Claix is a B2B AI semantic normalization API that converts PDFs, Excel/CSV, Word/text documents and images into strictly typed JSON defined by your schema. Official site: https://www.claix.dev/en

What file formats does the Claix API support?

Claix supports Excel (.xlsx) and CSV, JSON to Excel export, PDF (text or scanned), .docx/.txt/.md/.rtf documents, and .jpeg/.jpg/.png/.webp/.heic/.heif images. Each format uses a dedicated endpoint and schema type.

How do I convert a PDF to JSON with Claix?

Create a pdf-json schema, obtain an API key, and send a multipart POST to https://www.claix.dev/api/pdf-json with file and schema_id fields and the x-api-key header. Documentation: https://www.claix.dev/en/documentation/pdf-to-json

What is Claix pricing?

Pay-as-you-go. The first 15 successful calls (HTTP 200) are free. Excel↔JSON is billed by variable volume (€0.25–€1.00). PDF→JSON €0.35, Doc→JSON €0.20, Img→JSON €0.10 per successful request. 4xx/5xx errors are not billed.

Does Claix offer an embeddable widget?

Yes. Claix provides a free unlimited iframe widget (https://www.claix.dev/widget/{id}), customizable and production-ready. JSON is delivered to the owner's HTTPS webhook; the API key is never exposed in the browser.

Where is the OpenAPI specification?

The OpenAPI 3 spec is at https://www.claix.dev/openapi.yaml. AI context summary: https://www.claix.dev/llms.txt and full knowledge base: https://www.claix.dev/llms-full.txt

Is Claix compatible with n8n and Make?

Yes. Use generic HTTP multipart or the n8n-nodes-claix community node. Guide: https://www.claix.dev/en/blog/integrar-claix-en-n8n

Is Claix GDPR compliant?

Claix offers EU-oriented processing, a public DPA at https://www.claix.dev/en/dpa, zero file retention for model training, and no training on customer documents.

DPA — Data Processing Agreement — Claix

Preamble

This Data Processing Agreement (hereinafter, the "DPA") is entered into between:

The Data Controller:The natural or legal person (developer, company, agency, or B2B entity) contracting Claix platform and API services pursuant to the General Terms and Conditions (hereinafter, the "Controller").
The Data Processor:ANAYA CARBALLO GAEL (tax ID NIF 51030923H, registered office at Ronda Sur 203, 3º 3ª Der, 28053 Madrid, Spain), owner of the Claix platform and brand (hereinafter, the "Processor" or "Claix").
Processor contact email: info@claix.dev

This DPA constitutes an integral and binding part of the Claix General Terms and Conditions of Use and governs the conditions under which the Processor will process personal data contained in files and API requests sent by the Controller, pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR) and Article 33 of Organic Law 3/2018 (LOPDGDD).

Specific details of processing activities, data categories, data subject categories, and security measures are described in Annexes A, B, and C of this DPA.

Contract Clauses

1. Purpose of the Processing Agreement

1.1.The purpose of this DPA is to regulate the Processor's obligations regarding processing of personal data contained in source files (.xlsx, .csv) and HTTP requests (Payloads) sent by the Controller through the Claix REST API or Control Panel (Dashboard), for standardization, semantic mapping via Artificial Intelligence, and conversion to structured JSON format.

1.2.The Processor shall process personal data solely in accordance with the Controller's documented instructions, including those derived from API request configuration and this DPA, unless required to do so by applicable Union or Member State law. In such case, the Processor shall inform the Controller before processing, unless the law prohibits it for reasons of public interest (Art. 28.3.a GDPR).

2. Controller Instructions

2.1. Documented instructions:Executing HTTP requests to the Claix REST API using the x-api-key header constitutes the Controller's express initial instruction for Claix to ephemerally process the submitted content.

2.2. Controller legitimacy guarantee: The Controller guarantees that it has obtained data subject consent or has an adequate legal basis (Art. 6 and Art. 9 GDPR) to submit data contained in files to Claix servers.

2.3. Duty to inform: If the Processor considers that a Controller instruction infringes the GDPR or any other European or national data protection law, it shall immediately inform the Controller (Art. 28.3 GDPR) and may suspend execution of the request.

3. Confidentiality Duty

3.1. The Processor guarantees that all personnel authorized to manage API infrastructure, code, and systems have expressly committed to respect confidentiality or are subject to a legal duty of secrecy.

3.2. Access to processing infrastructure is strictly limited to automated systems (Edge Functions) and essential technical personnel for Service maintenance.

4. Ephemeral Processing, No-Training Guarantee, and Security Measures

4.1. Ephemeral Processing (Zero Retention): Unless otherwise expressly stated in custom Enterprise contracts, files (.xlsx, .csv) and structured content processed by the Claix ETL engine are processed exclusively in volatile memory or temporary storage for the time strictly necessary to return the JSON HTTP response (200 OK). Upon completion of the transaction, temporary traces are deleted immediately and irreversibly.

4.2. AI Training Prohibition: The Processor expressly guarantees that content of files sent to the API is NEVER used to train, retrain, tune (fine-tuning), or evaluate public or third-party Artificial Intelligence models.

4.3. Security Measures (Art. 32 GDPR): The Processor shall apply the technical and organizational measures detailed in Annex B, aimed at ensuring:

Encryption in transit (TLS 1.3) and at rest (AES-256).
Multi-tenant isolation of Edge executions.
Resilience, availability, and infrastructure restoration in the event of incidents.

5. Sub-processors

5.1. General Authorization: The Controller grants general authorization to the Processor to engage cloud infrastructure, orchestration, and transactional delivery sub-processors (listed in Annex C), pursuant to Art. 28.2 GDPR.

