HelloMeThis agreement forms part of the live chat service terms. It applies from the moment a conversation opens on your site, with nothing for you to sign.
For any question about this agreement, or to exercise a right described here, write to support@gracelab.io.
1.Who does what
For your support conversations you are the controller: you decide what your visitors are asked and what you do with it. GRACELAB OPEN TECH SARL acts as processor: we process that data to provide the service, and for nothing else.
For your agents' own HelloMe accounts — their profile, their personal chats, their history — we remain the controller: that account is theirs and does not become yours because they answer for you.
2.What we process, and about whom
| Data | People concerned | Why |
|---|---|---|
| Name, e-mail address, number typed into the window | Your visitors | So you can recognise them and get back to them |
| Messages, photos, voice notes, documents exchanged | Your visitors and your agents | To hold the conversation and its history |
| Page of origin, language, approximate country, browser | Your visitors | To give the agent the context of the request |
| Identity signed by your server, when you send one | Your customers already signed in with you | To avoid asking again for what you already know |
| Call minutes, assistant units, number of conversations | Your company | To count what is billed |
| Log of administrative acts | Your agents | So it can be said who did what |
We never ask your visitors for sensitive data. If you collect any through your own questions, that is your decision and your responsibility.
3.Our instructions are yours and no more
- We process this data only to provide, maintain and secure the service.
- We do not sell it, rent it, or use it for advertising.
- We train no artificial intelligence model on your customers' conversations.
- When the assistant answers in your absence, the text of the conversation and the brief you wrote are sent to the model provider to produce that one answer, and are not kept by them for training.
- If a law requires us to process beyond your instructions, we tell you first, unless that law forbids it.
4.What we put in place
- Encryption in transit on every connection, including the window's.
- Separation by workspace checked on every request: a key never reaches another company's data.
- Public key and secret kept apart; the signing secret never leaves our servers and is never shown again.
- Our own teams' access limited to what is needed, traced, and with no way to read conversations from the operations console.
- Rate limits per visitor, per address and per workspace, against automated abuse.
- An audit log of administrative acts, kept for a year.
5.Sub-processors
We use providers to host the service and to carry certain messages. They act only on our instructions and are held to the same obligations.
| Provider | What it does | Where |
|---|---|---|
| Service host | Servers, database, file storage | Stated in the legal notice |
| E-mail provider | Transcripts and service messages | European Union |
| Audio and video call provider | Carrying calls, without keeping their content | Worldwide network |
| Assistant model provider | Writing automatic answers, without training | European Union or United States |
Any change of sub-processor is announced at least thirty days ahead. You may object on serious grounds; failing agreement, you may end the service at no cost for the remaining period.
6.Your customers' rights
A visitor comes to you to reach, correct or erase their data. The service gives you what you need to answer without us: a full export of your workspace, and erasure of a customer on request.
- A visitor may also ask for erasure from their own window: their messages, their conversations with you and their carrier account are then deleted.
- If a visitor writes to us directly, we point them to you and tell you within five working days.
- We help you, so far as is reasonable, with an impact assessment or a request from an authority.
7.If there is a breach
If we find a breach affecting your data, we tell you without undue delay and within forty-eight hours at the latest, with what we know: what happened, what is affected, what we are doing, and what you can do. Notifying the authority is yours, since you are the controller; we give you what you need to do it.
8.At the end
When the service ends you have thirty days to export. After that your data is deleted from our live systems, and from backups within ninety days. We keep only what a legal obligation requires us to keep, and only for as long as it requires.
These documents are written and checked in French and in English. The French version is the reference for readers in French-speaking countries; the English version applies everywhere else. Whatever language HelloMe is displayed in, only these two versions are binding.