Subprocessors

Principles

FASTOCHE, publisher of Heylio, acts as processor for merchants (Article 28 of the GDPR). The providers below are our subprocessors: each receives only the data its role requires and is bound by data protection obligations equivalent to those of our processing agreement.

The service's data is hosted in the European Union (application in Dublin, database in Ireland). Processing carried out outside the Union, in particular by artificial intelligence providers, is indicated for each provider, together with the safeguard that governs it.

We inform customers of any addition or replacement of a subprocessor at least thirty (30) days before it takes effect; a customer may object on legitimate grounds (Article 7.6 of the Terms).

Hosting and infrastructure

Vercel, Inc.

• Role: hosting of the application and the API
• Data: all data processed by the service, for the duration of the request; technical logs (IP address, page address)
• Location: EU, Dublin (Ireland); company based in the United States
• Safeguards: Provider's data processing agreement; data stored in the European Union; standard contractual clauses for any access from the United States

Convex, Inc.

• Role: database, authentication and file storage
• Data: all data of the service, at rest
• Location: EU, Ireland; company based in the United States
• Safeguards: Provider's data processing agreement; data stored in the European Union; standard contractual clauses for any access from the United States

Trigger.dev

• Role: background jobs (email polling and processing, knowledge base, reports, data export and erasure)
• Data: the data processed by each job, for the duration of its run
• Location: United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses

GitHub, Inc.

• Role: database backup
• Data: copy of the database (excluding authentication sessions), artifact of a private repository with restricted access, kept for 90 days
• Location: United States
• Safeguards: Provider's data processing agreement; standard contractual clauses; store and mailbox access tokens encrypted in the copy as in the database

Artificial intelligence

OpenRouter, Inc.

• Role: routing of requests to the AI models that draft, classify and check replies; text vectors of the knowledge base
• Data: content of the conversation, customer context the reply needs (first name, email address, shipping address, order details), knowledge base excerpts
• Location: United States
• Safeguards: Standard contractual clauses; each request is routed only to hosts that retain no data (Zero Data Retention) and do not use it for training

Google Cloud, Amazon Web Services

• Role: Vertex AI and Bedrock: serve Anthropic's Claude models that draft, classify and check replies, through OpenRouter
• Data: the same as for OpenRouter, for the time needed to produce the reply
• Location: EU first (Vertex AI Europe, Bedrock Ireland); another region of these providers, possibly in the United States, if they are unavailable
• Safeguards: No data retention (Zero Data Retention) and no training, enforced on each request; standard contractual clauses

Microsoft Azure

• Role: Azure OpenAI: text vectors of the knowledge base, through OpenRouter
• Data: knowledge base texts and the customer's question, for the time of the computation
• Location: region chosen by OpenRouter, possibly outside the EU
• Safeguards: No data retention (Zero Data Retention) and no training, enforced on each request; standard contractual clauses

Anthropic, PBC

• Role: direct fallback AI provider (Claude models)
• Data: the same as for OpenRouter, for the time needed to produce the reply
• Location: United States
• Safeguards: Organization-level Zero Data Retention agreement required before any activation; standard contractual clauses; no training on the data sent
• Condition: only once the no-retention agreement is signed (not active today)

OpenAI, L.L.C.

• Role: voice agent (understanding and voice of the assistant on the phone or in the browser)
• Data: call audio and transcript, order information the reply needs
• Location: United States
• Safeguards: Standard contractual clauses; API terms: no training on the data sent
• Condition: only if the merchant enables the voice agent

LiveKit, Inc.

• Role: audio transport of voice calls and execution of the voice agent
• Data: call audio, for the duration of the call
• Location: EU, Germany; company based in the United States
• Safeguards: Provider's data processing agreement; data stored in the European Union; standard contractual clauses for any access from the United States
• Condition: only if the merchant enables the voice agent

Voyage AI (MongoDB, Inc.)

• Role: ranking of knowledge base excerpts; recognition of a product in a photo sent in the chat
• Data: the customer's question and knowledge base excerpts; photo sent by the visitor, never stored by Heylio
• Location: United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses
• Condition: photo: only if recognition is enabled (not active today)

TypeSafe

• Role: automated checks of the AI's drafts and classification of requests
• Data: the customer's message, order facts and the draft sentences being checked
• Location: United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses

Cohere Inc.

• Role: ranking of knowledge base excerpts, as a fallback
• Data: the customer's question and knowledge base excerpts
• Location: Canada
• Safeguards: European Commission adequacy decision (Canada); provider's data processing agreement
• Condition: only if enabled (not active today)

Communication

Resend (Plus Five Five, Inc.)

• Role: sending of emails: notifications to merchants and emails to the store's customers (verification codes, return labels, satisfaction surveys, data export)
• Data: name and email address of the recipient, content of the email
• Location: United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses

Twilio Inc.

• Role: back-in-stock text messages
• Data: phone number and text of the message
• Location: United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses
• Condition: only if enabled and the customer opted in (not active today)

Telegram

• Role: optional daily report sent to the merchant
• Data: identifier of the merchant's Telegram chat, aggregate statistics
• Location: outside the EU
• Safeguards: Used only at the merchant's request; no data of the store's customers
• Condition: only if the merchant links a Telegram chat

Measurement and payment

PostHog, Inc.

• Role: product usage measurement, error reporting and recording of dashboard sessions
• Data: email address of the merchant user, usage events, error messages; in recorded sessions, what the screen shows (input fields masked)
• Location: EU, Germany
• Safeguards: Provider's data processing agreement; data stored in the European Union; standard contractual clauses for any access from the United States

ipinfo.io

• Role: country of chat widget visitors
• Data: visitor's IP address (only the country is kept)
• Location: United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses

Stripe

• Role: payment of subscriptions for non-Shopify accounts
• Data: the merchant's billing data
• Location: EU (Ireland) and United States
• Safeguards: Provider's data processing agreement; transfer governed by the European Commission's standard contractual clauses

Services connected by the merchant

The services that merchants link to Heylio themselves, with their own credentials, are recipients they designate and contract with directly; they are not our subprocessors: Shopify, BigCommerce, PrestaShop, WooCommerce, Google (Gmail, Google sign-in), Microsoft (Outlook), Meta (Instagram, WhatsApp), Zendesk, Gorgias, Front, Klaviyo, AfterShip, Notion, Eventbrite.

The other apps of the suite (Heylio Return, Heylio Tracker, Heylio Fit), also published by FASTOCHE, only exchange data with Heylio if the merchant enables them.

Contact

Questions about our subprocessors: hello@heylio.io; data protection officer: rgpd@fastoche.tech.