What the program sends us
The Sellhelm program runs on your computer and stores its data there. It has no account, analytics or tracking. It connects to eBay and to the supplier websites you ask it to read. It sends information to us in two situations only, both about your license. (1) When you enter a license key, and if you choose "Revoke this license", it sends the license key, this computer's Machine ID and the program version, so we can record that the license is in use (or no longer in use), see that against your order, and stop a refunded license being used. (2) About once a day it downloads a public list of cancelled computers (as one-way hashes, not names) from our website. Like any request to a website, that shows your IP address to our server, which we do not store against your license. If the program cannot connect, it carries on working. Your eBay keys, orders, products and buyers' details never reach us. The rest of this notice is about our website and about you as our customer or enquirer.
What we collect, why, and our legal basis
The law says we must have a lawful reason ("basis") for each use. Ours are: contract (we need it to sell you Sellhelm and support it), legal obligation (for example tax records) and legitimate interests (running the shop safely and sensibly, where that does not override your rights). None of this relies on your consent, so there is nothing to withdraw. We do not sell your information, use it for advertising, or make automated decisions about you. You do not have to give us your details, but without your name, email address and payment we cannot sell you Sellhelm, and without a Machine ID we cannot make your license key.
- When you buy: your email address, your name and billing address (from the payment form, for your invoice and our records), your order and payment references, the pack bought, the price and time, and the time and version of the terms you accepted. Stripe collects your card details; we do not receive your card number. Why: to sell to you, send your order confirmation and invoice, keep our accounts. Basis: contract, and legal obligation for accounting records.
- When you visit this website: we count visits ourselves, so we know which pages help people and whether the site is found in search. For each page you read we note the page, the time, the website you came from (if any), the country your connection appears to be in, the kind of device (phone, tablet or computer) and a "visitor code". We work the country out on our own server from a public list and then discard your address, so only the country is kept. The code is a one-way scramble of your connection and browser with a random number that we delete every night, so it cannot be turned back into you and cannot follow you from one day to the next. We do not store your IP address, we set no cookie, and nothing is sent to anyone else. If your browser sends "Do Not Track" or Global Privacy Control, we do not count you at all. Why: to run and improve the website. Basis: our legitimate interest in doing so, which we think has very little effect on your privacy.
- Your licenses: the Machine ID you send for each computer (a code worked out from that computer's Windows identifier), an optional name for the computer, and the license key we make for it (the key contains your email address, the order number and that Machine ID, and is checked by Sellhelm on your own computer), with a history of what was done to it, including the computers a license was moved away from, the date the program first activated it, when it last checked in, and when you revoked it if you did. Why: to issue and manage your keys, and to make sure a refunded license is not still used. Basis: contract and legitimate interests.
- Your account: your password (stored only as a one-way scrambled hash), when you last signed in, and your choice about emails for new versions. When you sign in we record your IP address and browser details for security, and which files you download and when. Why: to give you access, keep accounts secure, spot license abuse and handle disputes. Basis: contract and legitimate interests.
- Support: the messages and diagnostics reports you send us and our replies. The diagnostics report is designed to contain no keys, orders or buyer details. Why: to help you. Basis: contract.
- Contact form: your name (if you give it), email address and message, and our replies. Why: to answer you. Basis: legitimate interests (answering people who write to us) or, if you are asking about a purchase, contract.
- Shop requests: the shop's address, your note and, only if you choose to give one, your email address, so we can tell you when it is added. Basis: legitimate interests.
- Emails: a copy of the messages we send you, such as your order confirmation and license key. Why: so we and you can see what was sent. Basis: contract and legitimate interests.
- Emails about new versions. If you have bought Sellhelm we may email you when a new version of it is ready. That is about the product you bought, not advertising, and every one of these emails has a link to stop them, or you can switch them off under Account. Basis: legitimate interests. Order, license, password and support emails are part of the service and always continue.
Who else sees it
- Stripe processes payments. It is separately responsible for the payment details it collects; see stripe.com/gb/privacy. It may process information outside the UK.
- Our email provider delivers the messages we send you.
- Our hosting provider runs the server this website is on.
- Our accountant and HMRC may see order and payment records.
- Someone else if the law or a court requires it, or to protect our legal rights. We do not share your details with anyone else.
Where a provider processes information outside the UK, we rely on the UK's approved safeguards (an adequacy decision or the standard contract clauses) so that it is protected to the same standard. If you use the US site, you should know that your information is sent to us in the United Kingdom and kept there and by the providers listed above. We give everyone the rights listed under "Your rights" below, wherever they live.
How long we keep it
- Order, payment and invoice records: six years from the end of the tax year they relate to, because tax law requires it.
- License records (Machine IDs, keys and their history): for as long as the license is active and then up to six years, so we can prove what was sold.
- Support tickets and contact-form messages: two years after they are closed or last answered, then deleted.
- Copies of emails we sent, and shop requests: two years, then deleted (for shop requests, your email address and note are removed and only the shop's address is kept).
- IP addresses in download records: 90 days, then removed. Sign-in records expire automatically (within 30 days, and within 8 hours for staff). Our security log is kept for two years. Like every website, our web server keeps an ordinary access log (the page asked for, the visitor's IP address and the time) for up to 14 days, for security and fault-finding.
- Website visit counts: the page-by-page counts described above are kept for 13 months, then deleted. The nightly random number is deleted the next day.
- Backups: a nightly copy of our database is kept for 14 days, so something we delete is gone from our backups within two weeks.
- When you ask us to erase your account, we remove your account, email address, messages and other personal details. We keep the order and license records we are legally required to keep, and for those orders that includes the name and billing address on the order, because our accounts need them; they are kept for the six years above.
Cookies
We use one essential cookie to keep you signed in to your account. It is needed for the service you asked for, so the law does not require your consent, and there is no cookie banner. We do not use analytics, advertising or tracking cookies (we count visits ourselves, without cookies, as described above), and we load no scripts, fonts or images from other websites, with one exception: the payment page shows Stripe's payment form inside our page, so that page loads Stripe's code (from js.stripe.com) and Stripe may set its own cookies for fraud prevention and to process the payment; they are described on Stripe's site.
Keeping it safe
The website uses an encrypted (https) connection, passwords are stored only as scrambled hashes, and access to the administration area is limited to us. No system is perfect: if a breach ever puts your information at real risk we will tell you and the Information Commissioner as the law requires.
Your rights
You can ask to see the information we hold about you, to have it corrected or erased, to restrict or object to how we use it (including the emails about new versions), and to receive a copy you can move elsewhere. Some rights are limited where the law requires us to keep records. Write to support@sellhelm.co.uk; we will normally reply within one month and will not charge you. You can turn off new-version emails yourself at any time under Account.
Complaints
If you are unhappy with how we handle your information, please tell us first, by email at support@sellhelm.co.uk or through the contact page. We will acknowledge your complaint within 30 days (usually much sooner), look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes
If we change this notice in a way that matters, we will change the date at the top and tell customers by email.