Privacy policy

Controller

Dmytro Yalanskyi Email: datenschutz@normapi.de

The postal address is given in the German privacy policy, which is the legally binding version.

Hosting

This website and the validation API are operated by Railway Corporation, 548 Market St PMB 68956, San Francisco, California 94104, USA, in the EU West region (Amsterdam, Netherlands). A data processing agreement under Art. 28 GDPR is in place.

The provider is established in the United States, so transfers of personal data to the USA cannot be excluded. Any such transfer is based on the Standard Contractual Clauses of the European Commission (Module Two, controller to processor) pursuant to Art. 46(2)(c) GDPR.

Invoice validation

Uploaded invoices are processed in memory only and discarded immediately after validation. Invoice content is never stored and never passed to third parties. The legal basis is Art. 6(1)(b) or (f) GDPR — performing the check you requested.

Server log files

When you load a page, the web server processes technically necessary access data: date and time, the page requested, HTTP status code, volume transferred, referrer, and user agent. This data is required for secure and stable operation. The legal basis is Art. 6(1)(f) GDPR — legitimate interest in operating the site securely. This data is not combined with any other source.

Ruleset-change notifications

On request, we email you when a new release of the XRechnung rule set is published. Sign-up is double opt-in: your address is stored only after you click the confirmation link. The legal basis is your consent under Art. 6(1)(a) GDPR, and you can withdraw it at any time — via the unsubscribe link in every email, or by writing to the address above.

We keep the list ourselves, on our own servers in the European Union. What is stored: your email address and the timestamps of sign-up and confirmation — the proof of consent Art. 7(1) GDPR requires. After you unsubscribe, your address is retained for one purpose only: so that we do not write to you again by mistake.

Delivery goes through Mailjet, a service of Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France. Processing takes place in the European Union; a data processing agreement under Art. 28 GDPR is in place. Click and open tracking are switched off: links in our emails go straight to their destination and are not routed through an intermediary.

Partner account (sign-in and API keys)

For design partners we offer an access-restricted account area. When you register and use it, we process: your email address, the sign-in method you chose, one-time login tokens (valid for 24 hours), and the API keys you create — of which we store exclusively a cryptographic hash, never the key itself. For accounting and abuse control we keep daily usage counters per key (endpoint, status code, request count); invoice content is never stored as part of this. The legal basis is Art. 6(1)(b) GDPR — providing the account within the design partner program.

Alongside those daily counters we keep a request log recording individual calls — key name, endpoint, status code, duration and timestamp. Its purpose is diagnosis: it lets a rejected call be traced, which a daily counter cannot do. No request or response bodies, no headers and no invoice data are stored in it. Entries are deleted after seven days.

Magic-link sign-in mail is sent through Mailjet, a service of Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France. This processes your email address and the one-time sign-in link; click and open tracking are disabled for these emails. We have a data processing agreement with the provider and processing takes place in the EU. If you choose to sign in with GitHub, GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, transmits the email address on your GitHub profile to us; GitHub's own privacy policy governs their processing.

Account data is stored until you delete the account. You can do that yourself at any time — in the account area under “Settings”, immediately and without asking us; keys, usage counters, the request log and the account record itself are removed. The same page exports your data as a JSON file (Art. 20 GDPR). An informal message to the address above of course still works.

Audience measurement

To understand which pages get used we run PostHog, in a cookieless mode. No cookies are set, and nothing is written to or read from the local storage or session storage on your device. Consent under § 25 TDDDG is therefore not required, and for the same reason this site has no cookie banner.

What is processed: the page you opened, the referrer, an approximate location at country level, device type and browser, plus a small number of events we have named ourselves — that an invoice was validated, with what verdict, and how many rules fired. No content from your invoice is transmitted: no field values, no file names, no fragment of the document. Your IP address is not stored. Visits are told apart using a hash computed on the server that changes daily, so there is no recognition of your device beyond the day.

The provider is PostHog, Inc., San Francisco, USA. Processing takes place on their EU cloud in Frankfurt am Main, under a data processing agreement per Art. 28 GDPR. The legal basis is our legitimate interest in data-minimising audience measurement, Art. 6(1)(f) GDPR. You may object at any time under Art. 21 GDPR; an informal message to the address above is enough.

Cookies

The public part of this website sets no cookies. The audience measurement described above works without cookies and without storing anything on your device. Fonts are served from our own server; no connection is made to Google Fonts or any other third party. Only the account area sets technically necessary session cookies for sign-in; there are no tracking cookies there either.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You also have the right to lodge a complaint with a supervisory authority. For any request, contact the email address above.