Legal
Privacy Policy
Effective June 29, 2026. Last updated June 29, 2026.
1. Introduction and Scope
XKM Solutions LLC (“Advexus,” “we,” “us,” or “our”) operates the Advexus AI™ cross-selling intelligence platform (the “Service”). This Privacy Policy explains how we collect, use, store, and protect information in connection with the Service.
This Policy applies to: (a) law firms and professional services organizations (“Firms”) that subscribe to the Service; (b) attorneys, associates, business development professionals, and administrators who use the Service as authorized Firm Users; and (c) visitors to the Advexus AI marketing website at advexus.ai.
By accessing or using the Service, the Firm and its Firm Users agree to the practices described in this Policy. If the Firm does not agree to this Policy, it must not permit its personnel to use the Service.
2. Special Notice Regarding Attorney-Client Privilege
Advexus AI is designed to operate exclusively on non-privileged business data: client names, matter identifiers, billing records, practice group assignments, and relationship metadata. The Service does not ingest, process, store, or analyze privileged attorney-client communications, legal memoranda, work product, or case strategy documents.
Firms are responsible for configuring their integrations to exclude privileged data from data feeds connected to the Service. We recommend that each Firm obtain a formal opinion from its ethics counsel regarding its specific integration configuration prior to go-live.
3. Data We Collect
3.1 Firm Data (Ingested from Source Systems)
When a Firm configures integrations with its practice management, billing, and CRM systems, we receive and process:
- Client names and organizational identifiers (e.g., entity names, client IDs)
- Matter identifiers, matter types, and practice area classifications
- Aggregate billing metrics, including: hours and fees billed, invoiced amounts, and matter status. Billing Data does not include individual time records, invoice-level detail, hourly billing rates, fee arrangements, billing descriptions, task codes, or payment and collections information
- Attorney and professional staff names, practice group assignments, and origination records
- CRM contact and account data, including contact names, titles, and relationship history (where integrated)
- Industry classifications and geographic market data associated with client records
This data is referred to collectively as “Firm Data.” We process Firm Data solely as a data processor acting on the Firm's instructions.
3.2 Account and Registration Data
When setting up and administering accounts, we collect:
- Firm Administrator name and contact information
- Firm User names, email addresses, and assigned roles
- Authentication credentials (stored in hashed form)
- Billing and payment information (processed by our payment processor; not stored on our servers in unencrypted form)
3.3 Usage Data
We automatically collect information about how Firm Users interact with the Service:
- Actions taken within the platform (e.g., opportunity views, filter settings, pitch acceptances, training module completions)
- Session timestamps, session duration, and feature engagement metrics
- IP addresses, browser type, operating system, and device identifiers
- Error logs and performance telemetry
3.4 Demo Request and Website Contact Data
When a visitor submits a demo request or contact form on our marketing website, we collect the information provided in the form, including name, firm name, email address, practice area, firm size, and any message content submitted.
3.5 Integration Credentials
To connect to the Firm's source systems, the Firm provides API keys, OAuth tokens, or other integration credentials. These credentials are encrypted at rest and in transit and are used solely to enable the integration with your firm's systems. We do not use these credentials to access systems outside the scope of the configured integration.
3.6 AI Interaction Data
When Firm Users interact with AI-assisted content in the Service, all personal information is anonymized before transmission to our AI infrastructure provider. Client names, attorney names, and other identifying information are replaced with opaque tokens; the AI model does not receive real names or other direct identifiers. We log AI interaction activity for quality assurance, error monitoring, and Service improvement purposes. These logs are subject to the same retention and deletion obligations as other Firm Data.
4. How We Use Your Data
We use the data described in Section 3 for the following purposes:
- Delivering the Service: analyzing Firm Data to identify and surface cross-selling opportunities and provide contextual guidance to users
- Account management: provisioning and managing user accounts, authentication, and role-based access control
- Service improvement: analyzing usage patterns, diagnosing errors, and improving platform features using anonymized and aggregated data
- Communications: sending transactional notifications (e.g., new opportunity alerts, account updates), product announcements, and support communications
- Security and compliance: detecting unauthorized access, preventing fraud, and meeting our legal obligations
- Billing and payment: processing subscription fees and maintaining financial records
- Legal defense: establishing, exercising, or defending legal claims
We do not use Firm Data to train AI or machine learning models without the Firm's explicit written consent. We do not use AI-generated outputs that contain personal data for any purpose other than delivering the Service to the applicable Firm. We do not sell, share, or disclose Firm Data or personal data to third parties for cross-context behavioral advertising, targeted advertising, or any other commercial purpose unrelated to the delivery of the Service. In the preceding twelve (12) months, we have not sold or shared personal information with third parties for the purposes of personalized advertising, and we do not sell personal information pertaining to minors under the age of 16.
5. Data Storage and Retention
5.1 Storage Location
Firm Data is stored in the United States on cloud database and edge delivery infrastructure provided by Supabase and Cloudflare. We do not store Firm Data in jurisdictions outside the United States except as necessary to fulfill integrations explicitly configured and authorized by the Firm.
5.2 Retention During Active Subscription
We retain Firm Data for the duration of the active subscription term plus any grace period following non-renewal.
5.3 Retention After Termination
Following termination or expiration of the subscription, we retain Firm Data for a maximum of 30 days after the Firm's confirmation of export receipt, after which it is securely deleted. See Section 13 of the Terms of Service for the complete data handling upon termination process.
