Privacy and legal in your account

The Legal and data page brings together the versions of the legal texts, the data processing agreement with its list of sub-processors, the technical and organisational measures, an overview of the data stored for your account, the data export, the accessibility statement and account deletion. In the app you reach it under Records › Legal and data, that is app.xicbot.de/recht.

Page layout

The page shows its cards in the order below. While the data is loading, it reads Loading …. The Technical and organisational measures and Accessibility statement cards come from a separate request and only appear once that request has answered. The wording of the agreement, the items of the annex and the texts of the accessibility statement exist only in German and appear in German in the English interface as well.

Who can do what

The roles rank in ascending order: Read, Edit, Administration, Owner. Triggering an action through the API with a role that is too low returns 403 with the error role_too_low and the required role in the required field. Every request on this page needs a signed-in user, an active account and a confirmed email address. Roles are assigned under Team and roles.

Legal texts

The Legal texts card shows the current version of the Terms and conditions, the Privacy policy and the Data processing agreement, each as a date, currently 2026-09-28. The Read full text link opens the terms and the privacy policy on xicbot.de in the language of the interface. The data processing agreement itself can be read right in the next card.

Data processing agreement

At the top, the Data processing agreement card shows the agreement Version and Accepted on with date and time, or a dash if it has not been accepted. After acceptance, Accepted version and Accepted by follow. If the user account of the person who accepted has since been removed, the card says Account removed; if no value was stored at all, it says not recorded. The name stays visible after a user is deleted, because the acceptance is a fact of the past.

Under Contract text you find the wording of the agreement: the title *Vertrag über die Verarbeitung personenbezogener Daten im Auftrag (Art. 28 DSGVO)*, the sentence stating that your account remains the controller within the meaning of Art. 4(7) GDPR, the Parties with Controller and Processor, followed by the individual sections. Company name and address of the controller are taken from your account's master data. The agreement applies for as long as the account exists and ends when it is deleted.

Accepting the agreement

1. 1

   Step 1

   Read the contract text

   Read the wording under Contract text and look out for messages about open points.

2. 2

   Step 2

   Accept

   As the Owner, click Accept the agreement. Other roles see the sentence The data processing agreement is accepted by the account owner. instead of the button.

3. 3

   Step 3

   Check the result

   The card shows Accepted on with date and time. On acceptance, the time, the version and the accepting person are stored, and the Audit log receives a dpa.accepted entry. This also applies when an older version was accepted and a new one now applies: the new acceptance replaces the time, the version and the person. If the current version has already been accepted, accepting it again changes nothing. The entry and the acceptance are stored together: if the entry cannot be written, the agreement keeps its previous state, that is unaccepted or on the older version, and you see Not saved: the entry in the audit log could not be written. Please try again.

The button is disabled while another action on the page is running, while no contract text is available, when the wording and the version number do not match, and while details from the operator are still open in the agreement.

Sub-processors

The Sub-processors card shows the List version and, under Confirmed by you, the version your account last confirmed, or a dash if none. The table lists Service provider, Purpose, Data, Location and Legal basis for each entry; anything operated in-house carries the Self-operated badge. The list is the same for every account.

If the confirmed version differs from the current one, the card shows The list has changed and is not confirmed yet. The Owner confirms with Confirm this version; the version is stored and the Audit log receives a dpa.accepted entry. Both are stored together; if the entry cannot be written, the previously confirmed version stays and you see Not saved: the entry in the audit log could not be written. Please try again. If the list changed while the page was open, the page reloads instead of showing an error. Confirming the list is independent of accepting the agreement and remains possible even while details are still open in the agreement.

While the list is not confirmed, the Administration role sees The account owner confirms the list version. Administration can object as well. The Read and Edit roles see The account owner confirms the list version. Objecting needs the Administration or Owner role.

Objecting

1. 1

   Step 1

   Open the form

   Click Object. The button appears for Administration and Owner while the list is not confirmed.

