Data processing agreement (DPA)

1. Parties and roles

This agreement is entered into between the customer using Heylio (the "Customer") and FASTOCHE, a simplified joint-stock company (société par actions simplifiée) with a share capital of €3,000, registered with the Aix-en-Provence Trade and Companies Register under number 922 556 212, whose registered office is at 1004 route de Coudoux, 13122 Ventabren, France, publisher of Heylio ("FASTOCHE").

The Customer is the controller of the personal data of its customers and staff that it entrusts to the service. FASTOCHE acts as processor within the meaning of Article 28 of Regulation (EU) 2016/679 ("GDPR") and processes this data only on the Customer's behalf.

FASTOCHE remains controller for the data of its own customer (account, billing, login logs), described in the privacy policy. This agreement expands on Article 7 of the Terms.

2. Subject matter and duration

The subject matter of the processing is the provision of Heylio, an artificial intelligence customer service agent for e-commerce: receiving requests from the Customer's customers on the channels it connects, drafting replies, sending them automatically or after review according to its settings, and performing the actions it authorises in its store.

The agreement applies for the entire term of the subscription, then until the deletion of data provided for in Article 11.

3. Description of the processing

• Nature of the operations: collection of messages through the connected channels (email, chat, messaging apps, telephone if the voice agent is enabled), consultation of orders through the store's API, recording, generation of replies by AI, automated checks of drafts, sending, performance of authorised actions (refund, cancellation, address change…), deletion.
• Purposes: replying to the requests of the Customer's customers and performing, on its instructions, the customer service and pre-sales actions it has authorised (including, if it enables them, follow-ups with the end customer's consent).
• Data subjects: the Customer's customers and prospects who contact it or use the widget of its store; members of its team who use the service.
• Categories of data: identity and contact details (name, email address, phone number or messaging identifier, shipping address); content of the exchanges (emails, messages, attachments, photos sent in the chat, call audio and transcript if the voice agent is enabled); order data the reply needs (items, amounts, status, tracking); technical widget data (country inferred from the IP address, visitor identifier); for the Customer's team, name, email address, role and access logs.
• Sensitive data: the service requires none (Article 9 of the GDPR). The Customer makes sure not to request any through its settings; if an end customer spontaneously writes some, it is processed like the rest of the message.
• Retention: each conversation (messages, attachments, transcripts, AI drafts and traces) is automatically deleted twenty-four (24) months after its last activity; the ticket and the action log are then anonymised, only statistics without personal data being kept. Other data is kept for as long as the Customer uses the service, except for the shorter periods set by the service (export links: 7 days; access log: one year; backups: 90 days), then deleted according to Article 11. Billing data follows its legal obligations.

4. Documented instructions

FASTOCHE processes the data only on documented instructions from the Customer. These instructions are: the Terms and this agreement; the Customer's configuration of the service (connected channels, knowledge base, rules, authorised actions, automatic sending or review, delayed sending period); the actions of its users in the interface; the compliance requests sent by its store's platform (for example Shopify's access and erasure requests).

FASTOCHE does not use this data to train artificial intelligence models, does not sell it and does not use it for advertising purposes. If FASTOCHE considers that an instruction infringes the GDPR, it informs the Customer without delay.

5. Confidentiality

Only authorised personnel of FASTOCHE, bound by confidentiality, access the Customer's data, strictly to the extent necessary to operate and support the service. Their views of an account's screens are personal and recorded in the access log, kept for one year, without any copy of the data viewed.

6. Security measures

FASTOCHE implements technical and organisational measures appropriate to the risk (Article 32 of the GDPR), in particular:

• Hosting in the European Union: application run in Dublin (Ireland), database and files in Ireland.
• Encryption: in transit (TLS, HSTS); at rest, application-level AES-256-GCM encryption of store access tokens, mailbox and messaging credentials, API keys of connected services and gift card codes, before they are stored; passwords stored as hashes (scrypt).
• Access control: personal accounts, roles (owner, administrator, agent, read-only), two-factor authentication by emailed code available for password logins, Google sign-in; administrative access restricted to a named list of verified addresses.
• Account isolation: all data functions are internal to the server and check the account concerned; the database access key is never exposed to the browser.
• Application protection: CSRF protection, content security policy (CSP), request rate limiting, signature verification of notifications received from platforms (Shopify, Stripe, Meta, Twilio, Resend, helpdesks).
• Logging: log of views by staff (one year), log of each action performed by the AI, log of API key calls (90 days), log of ticket deletions.
• Minimisation: decision traces redacted before storage (no email address, phone number or secret); chat photos never stored; widget IP addresses reduced to the country.
• Backups: daily database backup (full every week, incremental on other days), excluding authentication sessions, encrypted before it is stored (decryption key kept outside the repository and its host), kept for 90 days in a private repository with restricted access; documented and tested restore procedure.
• Separate environments: the test environment has its own database and its outgoing messages are limited to internal addresses.
• Monitoring: automatic alerts on database unavailability, service health checks, error tracking; incident management procedure.
• AI control: actions limited to those the Customer authorises, with caps and optional human review; AI can be paused at any time by the Customer; cost cap per account.

