Privacy notice

Who is responsible

Craig Gorton trading as Sellhelm, of Deal Street, Bury, BL9 7PU, is the "controller" of the personal information described here: we decide why and how it is used. You can contact us about it at support@sellhelm.co.uk or by post at that address. We are small enough not to need a data protection officer.

The program collects nothing

The Sellhelm program runs on your computer and stores its data there. It has no account, analytics or tracking, and it does not send information to us. It only connects to eBay and to the supplier websites you ask it to read. Your eBay keys, orders and buyers' details never reach us. This notice is about our website and about you as our customer or enquirer.

What we collect, why, and our legal basis

The law says we must have a lawful reason ("basis") for each use. Ours are: contract (we need it to sell you Sellhelm and support it), legal obligation (for example tax records) and legitimate interests (running the shop safely and sensibly, where that does not override your rights). None of this relies on your consent, so there is nothing to withdraw. We do not sell your information, use it for advertising, or make automated decisions about you. You do not have to give us your details, but without your name, email address and payment we cannot sell you Sellhelm, and without a Machine ID we cannot make your licence key.

When you buy: your email address and name, your order and payment references, the pack bought, the price and time, and the time and version of the terms you accepted. Stripe collects your card details and any billing address; we do not receive your card number. Why: to sell to you, send your order confirmation and invoice, keep our accounts. Basis: contract, and legal obligation for accounting records.
Your licences: the Machine ID you send for each computer (a code worked out from that computer's Windows identifier), an optional name for the computer, and the licence key we make for it (the key contains your email address, the order number and that Machine ID, and is checked by Sellhelm on your own computer), with a history of what was done to it, including the computers a licence was moved away from. Why: to issue and manage your keys. Basis: contract.
Your account: your password (stored only as a one-way scrambled hash), when you last signed in, and your choice about emails for new versions. When you sign in we record your IP address and browser details for security, and which files you download and when. Why: to give you access, keep accounts secure, spot licence abuse and handle disputes. Basis: contract and legitimate interests.
Support: the messages and diagnostics reports you send us and our replies. The diagnostics report is designed to contain no keys, orders or buyer details. Why: to help you. Basis: contract.
Contact form: your name (if you give it), email address and message, and our replies. Why: to answer you. Basis: legitimate interests (answering people who write to us) or, if you are asking about a purchase, contract.
Shop requests: the shop's address, your note and, only if you choose to give one, your email address, so we can tell you when it is added. Basis: legitimate interests.
Emails: a copy of the messages we send you, such as your order confirmation and licence key. Why: so we and you can see what was sent. Basis: contract and legitimate interests.
Emails about new versions. If you have bought Sellhelm we may email you when a new version of it is ready. That is about the product you bought, not advertising, and every one of these emails has a link to stop them, or you can switch them off under Account. Basis: legitimate interests. Order, licence, password and support emails are part of the service and always continue.

Who else sees it

Stripe processes payments. It is separately responsible for the payment details it collects; see stripe.com/gb/privacy. It may process information outside the UK.
Our email provider delivers the messages we send you.
Our hosting provider runs the server this website is on.
Our accountant and HMRC may see order and payment records.
Someone else if the law or a court requires it, or to protect our legal rights. We do not share your details with anyone else.

Where a provider processes information outside the UK, we rely on the UK's approved safeguards (an adequacy decision or the standard contract clauses) so that it is protected to the same standard.

How long we keep it

Order, payment and invoice records: six years from the end of the tax year they relate to, because tax law requires it.
Licence records (Machine IDs, keys and their history): for as long as the licence is active and then up to six years, so we can prove what was sold.
Support tickets and contact-form messages: two years after they are closed or last answered, then deleted.
Copies of emails we sent, and shop requests: two years, then deleted (for shop requests, your email address and note are removed and only the shop's address is kept).
IP addresses in download records: 90 days, then removed. Sign-in records expire automatically (within 30 days, and within 8 hours for staff). Our security log is kept for two years.
Backups: a nightly copy of our database is kept for 14 days, so something we delete is gone from our backups within two weeks.
When you ask us to erase your account, we remove your name, email address, messages and other personal details and keep only the order and licence records we are legally required to keep, without your personal details where we can.

Cookies

We use one essential cookie to keep you signed in to your account. It is needed for the service you asked for, so the law does not require your consent, and there is no cookie banner. We do not use analytics, advertising or tracking cookies, and we load no scripts, fonts or images from other websites, with one exception: the payment page shows Stripe's payment form inside our page, so that page loads Stripe's code (from js.stripe.com) and Stripe may set its own cookies for fraud prevention and to process the payment; they are described on Stripe's site.

Keeping it safe

The website uses an encrypted (https) connection, passwords are stored only as scrambled hashes, and access to the administration area is limited to us. No system is perfect: if a breach ever puts your information at real risk we will tell you and the Information Commissioner as the law requires.

Your rights

You can ask to see the information we hold about you, to have it corrected or erased, to restrict or object to how we use it (including the emails about new versions), and to receive a copy you can move elsewhere. Some rights are limited where the law requires us to keep records. Write to support@sellhelm.co.uk; we will normally reply within one month and will not charge you. You can turn off new-version emails yourself at any time under Account.

Complaints

If you are unhappy with how we handle your information, please tell us first, by email at the address above or through the contact page. We will acknowledge your complaint within 30 days (usually much sooner), look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes

If we change this notice in a way that matters, we will change the date at the top and tell customers by email.