Terms of sale and use

1. Purpose

These terms of sale and use (the "Terms") govern access to and use of the Heylio service, a SaaS (Software as a Service) software solution providing an AI agent for e-commerce customer service, published by FASTOCHE (see legal notice). Any subscription to a Heylio plan implies full and unreserved acceptance of these Terms.

Business customers only. The service is intended exclusively for professionals — natural or legal persons acting in the course of their commercial, industrial, craft or liberal profession activity — and is not offered to consumers. By subscribing, the customer declares that it is acting for professional purposes. The provisions of the French Consumer Code specific to contracts concluded with consumers, in particular the right of withdrawal and recourse to a consumer mediator, do not apply.

2. Subscription and billing

Heylio is offered as a tiered monthly subscription, each plan including a number of resolutions per month — a resolution is a conversation that the AI closes on its own; a handover to a human is never counted. Credit packs can be purchased in addition. The prices in force are those shown on the home page. Shopify merchants are billed through Shopify Billing; other accounts through Stripe, by credit card.

3. Term and termination

The subscription is entered into without any minimum term, unless otherwise expressly stated and accepted by the customer (in particular for custom plans). It renews tacitly each month. Either party may terminate the subscription at any time, with thirty (30) days' notice, by email to hello@heylio.io or from the customer area. Termination takes effect at the end of the current billing period; no pro rata refund is due unless otherwise required by law.

4. Customer obligations

The customer is responsible for the content it provides to the service (knowledge base, policies, playbooks and rules), for configuring the actions that the AI may perform in its store, and for choosing whether replies are sent automatically or after review. It ensures that this content and these settings comply with the regulations applicable to its business, in particular consumer law.

5. Liability

Heylio uses reasonable means to ensure the availability and reliability of the service, without guaranteeing that it will be entirely free of interruptions. The publisher's liability, for all damages combined, shall not exceed the total amount paid by the customer for the subscription during the twelve (12) months preceding the event giving rise to the claim.

6. Personal data

The processing of personal data collected through the use of the service is described in our privacy policy. Where the customer entrusts Heylio with personal data of its own customers, Article 7 below serves as the data processing agreement.

7. Data processing agreement (DPA)

This article constitutes the data processing agreement entered into between the customer and FASTOCHE within the meaning of Article 28 of the GDPR (Regulation (EU) 2016/679). It prevails over any other provision of the Terms as regards the processing of personal data entrusted by the customer.

7.1 Roles of the parties

The customer is the controller of the personal data of its end customers and staff that it entrusts to the service. FASTOCHE acts as processor and processes such data only on behalf of the customer and on its instructions. FASTOCHE remains the controller of the data relating to its own customer account (identity, billing, connection logs), described in the privacy policy.

7.2 Subject matter, duration, nature and purpose of the processing

• Subject matter: provision of the AI customer service agent described in Article 1.
• Duration: the term of the subscription, extended by the return and deletion period provided for in Article 7.9.
• Nature: collection of messages through the channels connected by the customer (email, chat, messaging apps), consultation of order data through the store's API, recording, generation of replies by AI, sending of replies, performance of the actions authorised by the customer, deletion.
• Purpose: replying to the requests of the customer's end customers and performing, on its instructions, the customer service actions it has authorised.
• Data subjects: the customer's end customers who contact it; members of the customer's staff using the service.
• Categories of data: identity and contact details (name, email, phone number or messaging identifier), content of the exchanges, order data needed for the reply. No so-called sensitive data (Article 9 of the GDPR) is required by the service.

7.3 Documented instructions

FASTOCHE processes the data only on documented instructions from the customer. The following constitute instructions: these Terms, the configuration of the service made by the customer (connected channels, knowledge base, playbooks and rules, authorised actions, automatic sending or review), the actions of its users in the interface, and the compliance signals sent by the e-commerce platform on its behalf. FASTOCHE does not use this data to train AI models.

7.4 Confidentiality

Only authorised personnel of FASTOCHE, bound by a duty of confidentiality, access the data, strictly to the extent necessary for operating and supporting the service. Such access is personal, time-limited and logged.

