Privacy Policy

1. Who we are

Lexi Solutions Inc. (“we,” “us,” “our”) operates the Lexi Track platform (www.lexitrack.app), a shipment tracking notification service for e-commerce brands. Our business address is 1516 N 5th Street, Suite 2, Philadelphia, PA 19122, United States.

2. What this policy covers

This policy describes how Lexi Track processes data when delivering shipment tracking notification services on behalf of our business clients (“Clients”). Lexi Track operates as a data processor on behalf of our Clients, who are the data controllers. If you are a consumer who has opted in to receive shipment tracking notifications from a brand that uses Lexi Track, your primary privacy relationship is with that brand, not with us.

3. What data we process

Lexi Track is designed to minimize the data we process. For client integrations using our PII-free architecture, we process only:

• Pseudonymous subscriber identifiers (LexID) — opaque identifiers assigned by the client's messaging platform, not directly identifying without access to the source system
• Order numbers — business transaction references
• Tracking numbers — carrier package references
• Carrier codes — identifies the shipping carrier (e.g., FedEx, USPS, Yodel)
• Brand and region identifiers — identifies which client brand and geographic region the shipment relates to
• Shipment status events — carrier scan events such as shipped, out for delivery, delivered, exception

We do not process, store, or transmit:

• Email addresses
• Phone numbers
• Names
• Postal addresses (except where required by a specific carrier, e.g., postal code for Yodel UK tracking)
• Payment or financial information
• Health, biometric, or other sensitive personal information

4. How we use data

We process data solely to deliver the shipment tracking notification service contracted by our Clients:

• Receiving and matching consent signals with shipment signals to activate tracking on a per-order basis
• Monitoring carrier tracking status for activated shipments
• Forwarding tracking status events to the Client's messaging platform for delivery to the consumer

We do not use Client data for marketing, advertising, profiling, or any purpose beyond delivering the contracted service.

5. Data sharing

We share data only with the sub-processors necessary to deliver the service:

We do not sell, rent, or trade any data. We do not share data with advertisers or marketing platforms. A complete Sub-Processor Register (LSI-SPR-001) is maintained and available on request.

6. Data retention

• Temporary records (pending consents, unmatched shipments): automatically deleted after 30 days
• Activated tracker records: retained for the duration of the Client agreement plus 30 days
• On contract termination: all Client data is deleted within 30 days

Retention is enforced programmatically through automated daily processes, not manual review.

7. Data security

We protect data through:

• Encryption in transit (TLS 1.2+) on all communications
• Encryption at rest (AES-256) on all stored data
• Bearer token authentication on all API endpoints
• Tenant isolation enforced at the database query level
• Multi-factor authentication on all infrastructure accounts
• PII scrubbing on all application logs
• Centralized error monitoring and uptime monitoring

For full details, see our Information Security Policy (LSI-ISP-001), available on request.

8. Your rights

If you are a consumer whose data may be processed by Lexi Track on behalf of one of our Clients, you should contact the Client (the brand you purchased from) to exercise your privacy rights. As a data processor, we will assist our Clients in responding to data subject requests including:

• Right to access your data
• Right to correction of inaccurate data
• Right to deletion of your data
• Right to restrict processing
• Right to data portability

If you need to contact us directly regarding a privacy concern, you may reach us at the address below.

9. International data transfers

Lexi Track's infrastructure is hosted in the United States. If you are located outside the United States (including the United Kingdom or European Economic Area), data processed through Lexi Track may be transferred to and stored in the United States. Where applicable, appropriate safeguards for international transfers are addressed in our Data Processing Agreements with Clients.

10. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page indicates when the policy was last revised. Material changes will be communicated to affected Clients.

11. Contact