5.2. Change Notification: The Processor shall notify the Controller of any planned addition or replacement of sub-processors at least fifteen (15) calendar days in advance. The Controller may object on data protection grounds. If the objection cannot be resolved, the Controller may cancel their subscription without penalty.

5.3. Sub-processor Contracts: The Processor shall enter into a contract with each sub-processor imposing the same legal requirements as those established in this DPA (Art. 28.4 GDPR).

6. Assistance to the Controller

6.1. Data Subject Rights: Given the ephemeral nature of processing (where Claix does not store processed file data), if a data subject exercises their rights (access, rectification, erasure) directly with Claix, the Processor shall redirect the request to the Controller within a maximum of five (5) business days.

6.2. Regulatory Compliance: The Processor shall assist the Controller, where appropriate and upon justified request, in conducting Data Protection Impact Assessments (DPIAs) or security notifications relating to API infrastructure.

7. Security Breach Notification

7.1.The Processor shall notify the Controller of any security breach in its infrastructure affecting the Controller's personal data, without undue delay and within a maximum of forty-eight (48) hours of confirmation.

7.2. The notification shall detail the nature of the incident, corrective measures applied, and possible consequences, providing necessary assistance for communications required to the AEPD (Art. 33 GDPR).

8. Audits and Inspections

8.1. The Processor shall make available to the Controller documentation and security certifications (such as SOC 2 and ISO 27001 reports from its EU infrastructure providers) necessary to demonstrate compliance with Art. 28 GDPR.

8.2.Any on-site or remote audit shall require thirty (30) days' prior notice, be conducted during business hours without interfering with API operations, and associated costs shall be borne by the Controller unless serious Processor non-compliance is demonstrated.

9. International Data Transfers

9.1. Primary API processing and database operations are carried out in data centers located within the European Union (Stockholm / Frankfurt / Ireland).

9.2. If auxiliary sub-processors outside the European Economic Area (EEA) are used, such as transactional email services, the Processor guarantees they operate under European Commission Adequacy Decisions (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs).

10. Data Fate upon Termination

10.1.Upon contract termination, the Controller's B2B account data shall be retained for ninety (90) days to allow download of invoices and consumption log history, after which secure deletion shall proceed.

10.2. With respect to files processed by the API, governed by the zero-at-rest retention principle, file return is not required as temporaries are destroyed after each HTTP response.

11. Liability (Art. 82 GDPR)

Each party shall be liable for damage caused to data subjects in accordance with the sanctioning and civil regime set out in Article 82 GDPR. The Processor shall be liable only if it has acted outside or contrary to the Controller's instructions or its specific legal obligations as Processor.

12. Governing Law and Jurisdiction

This DPA is governed by Spanish law and European Union law. For dispute resolution, the parties expressly submit to the Courts and Tribunals of the city of Madrid (Spain).

Annex A: Processing Activities Detail

Data Controller	The B2B User (company, developer, or agency) contracting or consuming the Claix API.
Data Processor	ANAYA CARBALLO GAEL (Claix).
Purpose of Processing Agreement	Standardization, structuring, and semantic AI mapping service for data files (.csv, .xlsx) sent to the Claix API.
Processing Duration	Transient/Ephemeral: Limited to the seconds required to process the HTTP request. For account management data: duration of the subscription.
Nature of Processing	HTTP reception, in-memory reading, AI semantic mapping, JSON structuring, response payload transmission, and temporary data purge.
Processing Purpose	Data schema transformation for integration into the Controller's CRM systems, databases, or automation workflows.
Data Subject Categories	Customers, contacts, leads, or end users of the Controller whose data appears within files uploaded to the API.
Data Categories	Identifying, commercial, or contact data (names, emails, phones, addresses, job titles, transactional data) present in columns of the uploaded file.
Special Categories of Data (Art. 9 GDPR)	Not required by the API. If the Controller includes sensitive fields in their files, these will be processed under the same encryption and immediate in-memory deletion policy.

Annex B: Technical and Organizational Security Measures (Art. 32 GDPR)

Encryption in Transit: Mandatory HTTPS protocol via TLS 1.3 for all REST API endpoints and the web Dashboard.
Encryption at Rest: Encryption of API keys, session tokens, and account data using AES-256 algorithm.
Execution Environment Isolation: Request processing via isolated (sandboxed) Edge Functions to prevent cross-client contamination or leakage (multi-tenant isolation).
Strong Authentication: API request authentication via private key headers (x-api-key).
Ephemeral Cryptographic Deletion: Automated purge of memory buffers and temporary files immediately after issuing the HTTP response (200 OK or error).
Zero AI Training Deployment: Configuration of language model calls with privacy clauses prohibiting persistence or use of data for training.
Logical Access Control: Principle of least privilege (RBAC) and production infrastructure access limited to SSH key / MFA authentication.
Network Security: Malicious request filtering, injection prevention, and anomalous traffic monitoring.

Annex C: List of Authorized Sub-processors

As of the effective date of this DPA, the Processor is authorized to engage the following infrastructure sub-processors:

Sub-processor	Service provided	Data location	Guarantees / Certifications
Supabase Inc. (AWS)	Cloud infrastructure, PostgreSQL database, Authentication, and Edge Functions.	European Union (Frankfurt / Stockholm / Ireland)	Data hosted in the EU. ISO 27001, SOC 2 Type II, GDPR compliance.
n8n (n8n GmbH / Faircode GmbH)	Workflow automation and Service data orchestration.	European Union (Germany)	Data hosted in the EU. SOC 2 Type II, GDPR compliance.
Resend Labs Inc.	Transactional email delivery, API alerts, and account notifications.	United States	EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). SOC 2.
Stripe, Inc.	Payment collection, B2B subscription billing, and payment gateway.	European Union / United States	EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). PCI-DSS Level 1, SOC 1, SOC 2.