5.4 Usage and Log Data Retention
Usage logs and error telemetry are retained for up to 12 months for diagnostic and security purposes, after which they are deleted or anonymized.
5.5 Data Retention Criteria
To determine the appropriate retention period for Firm Data and personal information, we consider applicable laws, the volume and nature of the data, the purposes for which it was collected, and the potential risk of harm from its unauthorized use or disclosure. If we do not have a continuing business purpose or legal basis for retaining personal information, we will delete or anonymize it.
6. Third-Party Subprocessors
We use the following third-party subprocessors in the delivery of the Service:
Supabase
Role: Database infrastructure and authentication services. Supabase stores Firm Data, user accounts, and application state. Data is stored in the United States. Supabase is SOC 2 Type II certified.
Anthropic
Role: AI infrastructure provider. Anthropic supports the delivery of contextual insights within the Service. Anthropic does not retain API inputs for model training purposes by default under its API terms. Data sent to Anthropic is encrypted in transit.
Cloudflare
Role: Edge network, content delivery, and DDoS protection. Cloudflare processes web traffic and may cache certain application responses at edge nodes globally. Cloudflare is SOC 2 Type II and ISO 27001 certified.
We maintain data processing agreements with each subprocessor. Subprocessors are not permitted to use Firm Data for their own commercial purposes. We will update this list when we add or remove subprocessors and will notify the Firm Administrator in advance of adding new subprocessors that process Firm Data.
7. Security Measures
We implement the following technical and organizational security measures:
- Encryption in transit: all data transmitted between the Firm's browsers, our servers, and subprocessors is encrypted using TLS 1.2 or higher
- Encryption at rest: Firm Data stored in our database is encrypted at rest using AES-256
- Multi-factor authentication: required for all Firm User accounts
- Role-based access control: access to Firm Data within the Service is restricted by the role assigned to each Firm User
- Logical data isolation between Firm accounts ensures that Firm Data is not accessible across Firm boundaries
- Audit logging: all access to Firm Data within the Service is logged with user identity, timestamp, and action taken
- Vulnerability management: we conduct periodic security reviews and address identified vulnerabilities in a timely manner
- Incident response: we maintain an incident response plan and will notify Firms of confirmed data breaches within 72 hours of discovery, where required by applicable law
8. Data Sharing and Disclosure
We do not sell, rent, trade, or share Firm Data or personal data for cross-context behavioral advertising, targeted advertising, or any other commercial purpose unrelated to the delivery of the Service. In the preceding twelve (12) months, we have not sold or shared personal information with third parties for the purposes of personalized advertising, and we do not sell personal information pertaining to minors under the age of 16. We disclose data only in the following circumstances:
- With authorized subprocessors as described in Section 6, solely to deliver the Service
- As required by law, regulation, court order, or legal process, provided we give the Firm prompt written notice where permitted by law
- In connection with a merger, acquisition, or sale of substantially all of our assets, provided the acquiring entity agrees to be bound by these privacy commitments
- With the Firm's explicit written consent for any purpose not described in this Policy
9. Cookies and Tracking Technologies
9.1 Marketing Website
Our marketing website (advexus.ai) uses session cookies necessary for website functionality. We do not currently use third-party analytics or advertising tracking technologies on the marketing website. We may add analytics in the future and will update this Policy accordingly.
9.2 Application
The Advexus AI application uses session cookies and local storage tokens necessary for authentication and session management. These are functional cookies that cannot be disabled without preventing use of the Service. We do not use advertising or behavioral tracking cookies within the application.
9.3 Do Not Track
We do not currently respond to “Do Not Track” browser signals or similar mechanisms. If a universal opt-out mechanism becomes required by applicable law, we will update this Policy to describe our response.
9.4 Third-Party Links
Our marketing website may contain links to third-party websites or services. We are not responsible for the content, privacy policies, or data practices of any third-party websites. We encourage you to review the privacy policy of any third-party website you visit. Your use of any linked website is at your own risk.
10. User Rights
10.1 Rights of Firm Administrators
Firm Administrators may access, correct, and delete Firm User account data through the administrative console. Firm Administrators may also request a full export of Firm Data at any time by contacting admin@xkmsolutions.com.
10.2 Consumer Privacy Rights
Depending on where you reside, you may have certain privacy rights including: the right to know what personal information is collected and how it is used; the right to request deletion of personal information; the right to correct inaccurate personal information; and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against any individual for exercising their privacy rights. We endeavor to respond to verified customer requests within forty-five (45) days of receipt. If we require additional time, we will inform you of the reason and extension period in writing. Requests to exercise rights may be submitted to admin@xkmsolutions.com.
11. International Data Transfers
The Service is operated from the United States. Firm Data is stored in the United States. If the Firm or any individual whose data is processed is located outside the United States, such transfer may be subject to applicable international data transfer laws. We will execute appropriate transfer mechanisms, including EU Standard Contractual Clauses and the UK International Data Transfer Addendum, upon the Firm's request. Contact admin@xkmsolutions.com for more information or to obtain a copy of applicable transfer mechanisms.
12. Children's Privacy
The Service is not directed to individuals under the age of 18 and is designed for use by professional services organizations and their adult employees. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor, we will delete it promptly.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on our website and notify the Firm Administrator by email at least 30 days before the changes take effect. The effective date at the top of this Policy will reflect the date of the most recent update. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.
14. How to Contact Us
Questions, requests, or concerns regarding this Privacy Policy or our data practices may be directed to: