Privacy policy

YourLio AI is operated by HELIOAI AGENTIC SYSTEMS PRIVATE LIMITED, a company incorporated in India (CIN U62011KA2025PTC202015), with its registered office at 10, 2nd Cross Rd, Laxmi Nagar, Hubballi, Dharwad 580030, Karnataka, India.

YourLio AI provides AI-powered customer support automation, product discovery, and CRM and retention automation for Shopify D2C brands, deployed across web chat, WhatsApp, Instagram, and Facebook Messenger.

For privacy-related queries, contact us at prakash@helioai.tech.

This policy applies to:

• Brand clients (businesses) that sign up to use the YourLio AI platform
• End customers of those brands who interact with YourLio AI powered chat interfaces on websites, WhatsApp, Instagram, or Facebook Messenger
• Visitors to yourlio.com

If you are a brand client, additional terms from the Master Service Agreement (MSA) and Data Processing Addendum (DPA) also apply to how we handle your customer data.

For our own website enquiries, business contacts, and account administration, YourLio determines why and how information is processed and acts as the controller. For a brand’s shoppers and customer conversations, the brand is the controller and YourLio processes information on its instructions. These roles determine who handles a privacy request.

From brand clients

• Business name, registered address, and company identification details
• Authorized signatory name and contact information
• Shopify store URL, API credentials, and admin access details
• Product catalog, pricing, policies, and brand content shared for AI training
• Billing information, payment records, and invoice history
• Communication history with the YourLio AI team

From end customers (via brand channels)

• Name and contact details provided during a conversation
• Order numbers, order status queries, and purchase history (via Shopify integration)
• Product questions, preferences, and browsing intent signals from chat sessions
• WhatsApp number, Instagram handle, and Facebook Messenger profile details where interactions occur on those channels
• Support queries, complaints, and return or refund requests

From website enquiries

When you use our contact form, we collect your email address, store website, phone number, and message. We use Resend to email your enquiry to our team so we can respond. Contact form submissions do not subscribe you to marketing emails.

Automatically collected

• Chat session metadata including timestamps, channel type, and session duration
• Conversation transcripts used for service delivery, quality assurance, and improvement
• Usage analytics on the YourLio AI platform dashboard
• Device and browser information from website visitors

We use data collected only for the purposes of delivering and improving our services, including AI model training for your specific brand, analytics and reporting, billing, and communication.

Our grounds for processing

Where a legal basis is required, it depends on the purpose and our role:

• Contract: delivering services you request, managing accounts, and administering billing.
• Legitimate interests: responding to business enquiries, protecting our services, and understanding service performance, subject to the rights and interests of the people concerned.
• Legal obligations: keeping required records and responding to lawful regulatory requests.
• Consent: where required for a particular activity. You may withdraw consent without affecting processing that was lawful before withdrawal.

For processing on a brand’s behalf, the brand establishes the relevant legal basis and provides instructions under our agreement. Rules about consent for cookies and similar technologies apply separately from the legal basis for processing personal data.

Brand clients remain the controller and owner of all end-customer data shared with or processed by YourLio AI. This includes:

• Customer data provided or made available to YourLio AI via Shopify or other integrations
• Conversation transcripts generated through YourLio AI powered interfaces on the brand's channels
• Any outputs, insights, analytics, or reports generated by YourLio AI using client data

YourLio AI acts as a data processor on behalf of brand clients for end-customer data. We process this data only to provide the agreed services and for no other purpose.

YourLio AI owns all rights to its platform, software, AI models, workflows, and proprietary technology. These are not transferred to clients at any point.

We do not share personal data with third parties except in the following situations:

• Sub-processors and infrastructure providers who support service delivery, bound by confidentiality obligations no less protective than this policy
• Meta for WhatsApp, Instagram, and Facebook Messenger where flows are enabled on those platforms, in line with their platform terms
• Shopify, for billing and store integration purposes
• Legal and regulatory authorities where disclosure is required by applicable law, court order, or regulatory directive

Any third party given access to data is required to protect it under written agreements consistent with our obligations. We remain responsible for their handling of such data.

Our service provider overview explains the role of our platform providers, including cloud infrastructure, AI inference, messaging, and store integration. Website enquiry processing and analytics are described in this policy.

