Terms of sale and use

1. Purpose

These terms of sale and use (the "Terms") govern access to and use of the HeyTracker service, a software-as-a-service (SaaS) solution for e-commerce parcel tracking and carrier claims management, published by FASTOCHE (see legal notice). Any subscription to a HeyTracker plan implies full and unreserved acceptance of these Terms.

Business customers only. The service is intended exclusively for professionals — natural or legal persons acting in the course of their commercial, industrial, craft or liberal profession activity — and is not offered to consumers. By subscribing, the customer declares that it is acting for professional purposes. The provisions of the French Consumer Code specific to contracts concluded with consumers, in particular the right of withdrawal and recourse to a consumer mediator, do not apply.

2. Subscription and billing

HeyTracker is offered as a tiered monthly subscription, including a free plan, each plan including a volume of parcels tracked per month according to the schedule published on the Pricing page. Beyond the volume included in a paid plan, each additional parcel is billed at the public unit price shown on that page, which prevails over any earlier statement; beyond the highest tier, a custom proposal is made. Prices are stated exclusive of tax (excl. VAT) and are subject to the applicable VAT. Billing is monthly, under the terms set out at the time of subscription.

3. Term and termination

The subscription is entered into without any minimum term, unless otherwise expressly stated and accepted by the customer (in particular for custom plans). It renews tacitly each month. Either party may terminate the subscription at any time, with thirty (30) days' notice, by email to hello@heylio.io or from the customer area. Termination takes effect at the end of the current billing period; no pro rata refund is due unless otherwise required by law.

4. Customer obligations

The customer is responsible for the accuracy of the information entered when configuring the service (look and content of the tracking page, alert time limits, claims settings) and for its compliance with the regulations applicable to its business. The customer alone decides whether to send claims to its carriers and whether to accept any compensation.

5. Liability

HeyTracker uses reasonable means to ensure the availability and reliability of the service, without guaranteeing that it will be entirely free of interruptions. The publisher's liability, for all damages combined, shall not exceed the total amount paid by the customer for the subscription during the twelve (12) months preceding the event giving rise to the claim.

6. Personal data

The processing of personal data collected through the use of the service is described in our privacy policy. Where the customer entrusts HeyTracker with personal data of its own customers, Article 7 below serves as the data processing agreement.

7. Data processing agreement (DPA)

This article constitutes the data processing agreement entered into between the customer and FASTOCHE within the meaning of Article 28 of the GDPR (Regulation (EU) 2016/679). It prevails over any other provision of the Terms as regards the processing of personal data entrusted by the customer.

7.1 Roles of the parties

The customer is the controller of the personal data of its end customers and staff that it entrusts to the service. FASTOCHE acts as processor and processes such data only on behalf of the customer and on its instructions. FASTOCHE remains the controller of the data relating to its own customer account (identity, billing, connection logs), described in the privacy policy.

7.2 Subject matter, duration, nature and purpose of the processing

• Subject matter: provision of the parcel tracking, tracking page and carrier claims management service described in Article 1.
• Duration: the term of the subscription, extended by the return and deletion period provided for in Article 7.9.
• Nature: collection through the API of the customer's e-commerce platform, queries to carriers, recording, consultation, display to end customers on the tracking page, transmission to carriers as part of claims, anonymization and deletion.
• Purpose: tracking the customer's shipments, informing its end customers about delivery, alerting the customer of delays and exceptions, and preparing its claims with carriers.
• Data subjects: end customers of the customer who placed an order that was shipped; members of the customer's staff using the service.
• Categories of data: limited identity and contact details (email, first name, last name, postal code, city, country), order data (items, amounts), shipping and tracking data (carrier, numbers, events, pickup point), claim documents (proof of shipment, proof of value, amounts). No so-called sensitive data (Article 9 of the GDPR) is required by the service.

7.3 Documented instructions

FASTOCHE only processes data on the customer's documented instructions. The following constitute instructions: these Terms, the configuration of the service by the customer (look of the tracking page, alert time limits, claims settings), the actions taken by its users in the interface, and the compliance signals sent by the e-commerce platform on its behalf. FASTOCHE only processes aggregated, anonymous data for its own purposes.

7.4 Confidentiality

Only authorised personnel of FASTOCHE, bound by a duty of confidentiality, access the data, strictly to the extent necessary for operating and supporting the service. Such access is personal, time-limited and logged.

7.5 Security

FASTOCHE implements technical and organisational measures appropriate to the risk (Article 32 of the GDPR), including: encryption of data in transit (TLS) and at rest; application-level encryption of access tokens and integration secrets; role-based access control; separation of test and production environments; encrypted backups; incident monitoring; logging of sensitive actions.

7.6 Sub-processors

The customer gives FASTOCHE general authorisation to engage the following sub-processors, bound by obligations equivalent to those of this article:

• Convex, Inc. — database and service execution (European Union, eu-west-1 region).
• Vercel, Inc. — hosting and delivery of the web interfaces.
• Resend — sending of service-related emails (sending claims to carriers by email is not available yet).
• OpenRouter and Anthropic — assisted drafting of claims, when turned on.

Providers that the customer chooses to activate in the service (carriers, logistics providers, customer service tools…) are recipients designated by the customer, which contracts with them directly; they are not sub-processors of FASTOCHE. FASTOCHE informs the customer of any addition or replacement of a sub-processor at least thirty (30) days before it takes effect. The customer may object on legitimate grounds within that period; failing agreement, it may terminate the subscription free of charge. The up-to-date list is available on request at hello@heylio.io.

7.7 Assistance to the customer

FASTOCHE assists the customer in fulfilling its obligations: responding to requests from data subjects to exercise their rights (access, rectification, erasure, restriction, objection, portability), data protection impact assessments and prior consultations with the supervisory authority. Any request from a data subject received directly by FASTOCHE is forwarded to the customer within five (5) business days, without responding to it on the merits. For Shopify stores, erasure requests forwarded by the platform are handled automatically (the orders concerned are anonymized); access requests are recorded automatically and the corresponding data handed over to the customer.

7.8 Personal data breach

FASTOCHE notifies the customer of any personal data breach affecting the data processed on its behalf without undue delay and no later than forty-eight (48) hours after becoming aware of it, so that the customer can notify the supervisory authority within the seventy-two (72) hour period provided for in Article 33 of the GDPR. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point.

7.9 End of processing: return and deletion

When the app is uninstalled or the subscription ends, access to the customer's store is revoked. For Shopify, all of the store's data is erased upon receipt of the deletion signal the platform sends forty-eight (48) hours after uninstall. Beyond that, FASTOCHE only keeps billing data subject to a legal retention obligation.

7.10 Audits

FASTOCHE makes available to the customer the information necessary to demonstrate compliance with this article. The customer may, no more than once a year, at its own expense and with thirty (30) days' notice, carry out an audit itself or have it carried out by an independent auditor bound by confidentiality, during business hours and without disrupting the service.

7.11 Transfers outside the European Union

Where a sub-processor is established outside the European Union or accesses the data from a third country, the transfer is governed by an adequacy decision or by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.

7.12 Liability

Each party is liable for breaches of its own obligations under the GDPR. The limitation of liability in Article 5 applies to the obligations under this article, unless otherwise required by mandatory law.

8. Governing law and disputes

These Terms are governed by French law. In the event of a dispute, an amicable solution will be sought first; failing that, the competent courts shall be those within the jurisdiction of the publisher's registered office, unless otherwise required by public policy provisions.