Privacy policy

Data controller

FASTOCHE, a simplified joint-stock company (société par actions simplifiée) whose registered office is located at 1004 route de Coudoux, 13122 Ventabren, France, publisher of HeyTracker, is the controller of the personal data described below, in particular in connection with the operation of the website https://heytracker.app. Contact: hello@heylio.io.

Data collected

• Customer identification data: last name, first name, email, store name and domain.
• Data related to use of the service: tracking page configuration, alert time limits, claims settings, parcel and file history.
• Data of the store's end customers (orders, parcels), processed on behalf of the HeyTracker customer.
• Browsing data and cookies (see our cookie policy).
• Data submitted through the website contact form: name, email address, company, e-commerce platform, tool concerned and message content.

Data received from Shopify and carriers

When a merchant installs the HeyTracker Shopify app, we receive from their store, read-only, the data needed to track their shipments.

What data

• Order: number, date, amount, items (title, variant, SKU, quantity, price, image).
• End customer: email address, first and last name, and for delivery only the postal code, city and country (never the full address).
• Shipment: carrier, tracking number and link, items contained in each parcel.
• Tracking: scan events returned by the carrier (date, status, location), pickup point (address, opening hours, collection deadline).
• Claims: claim file and supporting documents (proof of shipment, proof of value). Sending photos of a damaged parcel by the end customer from the tracking page is not available yet; this policy will be updated before it opens.
• Technical store data: domain, API access token, granted scopes.

To obtain scans, only the parcel's tracking number (and, where the carrier requires it, the delivery postal code) is sent to the carrier concerned.

Purpose and legal basis

This data is used exclusively to track the merchant's parcels, display the tracking page to their customers, alert them of delays and exceptions, answer delivery questions through their customer service agent, and prepare their claims with carriers. It is used for no other purpose: no prospecting, no advertising profiling, no sale or sharing with third parties for their own purposes.

The merchant is the data controller; HeyTracker acts as a processor, on the merchant's instructions (Article 28 of the GDPR). The data processing agreement is part of our Terms.

Access to the tracking page: through a signed link or with the order number and email address. Repeated failed attempts are limited, to prevent enumeration of a store's orders.

AI-assisted drafting

When assisted drafting is turned on, the claim sent to the carrier is drafted by an AI model from the file's details (carrier, tracking number, dates, reason, amount, store name). The merchant reviews the claim and can edit it; no decision is made automatically regarding the end customer.

Retention period and deletion

• For the duration of the contract, tracking data and claim files are kept so that the merchant can substantiate their claims.
• Erasure request from an end customer forwarded by Shopify: that customer's orders are anonymized.
• App uninstall: access to the store is revoked; upon receipt of the deletion signal Shopify sends 48 hours later, all of the store's data (claims and documents, alerts, parcels and scans, orders, settings) is erased.

Hosting and security

Data is hosted in the European Union (Convex database, eu-west-1 region). Encryption in transit (TLS); API keys are only stored as a hash; every Shopify request is authenticated by an HMAC signature.

Your rights as a store's customer

Exercise your rights with the merchant you ordered from: they are the data controller, and we assist them in responding. If you contact us directly, we forward your request to the merchant concerned.

Purposes and legal bases

• Performance of the contract: provision of the service, management of the subscription and billing.
• Legitimate interest: responding to contact requests, product improvement, security, fraud prevention, customer support.
• Consent: sending marketing communications.
• Legal obligation: retention of billing data for accounting and tax purposes.

Retention period

Account data is kept for the entire duration of the subscription, then archived or deleted at the end of the applicable limitation period after termination, unless a longer retention period is required by law (billing data: 10 years).

Messages sent through the contact form, and the contact details accompanying them, are kept for three (3) years from the last contact with the data subject, then deleted.

Your rights

In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to and port your personal data. You can exercise these rights by writing to us at hello@heylio.io. You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), if you consider that your rights have not been respected.

Data protection officer

DPO contact: rgpd@fastoche.tech — or by post: DPO — FASTOCHE, 1004 route de Coudoux, 13122 Ventabren.

Sub-processors

We use the following sub-processors, each contractually committed to complying with the GDPR and located in the European Union or covered by a compliant transfer framework:

• Convex, Inc. — database and service execution (European Union, eu-west-1 region).
• Vercel, Inc. — hosting and delivery of the web interfaces.
• Resend — sending of service-related emails (sending claims to carriers by email is not available yet).
• OpenRouter and Anthropic — assisted drafting of claims, when turned on.

Detailed list available on request at hello@heylio.io.