Processing location
GapPrivacy policy
LetX is operated from Bangladesh on cloud infrastructure the policy describes as “various regions (including Asia-Pacific)”. A specific region guarantee is not published, and there is no EU-residency commitment.
← LetX dossier
Procurement · Checked September 9, 2026
Adopting LetX at an institution.
This brief exists because a vendor pricing page is not a credible place to answer a data protection question. It sets out what LetX publishes about handling institutional data, and it names the things LetX has not published, because a reviewer will find those anyway.
Answer first
Who this is a fit for today.
LetX suits a department, lab, or course that wants unlimited collaborators without per-seat negotiation, a compile-tested template library, and an agent that validates its edits against the real compiler. Academic Pro is listed at $9 per month, and classroom, lab, department, and university licences are quoted directly.
It is not yet a fit for an institution whose procurement requires a signed data processing agreement, EU data residency, institutional single sign-on, or a contractual uptime commitment. None of those are published today. That is a straightforward statement of where the product is, not a hedge.
Data handling
Every position, and where it comes from.
Subprocessors
PublishedPrivacy policy
Named in the policy: Amazon Web Services (hosting, storage, database, transactional email), Cloudflare (DNS, CDN, delivery), Google and GitHub (optional OAuth sign-in), Zoho (support inbox), Lemon Squeezy (payments), and AI model providers when an opt-in AI feature is used.
Encryption
PublishedPrivacy policy
Encryption in transit over HTTPS and TLS, and encryption at rest for stored data.
AI training on documents
PublishedPrivacy policy and terms
“We never sell your work, and we never use your private documents to train AI models without your explicit, opt-in consent.” The terms of service repeat the commitment, which puts it in the contract rather than only in a policy page.
Retention and deletion
PublishedPrivacy policy
Data is kept while the account is active. On deletion, personal data and documents are deleted or anonymised within a reasonable period, except where legal, accounting, or security obligations require retention. Billing records persist.
Academic verification documents
PublishedPrivacy policy and terms
Transcripts and staff or student IDs submitted for Academic Pro are deleted within about a day of the decision. Approval lasts a year and is revocable if affiliation cannot be reconfirmed.
Subject rights
PublishedPrivacy policy
Access, correction, deletion, export of documents and data, and objection to or restriction of certain processing.
Data processing agreement
GapNot published
No DPA is published. An institution that requires a signed agreement has to request one directly, and should confirm what LetX can execute before committing to a rollout.
Availability commitment
GapTerms of service
The service is offered “as available” with no uptime guarantee, and users are told to keep their own backups. There is no published SLA.
Liability
PublishedTerms of service
Total liability is capped at the greater of the fees paid in the preceding twelve months or fifty US dollars, with indirect and consequential damages disclaimed.
Governing law
GapTerms of service
Bangladesh law, with exclusive jurisdiction in the courts of Dhaka. Institutions that require local jurisdiction or a specific governing law should raise it before procurement rather than after.
Single sign-on
GapPrivacy policy
Google and GitHub OAuth are supported for individual sign-in. Institutional SSO through SAML or Shibboleth is not published.
Quoted from the LetX privacy policy and terms of service as published on September 9, 2026. Policies change. Verify against the primary documents before signing anything.
Honest comparison
Where LetX wins, and where it does not.
Overleaf is the incumbent in most institutions, and inscrive.io competes specifically on procurement readiness. A comparison that only listed LetX strengths would be useless to the person who has to defend the decision internally.
| Requirement | LetX | Overleaf | Procurement-focused rivals |
|---|---|---|---|
| Unlimited collaborators on the free plan | Yes, on every plan | Overleaf limits free projects to one collaborator | Varies by vendor |
| Published per-seat academic price | $9 per month, $90 per year | Institutional pricing is quoted, not listed | Usually quoted |
| Compile-tested template library | 1,000+ across 20 categories | Large template gallery | Varies |
| Agent that compiles its own edits | Lexi, on paid plans | Error Assist explains and suggests fixes | Increasingly common |
| Hosted MCP server for AI clients | Yes, OAuth 2.1, 13 tools | No comparable public endpoint documented | Several vendors ship one |
| Signed DPA | Not published | Available | inscrive.io publishes one |
| EU data residency | Not offered | Available on some plans | inscrive.io publishes 100% EU residency |
| Institutional SSO | Not published | Yes | Common at this tier |
| Published uptime SLA | No | Yes on institutional plans | Common at this tier |
Competitor positions are taken from their own published pages as read on September 9, 2026. They are summaries of public marketing claims, not audited findings, and each should be confirmed with that vendor.
Verification
What to confirm before a rollout.
- 01
Ask which region holds your data
The policy names Asia-Pacific among others. If your institution has a residency requirement, get the specific region in writing before a pilot rather than after.
- 02
Ask whether a DPA can be executed
None is published. That does not mean none is possible, but it does mean the question has to be asked directly and answered before data protection review.
- 03
Confirm the AI training position in the contract
The commitment not to train on private documents without opt-in appears in both the privacy policy and the terms. Have it reflected in whatever you sign.
- 04
Decide how accounts are provisioned
There is no published institutional SSO. Plan for Google or GitHub OAuth, or individual accounts, and check that this satisfies your identity policy.
- 05
Run a real document through it
Compile the largest, ugliest document your department actually produces. The published typical compile is about six seconds, measured as a median over 12,700 compiles in 30 days, which is not a promise about a 400-page thesis.
- 06
Verify template accuracy with the receiving body
A community university or journal template is not an official artifact of that institution. Confirm the current class, margins, and bibliography style with whoever receives the submission.
Next
Talk to LetX about a department licence.
Classroom, lab, department, and university licences are priced directly rather than listed. If you are evaluating LetX for a group, the pricing page is the route to that conversation.