Privacy policy

Data controller

FASTOCHE, a simplified joint-stock company (société par actions simplifiée) whose registered office is located at 1004 route de Coudoux, 13122 Ventabren, France, publisher of Heylio, is the controller of the personal data described below, in particular in connection with the operation of the website https://heylio.io. Contact: hello@heylio.io.

Data collected

• Company data: name, store domain, email address, team members.
• Authentication: OAuth tokens of connected services (Shopify, Gmail, Outlook…), kept server-side and never sent to the browser.
• Configuration: application settings, playbooks and rules, knowledge base, AI preferences.
• Conversations processed on behalf of the customer: synchronised support emails, chat messages, Instagram and WhatsApp direct messages, generated replies and actions performed.
• Browsing data and cookies (see our cookie policy).
• Data submitted through the website contact form: name, email address, company, e-commerce platform, tool concerned and message content.

Data of the store's customers

When a merchant connects its store and channels to Heylio, we process on its behalf the messages of its customers and the data needed to reply to them.

• Identity and contact details: name, email address and, depending on the channel, phone number or username.
• Orders (Shopify stores): looked up one at a time, when a request concerns them, to reply or to perform an action authorised by the merchant (refund, cancellation, address change…).
• Content of the exchanges: emails, chat messages, direct messages, and the replies produced.

This data is used exclusively to reply to the requests of the merchant's customers. We do not sell it, do not use it for advertising purposes and do not use it to train AI models.

The merchant is the controller; Heylio acts as processor, on its instructions (Article 28 of the GDPR). The data processing agreement is set out in our Terms.

Artificial intelligence

Replies are drafted by AI models (Anthropic's Claude, via OpenRouter; the Anthropic API as a fallback). These providers receive the content of the conversation, the customer context the reply needs (first name, email address, shipping address, order details) and the relevant excerpts of the knowledge base, for the time needed to produce the reply. When the AI is not confident, or when a merchant rule requires it, the reply is prepared for human review instead of being sent.

Retention period

• Active use: data is kept for as long as the company uses the service.
• After uninstallation from Shopify: uninstalling does not delete data by itself; Shopify sends us a shop/redact request 48 hours later and the data is deleted on receipt (unless another app of our suite remains installed on the store, which still uses it). Other accounts: deletion on request.
• Backups: daily export of the database (without access tokens or sessions), kept for 90 days as an artifact of a private repository with restricted access.
• Requests concerning customer data (access, erasure), including those forwarded by Shopify: handled within 30 days.

Security

Encryption in transit (TLS); Shopify access tokens, mailbox credentials and API keys of connected helpdesks and stores encrypted with AES-256-GCM before storage; server-side isolation of each account; log of all actions performed by the AI and of every consultation of customer data by our team (kept one year).

Purposes and legal bases

• Performance of the contract: provision of the service, management of the subscription and billing.
• Legitimate interest: responding to contact requests, product improvement, security, fraud prevention, customer support.
• Consent: sending marketing communications and non-essential audience measurement cookies.
• Legal obligation: retention of billing data for accounting and tax purposes.

Retention period

Account data is kept for the entire duration of the subscription, then archived or deleted at the end of the applicable limitation period after termination, unless a longer retention period is required by law (billing data: 10 years).

Messages sent through the contact form, and the contact details accompanying them, are kept for three (3) years from the last contact with the data subject, then deleted.

Your rights

In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to and port your personal data. You can exercise these rights by writing to us at hello@heylio.io. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), if you consider that your rights have not been respected.

Data protection officer

DPO contact: rgpd@fastoche.tech — or by post: DPO — FASTOCHE, 1004 route de Coudoux, 13122 Ventabren.

Sub-processors

We use the following sub-processors, each contractually committed to complying with the GDPR and located in the European Union or covered by a compliant transfer framework:

• Vercel, Inc. — hosting of the application and the API (functions in the EU, Dublin).
• Convex, Inc. — database and file storage (EU region, Ireland).
• Trigger.dev — background jobs (email synchronisation, knowledge base, reports, data export and erasure).
• OpenRouter — generation of replies by AI and text vectors (Anthropic's Claude models, OpenAI embeddings).
• Google (Vertex AI) — serves Anthropic's Claude models when OpenRouter routes a request there.
• Cohere — ranking of search results, only if enabled (not active today).
• Twilio — text messages for back-in-stock alerts, only if enabled and the customer opted in (not active today).
• Anthropic — fallback AI provider (Claude API).
• OpenAI — fallback provider for text vectors.
• Voyage AI — ranking of search results in the knowledge base.
• TypeSafe — automated checks of the AI's drafts.
• Resend — transactional emails and notifications.
• PostHog (EU region) — product usage measurement and error reporting.
• GitHub — daily database backup (artifact of a private repository, 90 days).
• ipinfo.io — country of chat widget visitors.
• Stripe — payment of subscriptions for non-Shopify accounts.
• Telegram — optional daily report, when the merchant links a Telegram chat.
• Services connected by the merchant, on its behalf: Shopify, Google (Gmail, Google sign-in), Microsoft (Outlook), Meta (Instagram, WhatsApp), Zendesk.
• Google Ads (Google Ireland) — measurement of advertising conversions on our web pages, after your consent.

Detailed list available on request at hello@heylio.io.