7.5 Security

FASTOCHE implements technical and organisational measures appropriate to the risk (Article 32 of the GDPR), including: encryption of data in transit (TLS) and at rest; application-level encryption of access tokens and integration secrets; role-based access control; separation of test and production environments; encrypted backups; incident monitoring; logging of sensitive actions.

7.6 Sub-processors

The customer gives FASTOCHE general authorisation to engage the following sub-processors, bound by obligations equivalent to those of this article:

• Vercel, Inc. — hosting of the application and the API (functions in the EU, Dublin).
• Convex, Inc. — database and file storage (EU region, Ireland).
• Trigger.dev — background jobs (email synchronisation, knowledge base, reports, data export and erasure).
• OpenRouter — generation of replies by AI and text vectors (Anthropic's Claude models, OpenAI embeddings).
• Google (Vertex AI) — serves Anthropic's Claude models when OpenRouter routes a request there.
• Cohere — ranking of search results, only if enabled (not active today).
• Twilio — text messages for back-in-stock alerts, only if enabled and the customer opted in (not active today).
• Anthropic — fallback AI provider (Claude API).
• OpenAI — fallback provider for text vectors.
• Voyage AI — ranking of search results in the knowledge base.
• TypeSafe — automated checks of the AI's drafts.
• Resend — transactional emails and notifications.
• PostHog (EU region) — product usage measurement and error reporting.
• GitHub — daily database backup (artifact of a private repository, 90 days).
• ipinfo.io — country of chat widget visitors.
• Stripe — payment of subscriptions for non-Shopify accounts.
• Telegram — optional daily report, when the merchant links a Telegram chat.

Providers that the customer chooses to activate in the service (carriers, logistics providers, customer service tools…) are recipients designated by the customer, which contracts with them directly; they are not sub-processors of FASTOCHE. FASTOCHE informs the customer of any addition or replacement of a sub-processor at least thirty (30) days before it takes effect. The customer may object on legitimate grounds within that period; failing agreement, it may terminate the subscription free of charge. The up-to-date list is available on request at hello@heylio.io.

7.7 Assistance to the customer

FASTOCHE assists the customer in fulfilling its obligations: responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, objection, portability), data protection impact assessments and prior consultations with the supervisory authority. Any request from a data subject received directly by FASTOCHE is forwarded to the customer within five (5) business days, without responding to it on the merits. For Shopify stores, access and erasure requests forwarded by the platform are handled within thirty (30) days at the latest.

7.8 Personal data breach

FASTOCHE notifies the customer of any personal data breach affecting the data processed on its behalf without undue delay and no later than forty-eight (48) hours after becoming aware of it, so that the customer can notify the supervisory authority within the seventy-two (72) hour period provided for in Article 33 of the GDPR. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.

7.9 End of processing: return and deletion

When the application is uninstalled from Shopify, its access tokens are deleted, but uninstalling does not delete the data by itself: Shopify sends FASTOCHE a shop/redact request forty-eight (48) hours after uninstallation, and the data is deleted upon receipt of that request, unless another application of the Heylio suite remains installed on the store and still uses it. For accounts not billed through Shopify, the data is deleted on request at the end of the subscription. Backups are erased at the end of their ninety (90) day retention period. Beyond that, FASTOCHE only keeps billing data subject to a legal retention obligation.

7.10 Audits

FASTOCHE makes available to the customer the information necessary to demonstrate compliance with this article. The customer may, no more than once a year, at its own expense and with thirty (30) days' notice, carry out an audit itself or have it carried out by an independent auditor bound by confidentiality, during business hours and without disrupting the service.

7.11 Transfers outside the European Union

Where a sub-processor is established outside the European Union or accesses the data from a third country, the transfer is governed by an adequacy decision or by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.

7.12 Liability

Each party is liable for breaches of its own obligations under the GDPR. The limitation of liability in Article 5 applies to the obligations under this article, unless otherwise required by mandatory law.

8. Governing law and disputes

These Terms are governed by French law. In the event of a dispute, an amicable solution will be sought first; failing that, the competent courts shall be those within the jurisdiction of the publisher's registered office, unless otherwise required by public policy provisions.