Privacy Policy & Data Protection

Last updated: October 15, 2026

This page is the English summary of our privacy practices. The reference versions, in French, are our Politique de confidentialité and, for the data we process on behalf of merchants, the data processing agreement in article 7 of our CGV. If the two ever differ, the reference version prevails.

1. Who we are

Heylio ("we", "our", "us") is an AI customer service agent for e-commerce, published by FASTOCHE, a French société par actions simplifiée (SAS) with a share capital of €3,000, registered with the Aix-en-Provence Trade and Companies Register under number 922 556 212 (SIRET 922 556 212 00020), whose registered office is at 1004 route de Coudoux, 13122 Ventabren, France. Full details are in our legal notice.

Heylio is offered to businesses only (merchants and other professionals acting for business purposes), not to consumers.

Data controller for the data of our own customers and of visitors to our website (account, billing, contact requests, website analytics): FASTOCHE SAS.
Data processor for the data of a merchant's customers that we process to answer their requests: the merchant is the controller, and FASTOCHE acts on the merchant's documented instructions (Article 28 GDPR). The data processing agreement is article 7 of our CGV.

Contact: hello@heylio.io
Data Protection Officer: rgpd@fastoche.tech, or by post: DPO — FASTOCHE, 1004 route de Coudoux, 13122 Ventabren, France

2. Data Collected

2.1 Business Data

Store Information: Business name, store domain, email address, team members
Authentication: OAuth tokens of connected services (Shopify, Gmail, Outlook…), stored server-side and never sent to the browser
Configuration: App settings, playbook rules, knowledge base, AI preferences
Billing: Subscription status and billing contact (payments are handled by Shopify Billing or Stripe; we never see full card numbers)

2.2 Data of the Merchant's Customers (processed on the merchant's behalf)

Identity and contact details: name, email address and, depending on the channel, phone number or username
Orders (Shopify stores): looked up one at a time, when a request concerns them, to answer it or to perform an action the merchant has authorized (refund, cancellation, address change…)

2.3 Communication Data

Support Emails: Emails synced from connected Gmail/Outlook accounts
Direct Messages: Instagram DMs and WhatsApp messages
Chat Messages: Conversations from the storefront chat widget
AI Responses: Generated replies and executed actions

2.4 Website Data

Contact form: the name, email address and message you send us
Browsing data and cookies: see section 6 and our cookie policy

3. How We Use Your Data

Support Automation: Classifying tickets, generating AI responses, executing the actions the merchant has authorized
Customer Identification: Matching messages to customer accounts and order history
Personalization: Addressing customers by name, referencing their specific orders
Running our service: Account management, billing, support, security, fraud prevention, answering contact requests

The data of a merchant's customers is used exclusively to answer that merchant's customers. AI replies are written by AI models (Anthropic's Claude, through OpenRouter; Anthropic's API as a fallback), which receive the conversation and the relevant knowledge-base excerpts only for the time needed to produce the reply. When the AI is not sure, or when a merchant rule requires it, the reply is prepared for human review instead of being sent.

We DO NOT: Sell personal data, use it for advertising, share it with advertisers, or use it to train AI models.

3.1 Legal bases

Performance of the contract: providing the service, managing the subscription and billing
Legitimate interest: answering contact requests, improving the product, security, fraud prevention, customer support
Consent: marketing communications, and non-essential cookies (website audience measurement and advertising conversion measurement)
Legal obligation: keeping billing records for accounting and tax purposes

4. Google User Data (Gmail and Sign in with Google)

When a business connects a Gmail account, Heylio requests access to read, send and modify emails of that mailbox (Gmail API scopes gmail.readonly, gmail.send, gmail.modify) and to the account's email address. This access is used only to provide the user-facing features the business has turned on: reading incoming support emails, drafting replies with AI, sending the approved or automatic replies from the business's own address, and marking processed emails as read.

Heylio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

Google user data is used only to provide and improve the user-facing features described above;
it is not transferred to third parties, except to the sub-processors listed in section 5 as necessary to provide those features (for example the AI provider that writes the reply), to comply with applicable law, or as part of a merger or acquisition with the user's prior notice;
it is never used to serve advertisements, including retargeting or personalized or interest-based ads;
it is never sold, and never used to train or improve generalized AI or machine-learning models;
no human reads it, unless the user has given affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse), or it is required by law.

A business can revoke Heylio's access at any time from its Heylio settings or from its Google account permissions page; the OAuth tokens are then deleted.

