Legal

Cookie Policy

What cookies we use on lex.law and in the Lex platform, and how to control them.

Last updated: 4 September 2026.

1. What are cookies?

Cookies are small text files stored on your device when you visit a website. They allow the site to remember information about your visit — such as your login session or your preferences — so you don't have to re-enter it every time. Cookies can be set by the site you are visiting ("first-party cookies") or by third-party services embedded in the page.

2. Cookies on lex.law (marketing site)

Cookie nameTypePurposeDuration
PHPSESSID Strictly necessary PHP session identifier. Maintains your session state while browsing, including the CSRF token used to protect forms against cross-site request forgery attacks. No personal data is stored in this cookie — it is a random identifier only. Session (deleted when browser closes)
lex_cookie_consent Strictly necessary Records whether you have acknowledged this cookie notice, so we do not display it on every page visit. 12 months

The marketing site (lex.law) does not use analytics cookies, advertising cookies, or any third-party tracking cookies. We do not use Google Analytics, Facebook Pixel, or any similar tracking technology. The only cookies set are the two functional cookies listed above.

3. Cookies in the Lex platform (app.lex.law)

Cookie nameTypePurposeDuration
PHPSESSID Strictly necessary Maintains your authenticated session in the Lex platform. Without this cookie, you cannot remain logged in. The session contains your user ID, firm ID, 2FA status, and role — stored server-side, not in the cookie itself. 8 hours of inactivity, then auto-expired
lex_2fa_verified Strictly necessary Records that you have successfully completed two-factor authentication for this session. This prevents you from being repeatedly challenged for 2FA within a single working session. Session
lex_csrf Strictly necessary CSRF protection token. Ensures that form submissions originated from within the Lex platform rather than from a malicious third-party site. Session

The Lex platform does not use any analytics, advertising, or non-essential cookies. All cookies in the platform are strictly necessary for security and authentication. They cannot be disabled without breaking your ability to use the platform.

4. Third-party services and cookies

The following third-party services are used by Lex. They may process data but do not set cookies in your browser:

  • Google Fonts — We load the Montserrat font from Google Fonts. Google may log the request. No cookie is set. To avoid this entirely, you can use a browser extension that blocks Google Fonts requests.
  • PowerTranz (payment gateway) — When you proceed to payment, you are redirected to PowerTranz's hosted payment page. PowerTranz may set cookies on their domain as part of their PCI-DSS compliant payment flow. You are subject to PowerTranz's privacy policy during the payment process.

5. How to control cookies

All major browsers allow you to manage cookies through their settings:

Please note that disabling the strictly necessary cookies listed in this policy will prevent you from using the Lex platform, as they are required for authentication and security.

6. Changes to this policy

We will update this policy if we introduce new cookies. Material changes will be communicated to active subscribers by email.

7. Contact

Questions about cookies: support@lex.law