We retain data for as long as the client relationship is active and as needed to provide the contracted services. After termination:

• We will return or securely destroy client data within 30 days of a written request
• We may retain certain records for the minimum period required by law or bona fide compliance obligations
• Conversation transcripts may be retained for up to 90 days post-termination for quality and dispute resolution purposes, unless earlier deletion is requested

Confidentiality obligations over retained data continue for a minimum of 3 years from the date of disclosure, regardless of when the service ends.

Website enquiries and business correspondence are retained while needed to respond, manage the resulting relationship, or meet legal and dispute-resolution requirements. The period depends on the purpose, the nature of the information, and any applicable recordkeeping obligations. You can request deletion using the process below; we will explain any lawful reason that prevents us from deleting particular records.

YourLio is an Indian company serving businesses internationally. Information may be processed in India and in countries where our service providers operate. Those countries may have data protection laws that differ from the laws where you live.

For transfers of personal data from the European Economic Area that require contractual safeguards, we use the European Commission’s Standard Contractual Clauses (EU SCCs). For restricted transfers from the United Kingdom, we have UK transfer safeguards in place under the applicable transfer agreement. These safeguards form part of the relevant contractual arrangements with clients and providers.

You may contact us for information about the safeguards applicable to your data, including a copy where required by law. Commercially confidential information may be redacted. If your procurement process requires a particular hosting location or residency restriction, ask us to confirm that requirement in your agreement before sharing data.

Our provider overview identifies the services involved. The European Commission’s transfer guidance explains these safeguards.

YourLio AI implements reasonable, industry-standard technical and organizational measures to protect data against unauthorized access, disclosure, alteration, and destruction. These include:

• Encrypted data transmission (TLS in transit)
• Access controls limiting data access to authorized team members only
• Regular security reviews and monitoring
• Vendor due diligence for all sub-processors

No system is completely secure. If a data breach occurs that affects your data, we will notify you as required by applicable law.

Depending on the law that applies and the circumstances of the processing, you may exercise the following rights:

• Access: request a copy of the data we hold about you
• Correction: request that inaccurate data be corrected
• Deletion: request deletion of your data where legally permitted
• Restriction: request that we limit how your data is used
• Portability: request your data in a structured, commonly used format
• Objection: object to certain processing, including direct marketing where applicable
• Withdrawal: withdraw consent where we rely on it

To exercise a right or raise a privacy concern, email prakash@helioai.tech. Describe your request and, if relevant, the store or account involved. You do not need to create an account to make a request. Please do not include passwords, API keys, or identity documents in your initial email.

We may ask for proportionate information to verify your identity or an agent’s authority before disclosing or changing personal data. We respond within the applicable legal period. If an exception or permitted extension applies, we explain the reason and any available appeal or complaint route. We do not discriminate against you for exercising your privacy rights.

Where data is processed on behalf of a brand client, that brand is the primary point of contact for exercising data rights. We will cooperate with brand clients to fulfill such requests.

The information below supplements this policy where the relevant law applies to you and our processing. Rights can have conditions and exceptions. Your location alone does not make every law applicable, and this policy does not limit rights that cannot be waived.

India

Our operating company is incorporated in India, and Indian law governs our business subject to applicable mandatory protections elsewhere. You can request access, correction, or deletion and raise a grievance through our privacy contact.

India’s Digital Personal Data Protection Act, 2023 and related rules have a phased commencement. We apply the provisions that are in force and applicable to the processing concerned. Rights under provisions that have not yet commenced are not described here as already effective. See the official commencement notification. The request process in this policy remains available to you.

European Union and European Economic Area

Where the GDPR applies, your rights include access, rectification, erasure, restriction, portability, and objection, subject to the legal conditions for each right. You may withdraw consent at any time where processing relies on consent. You may also challenge qualifying decisions based solely on automated processing that produce legal or similarly significant effects.

We generally respond within one month, with a permitted extension for complex or multiple requests and notice within the initial period. You can complain to a supervisory authority, including in the country where you live or work or where an alleged infringement occurred. See the European Commission’s information about individual rights.

