Privacy policy
This is a convenience translation. Only the German version is legally binding: German version
This site loads nothing from third-party servers, sets no cookies without a login, and does not measure audience reach. The data that nevertheless arises is listed here in full.
1 · Who is the controller
xl0g UG (haftungsbeschränkt)
Osterkamp 15, 21502 Geesthacht
Represented by Michael Bibow
Email: [email protected]
xl0g does not appoint a data protection officer. The requirements of § 38 BDSG are not met.
2 · What visiting this site leaves behind
Every request creates an entry in the server log. It contains the IP address, the time, the requested address, the status code, the amount of data transferred, the referring page and the browser identifier.
The entry safeguards operations: it reveals faults, misconfigurations and attacks. The legal basis is the legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR).
The log is overwritten after 30 days at the latest, sooner when traffic is high. The server does not record access credentials in the first place: the fields Authorization, X-Api-Key, Cookie and Set-Cookie are removed before writing. These entries are not combined with other data.
3 · Delivery and hosting
Delivery. The site is delivered via Cloudflare. Cloudflare speeds up retrieval and fends off overload attacks. In doing so, Cloudflare processes the IP address and the technical details of the request. The legal basis is the legitimate interest in the availability and defensibility of the site (Art. 6(1)(f) GDPR). Cloudflare may also process data in the USA; the transfer is safeguarded by standard contractual clauses and certification under the EU-US Data Privacy Framework. The contracting party is Cloudflare Germany GmbH. Here, too, a data processing agreement under Art. 28 GDPR is in place; it will be issued to the company upon registration.
The browser reports failed connections to a Cloudflare reporting service (Network Error Logging). Technical details of the connection error and the IP address are transmitted.
Hosting. The site and the application run on a server in Germany, operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, data centre in Berlin. A data processing agreement under Art. 28 GDPR is in place; it will be issued to the company upon registration.
4 · Fonts and embedded content
The site uses the fonts Inter and JetBrains Mono. Both are stored on the xl0g server and loaded from there. No connection to Google Fonts or any other third-party font service is made. The site does not embed videos, maps, social plugins or advertising networks.
5 · Contact and newsletter form
xl0g receives enquiries through the forms on the home page. What is stored is your information from the form — name, company, email address, shipment volume, segment, message and language — as well as the IP address and the browser identifier at the time of submission. The last two items limit abuse: they show whether the same source is hitting the form in bulk.
The legal basis for the enquiry is the initiation of a contract (Art. 6(1)(b) GDPR); for the IP address and browser identifier it is the legitimate interest in preventing automated submissions (Art. 6(1)(f) GDPR). For the newsletter it is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time by email to [email protected], without affecting the lawfulness of the processing carried out until then.
The enquiry is additionally forwarded as a notification to the xl0g mailbox.
6 · Contact by email
If you write directly by email, xl0g processes the information in your message — sender address, name, content and anything you add yourself — in order to reply. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) and otherwise the legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).
xl0g deletes enquiries that lead to no business outcome after 12 months. If the enquiry leads to a contract, the retention periods under commercial and tax law of six and ten years respectively apply.
Sending and receiving runs via IONOS SE.
7 · What the browser stores
The site remembers two settings in your browser’s local storage: the selected language and the choice between light and dark display. Both values stay on your device, are not sent to the server and serve display purposes only. You can delete them via your browser settings.
8 · Access to the customer area
The login path leads into the xl0g application. Only upon login does the application set a cookie named session_token. It maintains the session, is bound to HTTPS, is not readable by scripts in the browser and is deleted on logout. Without this cookie the login does not work; it is therefore strictly necessary within the meaning of § 25(2) No. 2 TDDDG and requires no consent. For the session, the application stores the IP address in order to detect a stolen session.
For processing within the application, the agreement with the respective customer applies.
9 · Access by automated visitors
xl0g counts how often AI agents and search services call the public interfaces. Only three items are stored: the day, the name of the agent and the type of endpoint, plus a counter. Neither IP address nor browser identifier is stored. The assignment happens at the moment of access and cannot be resolved afterwards.
10 · What does not take place
11 · Who receives the data
IONOS SE, Elgendorfer Straße 57, 56410 Montabaur — operation of the servers.
Cloudflare — delivery and attack defence, standard contractual clauses, EU-US Data Privacy Framework.
IONOS SE — email traffic.
There are no other recipients. xl0g discloses data to authorities only when a law requires it.
12 · How long data is stored
Server log — 30 days at the latest.
Form and email correspondence without a contract — 12 months.
Form and email correspondence relating to a contract — 6 or 10 years respectively under commercial and tax law.
Counters of automated access — indefinitely, without personal reference.
13 · Your rights
You have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing that is based on a legitimate interest (Art. 21).
An email to [email protected] is sufficient. xl0g replies within one month.
Any data protection supervisory authority accepts complaints, in particular the one at the seat of xl0g: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Postfach 71 16, 24171 Kiel, telephone 0431 988-1200, [email protected].
14 · Last updated
This policy applies from 21.10.2026. If the site changes, the policy changes with it; the date here shows the current version.