2. 2

   Step 2

   Enter the reason

   Fill in Reason for the objection. The field is required and needs at least 5 characters; an upper limit of 1000 characters is only set by the API. Spaces at the start and end are not counted and not sent. If fewer than 5 characters remain without them, the page sends nothing and shows no message either.

3. 3

   Step 3

   Submit

   After submitting, the page shows Your objection has been recorded. We will get back to you., the field is cleared and the form closes. The objection is kept as a record of its own, which does not expire with the audit log retention, appears in the export under subprocessor_objections and is deleted with the account; in addition there is a subprocessor.objection entry in the Audit log, which is visible from the Administration role upwards. The operator receives a notice with account, version and reason. Below the list the page then shows Objection lodged on … against version …. with We will get back to you., and after the operator has answered Answered on ….; the Object button no longer appears for this version. The confirmation only appears once the record and the entry have been written. If it could not be written, the page shows Not saved: the entry in the audit log could not be written. Please try again. instead, and your reason stays in the field so you can submit it again.

Technical and organisational measures

The Technical and organisational measures card shows the annex to the agreement. It opens with the sentence This annex belongs to the data processing agreement and describes what is actually in place. Items the operator has yet to fill in are marked as such and not as fulfilled. Below it you see the Annex version and the Version of the agreement it belongs to. The annex is part of the configuration and the same for every account.

• The items are arranged in four groups, shown under their German titles: *Vertraulichkeit* (confidentiality), *Integrität* (integrity), *Verfügbarkeit und Belastbarkeit* (availability and resilience) and *Verfahren zur Überprüfung* (review procedures).
• An item the operator still has to fill in carries the To be filled in by the operator badge. If there are such items, the card shows their number under Still to be filled in by the operator.
• Under confidentiality, the annex describes among other things the four roles in ascending rank and states that neither keys nor secrets appear in the data report or in an export.
• Under availability and resilience, it states that sign-in, export, key issuance, knowledge ingestion and conversation traffic each have their own rate limits, and that a limit that has been exceeded answers with the waiting time.

Stored data

The Stored data card carries the note The numbers come from the same query as the export. The table has one row per kind of data with Category and Count. If a number cannot be determined, the cell reads Not measured instead of zero, and below the table the card shows This value could not be determined and is therefore not a result. Kinds of data without a label of their own appear under their technical table name.

Coverage of the data catalogue

Export and deletion follow a data catalogue that lists every table holding account data, arranged in deletion order. Below the table, the line Coverage of the data catalogue shows the number of tables and the result of comparing the catalogue with the database: complete, no table missing, incomplete or, if the database could not be read, Not measured.

Retention periods

Under Retention periods you set a period in whole days for each type of object. The Administration and Owner roles can change them; for the Read and Edit roles the fields and the button are disabled, and the card shows Retention periods can be changed by users with the Administration or Owner role. Each change adds a retention.updated entry to the Audit log. The entry and the change are stored together; if the entry cannot be written, the previous periods stay and you see Not saved: the entry in the audit log could not be written. Please try again. The available fields, the permitted values, the defaults for a new account and when deletion takes place are covered in Retention and deletion.

Data export

The Data export card introduces itself with The export contains the stored data of your account as a JSON file. Credentials and their hash values, hash values of IP addresses and of blocked conversations, and internally derived values are left out; hash values over content, such as the consent wording, are included. If a section fails, the file marks it as failed instead of leaving it out; if one is shortened, the file says so. Files that visitors attached appear only as a list with name, type, size and checksum; download their content as a ZIP archive with “Download attachments”. Only the Owner sees the button; every other role reads The export contains every conversation in plain text and is therefore reserved for the account owner.

1. 1

   Step 1

   Start the export

   Click Export data. While the export is being created, the button reads Creating … and the other actions on the page are disabled.

2. 2

   Step 2

   Save the file

   The browser saves the file as xicbot-datenausfuhr.json. Then Export created appears, and the card shows Sections with the number of sections in the file. Export created only means that the file has been saved. Whether it is complete is stated in the card below the number of sections, either with Complete: every section is included, none is shortened, and the data catalogue covers every table. or with The export is not confirmed as complete. The reasons are listed below.

