1. Who we are
NextStep Lex is a software platform that helps immigration law firms manage matters, prepare USCIS forms, collect supporting documents, and communicate with clients. Throughout this policy, “we,” “us,” and “NextStep Lex” refer to the operator of the Services. NextStep Lex is a technology provider. We are not a law firm, we do not employ attorneys, and we do not provide legal advice of any kind.
2. Information we collect
We collect the following categories of information:
- Account information — name, email address, firm name, role, and other details you provide when creating an account or contacting us (including through the waitlist form).
- Matter and client information — information you or your clients enter into the platform in connection with an immigration matter, including uploaded documents, form answers, communications, and case metadata. This information belongs to the attorney or firm who created the matter; we act as a service provider handling it on their behalf.
- Usage information — logs of how the Services are used (pages visited, features exercised, timestamps, IP address, browser and device information) collected automatically for security, reliability, and product improvement.
- Payment information — if you subscribe to paid Services, our payment processor collects billing details. We do not store full card numbers on our systems.
3. How we use information
We use the information described above to:
- Operate, maintain, and improve the Services.
- Provide the platform functionality that attorneys and firms rely on — including form generation, document validation, invoicing, and client communication.
- Communicate with you about your account, the waitlist, product updates, security notices, and support requests.
- Detect and prevent fraud, abuse, and security incidents; enforce our Terms; and comply with applicable law.
4. How we protect information
We use industry-standard technical and organizational measures to protect information on our systems, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), per-matter access scoping so each attorney only sees their own files, US-based cloud infrastructure, and continuous monitoring. Our full control set is aligned to the AICPA’s SOC 2 Trust Services Criteria — see the Security Vault for details. No system is perfectly secure, however, and we cannot guarantee that a determined attacker could not defeat our controls.
5. Data retention and deletion
We retain matter and client information for as long as an active engagement requires. After a case receives final approval and signature, the case and all related data are automatically deleted from our production systems within six hours. Backups follow a rolling retention window and are also purged on that schedule. Firms may also request early deletion of any matter at any time by contacting us at admin@nextsteplex.com.
6. Sharing and disclosure
We do not sell your information. We do not use client or matter data to train third-party AI models. We share information only in the following circumstances:
- Service providers we rely on to operate the Services (e.g. hosting, email delivery, payment processing, error monitoring). Each provider is contractually bound to protect the information and use it only for the purpose we engaged them for.
- Legal process — if we are required to disclose information in response to a subpoena, court order, or other lawful request. Where permitted, we will notify the affected firm before disclosure so they can pursue objections.
- Corporate transactions — if NextStep Lex is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction under equivalent protections.
7. Your choices
You may access, correct, export, or delete personal information we hold about you by contacting us at admin@nextsteplex.com. Firms remain the controllers of the matter and client information they enter into the platform and are responsible for responding to access, correction, or deletion requests from their own clients.
8. Children
The Services are intended for use by law firms and their professional staff and are not directed to children under 13. Where an immigration matter involves a minor as a beneficiary, the information is provided and controlled by the attorney handling the matter, not the minor.
9. International use
NextStep Lex is operated from and hosted in the United States. If you access the Services from outside the U.S., you consent to the transfer, storage, and processing of your information in the United States, where privacy laws may differ from those in your jurisdiction.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be posted here with a revised “Last updated” date. Continued use of the Services after a change becomes effective constitutes acceptance of the revised policy.
11. Contact
Questions about this Privacy Policy, or requests relating to your information, can be sent to admin@nextsteplex.com.