7. Subprocessors

The Customer grants FASTOCHE a general authorisation to use the subprocessors whose up-to-date list, with their role, the data received, their location and the applicable safeguards, is published on the Subprocessors page. Each is bound by data protection obligations equivalent to those of this agreement; FASTOCHE remains liable to the Customer for their compliance.

FASTOCHE informs the Customer of any addition or replacement at least thirty (30) days before it takes effect, by email to the account address and by updating that page. The Customer may object on legitimate grounds within that period; failing agreement, it may terminate the subscription free of charge.

The services the Customer connects itself (its store, mailboxes, messaging apps, helpdesk, returns or tracking tools) are recipients it designates and contracts with directly; they are not subprocessors.

8. Transfers outside the European Union

The data is stored in the European Union. Some subprocessors process it from a third country, mainly the United States: Trigger.dev, GitHub, Inc., OpenRouter, Inc., Google Cloud, Amazon Web Services, Microsoft Azure, Anthropic, PBC, OpenAI, L.L.C., Voyage AI, TypeSafe, Cohere Inc., Resend, Twilio Inc., Telegram, ipinfo.io, Stripe. These are mostly artificial intelligence providers, which receive the content of the conversation and the context the reply needs, for the time needed to produce it.

Each transfer is governed by a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified providers) or by the standard contractual clauses adopted by the Commission, supplemented by the measures described in Article 6. For non-Anthropic AI models, each request forbids the host from retaining the data or using it for training, and only named hosts may receive it — never a host established in China.

9. Assistance to the Customer

FASTOCHE assists the Customer in responding to requests to exercise data subjects' rights (access, rectification, erasure, restriction, objection, portability), in its impact assessments and in its consultations of the supervisory authority.

• Shopify stores: access and erasure requests from an end customer forwarded by Shopify are handled automatically on receipt; the export is delivered through a signed link valid for seven (7) days. Maximum period: thirty (30) days.
• Other accounts: on the Customer's written request to hello@heylio.io, FASTOCHE exports or erases a person's data within thirty (30) days.
• Any request from a data subject received directly by FASTOCHE is forwarded to the Customer within five (5) business days, without responding on the merits.

10. Personal data breach

FASTOCHE notifies the Customer of any personal data breach affecting the data processed on its behalf without undue delay and at the latest forty-eight (48) hours after becoming aware of it, so that it can notify the supervisory authority within the seventy-two (72) hour period of Article 33 of the GDPR.

The notification, sent to the account's email address, describes as far as possible the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point; it is supplemented as the investigation progresses. Incidents are recorded in an internal log with their causes and follow-up.

11. End of processing: return and deletion

• Shopify stores: when the app is uninstalled, its access tokens are deleted; the store's data is deleted on receipt of the erasure request that Shopify sends forty-eight (48) hours later, unless another app of the suite remains installed on the store and still uses it.
• Other accounts: at the end of the subscription, the Customer may request an export of its data; it is deleted at its request, within thirty (30) days of that request.
• Backups: deleted data disappears from backups when their ninety (90) day retention period expires.
• Beyond that, FASTOCHE only keeps billing data subject to a legal retention obligation.

12. Documentation and audits

FASTOCHE keeps a record of the processing carried out on behalf of its customers (Article 30(2) of the GDPR) and makes available to the Customer the information necessary to demonstrate compliance with this agreement. The Customer may, no more than once a year, at its own expense and with thirty (30) days' notice, have an audit carried out by itself or by an independent auditor bound by confidentiality, during business hours and without disrupting the service.

13. Liability and order of precedence

Each party is liable for breaches of its own obligations under the GDPR. The limitation of liability in Article 5 of the Terms applies to this agreement, unless mandatory law provides otherwise.

This agreement supplements Article 7 of the Terms; in case of conflict, the provision most protective of personal data prevails. French law applies. Contact: hello@heylio.io; data protection officer: rgpd@fastoche.tech, DPO — FASTOCHE, 1004 route de Coudoux, 13122 Ventabren.