3. 3

   Step 3

   Check for gaps

   If a section failed, the card names it under Incomplete: these sections are missing. Tables from the data catalogue that no section contains are listed under These tables are not covered by the export. Below the message The export is not confirmed as complete., the card gives the reasons, among them Failed sections and Tables not exported with their number, Shortened for each shortened table with the table and both numbers, e.g. activities (5,000 of 5,003 entries), Not verifiable if the stored number could not be counted, Coverage of the data catalogue with incomplete or Not measured, and the number and size of files attached by visitors that are not in the file, for example 3 files attached by visitors (1.8 MB) are not in the file. Add them with “Download attachments”. Whether the export is complete or not, the card finally lists the withheld fields as table.field after Deliberately left out of the export because they are credentials, their hash values, hash values of IP addresses and of blocked conversations, internal storage paths, or internally derived values.

4. 4

   Step 4

   Download the attachments

   If visitors attached files, the Download attachments button appears below the report. It downloads a ZIP archive with every file under <conversation>/<id>.<extension> and the list manifest.json with ID, conversation, enquiry, name, type, size and checksum for each file. If a file is missing from storage, it is listed there with missing: true. Only the export file and the archive together contain the complete data.

Every export adds a privacy.export entry to the Audit log with the names of the sections in sections, the failed sections in failed, the tables not covered in unexported_tables the shortened tables in truncated_tables and the number of files attached by visitors that are not in the file in files_not_included. The attachment archive gets an entry of its own, privacy.export_attachments, with count, missing and bytes. The API allows 5 requests per minute per signed-in user; this limit is shared by export, retention periods, objections and deletion.

Structure of the export file

{
  "generated": "2026-09-28T10:15:00+00:00",
  "tenant": "example-ltd",
  "complete": false,
  "files_complete": false,
  "failed_sections": ["leads"],
  "unexported_tables": [],
  "catalog": { "tables": …, "measured": true, "reason": null, "complete": true, "missing_tables": [], "unknown_tables": [], "order_violations": [], "without_model": [] },
  "files": { "visitor_attachments": { "included": false, "count": 3, "bytes": 1887436, "measured": true, "reason": null, "download": "/api/v1/privacy/export/attachments" } },
  "sections": {
    "account": { "ok": true, "reason": null, "data": [ … ], "withheld": ["users.password", "users.remember_token", "users.totp_secret", …], "truncated": [] },
    "activities": { "ok": true, "reason": null, "data": [ … ], "withheld": ["activities.ip_hash"], "truncated": [{ "table": "activities", "exported": 5000, "stored": 5003, "measured": true, "reason": null }] },
    "leads": { "ok": false, "reason": "QueryException: …", "data": null, "withheld": [], "truncated": [] }
  }
}

• account contains every member of the account, including those currently working in another account, and lists for each user the email address, name, the role in this account, language, email confirmation, whether two-factor sign-in is active, creation time, last sign-in and the security keys with name, creation time and last use. Further columns of the users and security keys are included under their column names. The credential_id, credential_hash and public_key of a security key are not included.
• Columns the data catalogue marks as secret are left out of every section, for users for example the password, the remember-me token and the two-factor secret. If a secret sits in a JSON column, such as settings.token for tools, the file shows __set__ there if a value is set and an empty value otherwise. Columns the application computes from others, such as embedding and index_text of the knowledge chunks, are left out as well. Every section names these fields in withheld.
• Sections that take table rows as they are leave out the account identifier tenant_id and contain at most 20000 rows per table.
• activities contains at most 5000 entries and logins at most 2000, each in ascending order of time, so these are the oldest entries. If activities, logins or a section that takes table rows as they are contains fewer entries than are stored for the account, for example at one of these limits or at the limit of 20000 rows, truncated names the table with exported and stored, and complete is false. If the stored number cannot be counted, stored is null and measured is false; the section then still counts as shortened.
• Through the API, the response suggests the file name xicbot-ausfuhr-<short-name>-<date>.json and reports the number of sections, failed sections, uncovered tables and shortened tables in the x-sections, x-failed, x-unexported and x-truncated headers.

