APIs
API privacy notice
Version 1.0 of 10 November 2026
This English version is the binding one. The German translation is provided for convenience. For the website xmoo.app itself, the website privacy policy applies.
1. Who is responsible
Haag Automation, Julian Haag, Mühlstraße 35, 74360 Ilsfeld, Germany,
julian@haag-automation.com. This notice covers the
xmoo E-Invoice API and the xmoo Cable Sizing API at api.xmoo.app.
2. Content of your requests
Invoices you send to the E-Invoice API usually contain personal data, for example names, addresses, e-mail addresses, telephone numbers and bank details of the people named in them. We process this content only on your behalf and only to answer the request: in the server's memory, for the duration of the request. It is not stored, not written to any log, not passed on and not used for any other purpose, including training of AI models. For this processing you are the controller and we are your processor; the data processing agreement applies.
Requests to the Cable Sizing API contain technical values (power, length, installation method) and normally no personal data. They are processed in the same way.
3. Technical data
Each request reaches us through the RapidAPI gateway. Besides the content, it carries technical data: the IP address of the gateway, your RapidAPI user name and plan, and usually your own IP address in a forwarding header. We use these only to deliver the answer; our servers keep no access log, so none of it is stored.
Only technical error messages of the server software are logged (container logs, limited to a few megabytes and overwritten continuously). If an error occurs while a request is handled, the entry may contain the IP address of the connecting system; invoice content is never logged. Legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the APIs.
4. RapidAPI
You reach the APIs through RapidAPI, operated by Nokia of America Corporation, dba Rapid, USA. Your account, subscription and payment are handled by Rapid under your own agreement with Rapid and Rapid's privacy notice; Rapid processes the requests on its gateway, which may include servers outside the EU, in particular in the USA. For data Rapid processes on your behalf, Rapid's terms refer to its own data processing addendum. Please check whether this fits your requirements before you send invoices with personal data.
From Rapid we receive usage figures and payouts. Rapid does not pass on your e-mail address or other contact details to us.
5. Hosting
The APIs run on a virtual server (Hetzner Cloud) of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Helsinki, Finland (EU). A data processing agreement under Art. 28 GDPR is in place with Hetzner. Hetzner's backup copies of the server disk contain the programs only, no request data.
6. Contact and contract
If you write to us, we process your message and contact details to answer it and, where relevant, to perform the contract (Art. 6(1)(b) GDPR). We delete them when they are no longer needed, unless retention periods under tax or commercial law apply.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. You can also lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. For invoice content we process on behalf of our customers, please contact the customer who sent the invoice; we support them in answering such requests.