5. Data Sharing

We share data only with the following service providers (sub-processors), necessary for service operation. Each is contractually bound to the GDPR and located in the European Union or covered by a compliant transfer mechanism (adequacy decision or European Commission standard contractual clauses):

Provider	Purpose	Data Shared
Vercel	Application hosting (functions run in the EU, Dublin)	All requests to the app and API, including the data they carry
Convex	Database and file storage (EU region, Ireland)	All app data: accounts, settings, tickets, messages, knowledge base, uploaded files
Trigger.dev	Background jobs (email sync and processing, knowledge-base processing, reports, data export and erasure)	Data processed by these jobs, in transit
GitHub	Daily database backup, kept 90 days as an artifact of a private repository	A copy of app data, without access tokens or sessions
OpenRouter	AI response generation and text embeddings (routes requests to Anthropic Claude, served by Anthropic or Google Vertex AI, and to OpenAI embedding models)	Ticket and chat content, customer context, knowledge-base excerpts
Anthropic (Claude API)	Backup AI provider when OpenRouter is unavailable	Ticket and chat content, customer context, knowledge-base excerpts
OpenAI	Backup provider for text embeddings	Knowledge-base text and search queries
Voyage AI	Search result ranking	Customer questions and knowledge-base excerpts
Google (Vertex AI)	Serves Anthropic Claude models when OpenRouter routes a request there	Ticket and chat content, customer context, knowledge-base excerpts
Cohere	Search result ranking, only if enabled (not active today)	Customer questions and knowledge-base excerpts
Twilio	Text messages for back-in-stock alerts, only if enabled and the customer opted in (not active today)	Customer phone number and message content
TypeSafe	Automated checks on AI drafts and customer intent	Excerpts of customer messages and AI drafts
Resend	Transactional and notification emails	Recipient email address and email content
PostHog (EU region)	Product analytics and error reporting	Usage events, pseudonymous identifiers, IP address, technical error details
ipinfo.io	Country detection for chat widget visitors	Visitor IP address
Stripe	Subscription and credit-pack payments (accounts not billed through Shopify)	Billing contact, payment details, subscription status
Telegram	Optional daily report, when the merchant links a Telegram chat	Telegram chat ID and aggregate ticket counts

When a business connects one of the following services, data is exchanged with it on the business's behalf (the business chooses and contracts with these services directly):

Provider	Purpose	Data Shared
Shopify	Store data, orders and customers; billing for Shopify merchants	Store, order and customer data needed to answer support requests
Google (Gmail API, Sign in with Google, Google Docs)	Email synchronization, sign-in, knowledge-base import	Email content, account email address, imported documents
Microsoft (Outlook API)	Email synchronization	Email content when Outlook is connected
Meta (Instagram and WhatsApp APIs)	Direct message support	DM content, sender username or phone number, conversation history
Zendesk	Helpdesk synchronization, when connected	Tickets and messages exchanged with the connected helpdesk

On our website, Google Ads measures advertising conversions (page visits and cookie identifiers), only with your consent (see section 6). An up-to-date list of sub-processors is available on request at hello@heylio.io.

6. Cookies and Website Analytics

On heylio.io we use PostHog, hosted in the European Union and reached through our own domain, to measure audience (pages viewed, where visits come from, clicks), and Google Ads to measure advertising conversions. Both are subject to your prior consent, collected through the cookie banner shown on your first visit; you can change your choice at any time with the "Manage cookies" link. Refusing does not prevent you from using the site. These cookies last 13 months at most, and your consent choice is kept for 6 months. Details: cookie policy.

7. Data Security

Encryption in Transit: TLS (HTTPS) for all communications
Encryption of Secrets: Shopify access tokens, mailbox and messaging credentials (OAuth tokens, IMAP/SMTP passwords) and API keys of connected integrations are encrypted with AES-256-GCM before storage
Backups: Daily database export, kept 90 days as an artifact of a private, access-restricted repository; access tokens and sessions are excluded
Authentication: Shopify OAuth 2.0 for Shopify merchants; for direct accounts, Sign in with Google or an email and password (passwords are stored hashed, never in plain text)
Multi-Tenant Isolation: Every database read and write is scoped server-side to the business's account
Logs: Every action taken by the AI is logged and visible to the business; every consultation of customer data by our team (who, which store, which screen, when — never the data itself) is logged and kept one year

8. Data Retention

Active Use: Data retained while the business uses the service
After Uninstallation from Shopify: Uninstalling does not delete data by itself. Shopify sends us a shop/redact request 48 hours after uninstallation; on receipt we delete the business's data and its customers' data, unless another app of our suite remains installed on the store and still uses it. Backups are erased when their 90-day retention period ends
End of Contract (other accounts): Data deleted on request
Billing Records: Kept 10 years, as required by accounting and tax law
Contact Form Messages: Kept 3 years after your last contact with us
Customer Data Requests: Access and erasure requests about a merchant's customers, including those sent by Shopify (customers/data_request, customers/redact, shop/redact), are processed within 30 days

9. Your Rights (GDPR)

You have the right to: Access, Rectification, Erasure, Restriction, Portability, and Objection, and to withdraw your consent at any time.

To exercise any right, contact hello@heylio.io or our Data Protection Officer at rgpd@fastoche.tech. If you are a customer of a store that uses Heylio, you may also contact that store directly: it is the controller of your data. You can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

10. Contact

Privacy: hello@heylio.io
Data Protection Officer: rgpd@fastoche.tech
Security: hello@heylio.io
General: hello@heylio.io or our contact page