate reason. However, certain information about you may need to be retained for the duration of our contractual relationship with your Organization, even if your account is deleted (see section 7).

In view of our legal obligations, certain information, particularly regarding the contractual relationship, must be retained for at least 10 years.

11. What security measures are in place?

We are committed to ensuring the security of your personal data and have implemented physical, technical, and organizational measures to protect your personal data and prevent unauthorized access to it. We use two-factor authentication methods whenever possible. We limit access to your personal data to those who need it for the purposes described in this Statement. Furthermore, we use standard security protocols and mechanisms for the transmission of sensitive data. When you enter sensitive information on our Solution, it is encrypted using Transport Layer Security (TLS) technology.

While we take appropriate measures to protect your personal data, no digital service is completely secure. Consequently, we cannot guarantee that the data you provide to us is protected against all unauthorized third-party access and theft. We assume no liability in this regard.

The Internet is a global environment. Consequently, when you send us information electronically, such data may be transferred internationally over the Internet depending on your location. The Internet is not a secure environment, and this Statement applies to our use of your personal data only once it is under our control. Given the nature of the Internet, any transmission of data via the Internet is at your own risk.

If we have reasonable grounds to believe that an unauthorized person has accessed your personal data, and applicable law requires notification, we will promptly notify you of this event by email (if we have your address) and/or through any other communication channel (including by posting a notice on Silex).  

How do we use cookies or other analytical tools?

We and our third-party service providers use cookies and other similar technologies (Cookies) in connection with our Solution to provide our Services, ensure they function properly, analyze our performance, and personalize your experience. These may automatically process data on your electronic device and/or transfer personal data about you to us or to third parties.

You can consult our Cookie Notice for additional information on our use of Cookies and how you can control them.

12. Your rights regarding the processing of your personal data?

You have the right to access the personal data we process and may request, among other things, that it be deleted, updated, or corrected
‍ If you use a Service provided by your Organization, you must address your requests regarding our use of your personal data on behalf of your Organization directly to your Organization's contact person, including any requests to exercise your rights regarding your personal data (see section 7).

In other cases, you may contact us directly to exercise your rights. Unless otherwise provided by law, you have the right at any time to know whether we are processing personal data concerning you, to know the content of such personal data, to verify its accuracy, and to the extent permitted by law, to request that it be completed, updated, corrected, or deleted. You also have the right to ask us to stop any specific processing of personal data that may have been obtained or processed in violation of applicable law, and to object to any processing of personal data for a legitimate reason. However, if you are not a user of our Services, you must address your inquiries regarding the use of your personal data by your Organization directly to them, including any requests to exercise your data protection rights.

If you have a user account, you can view, update, correct, or delete the personal data available in your account.

If you ask us to delete your personal data from our systems, we will comply with your request, unless we are required to retain your data for a legal or other legitimate reason. Please note that any information we have saved may remain in backup storage for a certain period after your deletion request.

When we rely on your Consent to process your personal data, we will seek your free and specific Consent by providing you with information that is as precise as possible. You may withdraw your Consent at any time (without such withdrawal affecting the lawfulness of processing carried out prior to that point).

The foregoing does not limit any other rights you may have under applicable data protection laws in certain circumstances.  

You will find further details regarding your rights in sections 5 and 6 of this Statement in relation to each processing activity we perform. If you wish to exercise any of your rights or obtain additional information about them, please contact us using the contact details provided below (see section 13).

You have the right to lodge a complaint with the competent authority.
If you are not satisfied with the way we process your personal data, you may, in addition to the rights described above, file a complaint with the competent data protection supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Although not mandatory, we recommend that you contact us first (see section 13) as we may be able to address your request directly.

13. How to contact us?

If you believe that your personal data has been used in a manner that is not consistent with this Statement, or if you have questions regarding the collection or processing of your personal data, you may contact us at data@silex.legal

14. Changes to this Statement

This Statement may be subject to changes, in which case you will be informed of any modifications affecting the processing of your personal data by any appropriate means, including via email and/or through Silex (for example, by means of banners, pop-up windows, or other notification mechanisms). If you do not accept the changes made, you must stop accessing and/or using the affected Service.

Last updated: April 15, 2026.