United Kingdom

Where UK data protection law applies, you have rights to access, correct, erase, restrict, and port personal data, object to certain processing, and withdraw consent where relevant. Applicable protections for qualifying automated decisions also remain available.

We generally respond within one month, subject to the applicable rules on verification, clarification, and permitted extensions. You may raise a concern with the Information Commissioner’s Office. Our international transfer arrangements include safeguards for restricted UK transfers.

United States

US privacy rights vary by state and by whether a law applies to the business and processing involved. Where available, these include access to and a copy of personal data, correction, deletion, and opting out of sale, targeted advertising, or certain profiling. You may use an authorized agent where permitted and appeal a denied request where state law provides that right. Send requests and appeals to our privacy contact.

For California residents where the CCPA, as amended by the CPRA, applies, rights include knowing the categories and specific information collected, its sources, purposes, and recipients; correction; deletion; and non-discrimination. California law also provides rights to opt out of sale or sharing for cross-context behavioral advertising and to limit certain uses of sensitive personal information.

We do not sell personal data. Advertising storage and personalization are disabled in our website analytics integration. The information we collect, disclosures, and analytics practices are described above and below. For California access, correction, and deletion requests, the usual response period is 45 days, with up to an additional 45 days where permitted and notified. See the California Attorney General’s privacy rights guidance.

Canada

Where PIPEDA or applicable provincial privacy law applies, you may request access to information about you, challenge its accuracy, request correction, and raise a complaint about its handling. Consent may be withdrawn subject to legal or contractual restrictions and reasonable notice. PIPEDA access requests generally require a response within 30 days, with limited extensions. You may contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority.

Australia

Where the Privacy Act and Australian Privacy Principles apply, you may request access to or correction of your personal information and complain about its handling. We consider requests within the applicable period and explain any lawful refusal. You can raise an unresolved complaint with the Office of the Australian Information Commissioner.

Switzerland

Where the Swiss Federal Act on Data Protection applies, you may request information about processing, correction of inaccurate data, and deletion or restriction where available. Information requests are generally answered within 30 days, subject to lawful exceptions. The Federal Data Protection and Information Commissioner explains the available rights and remedies.

Other countries and regions

You can use the same privacy contact and request process wherever you are located. If your country provides additional mandatory rights, response periods, or complaint routes that apply to our processing, those protections continue to apply. Tell us the country relevant to your request so we can assess it under the appropriate rules.

Our business website and platform accounts are intended for adult business representatives. Brands are responsible for determining whether their storefronts serve children and for providing any required notices and obtaining necessary permissions. If you believe a child’s information has been provided improperly, contact us so we can investigate with the relevant brand and take appropriate action.

YourLio uses customer questions, preferences, conversation history, and store information to support shopping recommendations and customer service. These tools are not intended to make employment, credit, insurance, or similar eligibility decisions. Brands remain responsible for how they use outputs. If you have a concern about an automated interaction, request human review from the brand or contact us for help routing your request.

The YourLio AI web chat widget uses session-based cookies and local storage to maintain conversation context during a user session. These do not track users across third-party websites.

Our website at yourlio.com uses Google Analytics 4 to measure traffic sources, page visits, and actions such as demo requests, and PostHog to understand journeys and replay website interactions. These providers process analytics data for us. Analytics cookies and browser storage may be used to connect activity across visits. Advertising storage and advertising personalization are disabled in this integration.

Session replay reconstructs interactions on our website, such as clicks, scrolling, and navigation. Form inputs are masked, and forms and embedded frames are excluded from replay. We do not send contact form contents as analytics event properties. Analytics and replay load automatically after the page loads. The cookie notice is informational; dismissing it does not change analytics collection.

Users can control cookies through their browser settings. Disabling cookies may affect chat functionality.

This Privacy Policy is governed by the laws of India. Disputes are subject to the jurisdiction of courts in Bengaluru, Karnataka, India, except where applicable mandatory law gives you rights to another forum or remedy.

Nothing in this policy limits mandatory local privacy rights, your right to complain to a competent data protection authority, or other remedies available under applicable law.

We may update this Privacy Policy from time to time. When we do, we will update the date shown on this page. Material changes will be communicated to active clients by email.

Where a change requires consent or another step under applicable law, a policy update alone does not replace that requirement.