Accessibility statement

The Accessibility statement card is a self-declaration based on an internal assessment. It shows the Standard (WCAG 2.2 AA), the Conformance status (*teilweise konform*, that is partially conformant) and Assessed on (2026-09-05), followed by the sections How it was assessed, Scope, What is in place, Known limitations and Feedback and contact. The scope covers the admin interface at app.xicbot.de and the embedded chat window, but not the content you put into your knowledge base.

Report barriers to mail@xicbot.de. The same statement is available without signing in at app.xicbot.de/barrierefreiheit; the Accessibility link at the end of the card leads there, so you can pass the statement on without sharing a login. The accessibility aids of the interface are described in Appearance and accessibility.

Deleting the account

The Delete account card opens with All assistants, knowledge sources, conversations and messages are deleted irreversibly, the user accounts are anonymised. Anyone who still belongs to another account keeps their access and continues working there. Roles other than Owner only see Only the owner of the account can delete it. below it.

1. 1

   Step 1

   Type the word

   As the Owner, enter the word shown next to the required field Type this word to confirm, LOESCHEN, spelled exactly like that.

2. 2

   Step 2

   Delete

   The Delete the account permanently button only becomes active once the word matches and no other action on the page is running.

3. 3

   Step 3

   Sign-out

   After the deletion the page shows Your account has been deleted. You are being signed out. The app signs you out and shows the sign-in page. The message The confirmation word does not match. only appears if the API rejects the word; through the page this is hardly possible, because the button only becomes active once the word matches.

What happens during deletion

• First, the data catalogue is compared with the database. If it is empty or incomplete, deletion stops before anything is deleted.
• Next, the audit entry account.deletion (shown in the Audit log as Account deleted) is written with the count per category, the categories that could not be measured and the email address of the person who confirmed. If the entry cannot be written, deletion stops before anything is deleted, and you see Not saved: the entry in the audit log could not be written. Please try again.
• Users currently working in this account who still belong to another account that has not been deleted move there: to an account in which they are Owner, otherwise to the one they have belonged to longest, each time with their role there. They keep their user account and their email confirmations; their session tokens are deleted. Only users who belong to no other account are anonymised.
• For the remaining users of the account, session tokens, email confirmations, browser sessions, security keys and password links are removed, and so are all their memberships.
• The account data is then deleted table by table in catalogue order, for every table the catalogue marks for deletion, including conversations with their messages and tool calls, enquiries, appointments, handed-over carts, the block list, invitations and memberships.
• The remaining user accounts stay in anonymised form: name Gelöscht, email address geloescht-<number>@xicbot.invalid, a random password, no two-factor sign-in; they count as deleted.
• The account itself keeps an entry with the name Gelöscht and a new short name of the form geloescht-…, without billing email address or VAT ID, in the state deleted.
• Deletion runs in a single transaction. If the database aborts it because of concurrent access, because a row has changed in the meantime or two operations are waiting for each other, the whole run is repeated; there are at most three attempts.

API

Every action on the page is available under /api/v1/privacy/. How to authenticate is described in API: account; rate limits and the response when they are exceeded are covered in API limits.

Error responses

On the page, errors appear as a message. When there are too many requests, retention periods, the agreement, objections, deletion and the export show Too many attempts. Please wait a moment. For not_logged, retention periods, the agreement, objections and deletion show Not saved: the entry in the audit log could not be written. Please try again., and the export shows The export was not delivered: the entry in the audit log could not be written. Please try again. No file is saved in that case. If the service reports another server error during the export, the page shows The service reported an error. Please try again later.; if the export cannot reach the service, it shows The service is not responding right now. If the sign-in is no longer valid, the session ends and the sign-in page shows Your session has expired. Please sign in again.

Frequent questions