Privacy notice

What the program sends us

The Sellhelm program runs on your computer and stores its data there. It has no account, analytics or tracking. It connects to eBay and to the supplier websites you ask it to read. It sends information to us in ten situations only, four about your license, updates and add-ons, and six only if you use the research and drafting tools. (1) When you enter a license key, and if you choose "Revoke this license", it sends the license key, this computer's Machine ID and the program version, so we can record that the license is in use (or no longer in use), see that against your order, and stop a refunded license being used. While the program is running it sends the same three things about every half hour to renew its license (see the license terms above). (2) About once a day it downloads a public list of canceled computers (as one-way hashes, not names) from our website, and a public list of eBay VeRO brand names to check your drafts against; both are downloads, and neither sends anything of yours. (3) Only if you use Product research, when a product reaches the AI photo check described in (5) it asks our website to count one search credit (and to give it back if the check cannot be finished): that request carries your license key, this computer's Machine ID, the market and a reference for the product, and never the product's details, your prices, your shop or any buyer. (4) Only if you use Competitor research and ask it to find the supplier of another seller's eBay listing, it sends us that listing's title and picture address (and, where the listing has them, its barcode or part number) so our website can search the web and compare pictures for you, together with your license key so your search credits can be counted and a credit given back when nothing is found. We keep the words searched and the results for a few days so a repeat search is quick; they describe a public listing, not your shop. (5) Only if you use Product research, and only for a product that already looks profitable, it sends us the titles and picture addresses of the supplier’s product and of an eBay listing, together with your license key and Machine ID, so our website can have an AI model, provided by Anthropic, look at the two public product photographs and say whether they show the same product. Nothing about you, your shop, your prices or any buyer is sent. The pictures are fetched and passed on without being kept, and we keep only the answer, for 30 days, so the same pair is not checked twice. If the check is switched off or cannot be reached, the program carries on without it. (6) Only if you press the AI title writer in one of your drafts, it sends us that draft's product title, brand, part number, specifications, bullet points, item specifics and description (the product's own details, as read from the supplier), with some phrases eBay buyers search for and the titles of some public eBay listings it looked up, together with your license key and Machine ID, so our website can have an AI model, provided by Anthropic, write a title; one search credit is counted, and given back if no title is produced. We keep a record that a title was requested (when, for which license, and what it cost us), not the title or the product details. Nothing about you, your shop, your prices or any buyer is sent. (7) Only if you press the AI description writer in one of your drafts, it sends us that draft's product title, brand, color, opening text, selling points, feature blocks, specification and box contents (the product's own details, as read from the supplier), together with your license key and Machine ID, so our website can have an AI model, provided by Anthropic, rewrite the description; search credits are counted, and all given back if nothing usable is produced. We keep a record that a description was requested (when, for which license, and what it cost us), not the text or the product details. Nothing about you, your shop, your prices or any buyer is sent. (8) Only if you press the AI main photo button in one of your drafts, it sends us small copies (about 640 pixels wide, not the full pictures) of up to six of that product’s photographs (the supplier’s public product photographs, as your program downloaded them) and the product title, together with your license key and Machine ID, so our website can have an AI model, provided by Anthropic, say which of the photographs is a clean product shot on a plain background; one search credit is counted, and given back if no photograph is suitable. The small copies are passed on without being kept, and we keep only a record that the request was made (when, for which license, and what it cost us). The studio picture itself is made on your own computer, from the full photograph, and never leaves it; it reaches eBay only if you choose to use it and then list the product. Nothing about you, your shop, your prices or any buyer is sent. (9) Every few hours, and when you press Check for updates, it asks our website whether a newer version is available, sending your license key, this computer's Machine ID, the version you run and whether it is the UK or US edition; if you press Update now it asks for the installer file with the same details, and the file is checked against a signature before it is run. (10) It asks our website which add-ons (such as Tracking) your license includes, sending your license key and Machine ID. Like any request to a website, that shows your IP address to our server, which we do not store against your license. If the program cannot connect, it carries on working. Your eBay keys, your own listings, orders, products and buyers' details never reach us. The rest of this notice is about our website and about you as our customer or enquirer.

What we collect, why, and our legal basis

The law says we must have a lawful reason ("basis") for each use. Ours are: contract (we need it to sell you Sellhelm and support it), legal obligation (for example tax records) and legitimate interests (running the shop safely and sensibly, where that does not override your rights). None of this relies on your consent, so there is nothing to withdraw. We do not sell your information, use it for advertising, or make automated decisions about you. You do not have to give us your details, but without your name, email address and payment we cannot sell you Sellhelm, and without a Machine ID we cannot make your license key.

• When you buy: your email address, your name and billing address (from the payment form, for your invoice and our records), your order and payment references, the pack bought, the price and time, and the time and version of the terms you accepted. Stripe collects your card details; we do not receive your card number. Why: to sell to you, send your order confirmation and invoice, keep our accounts. Basis: contract, and legal obligation for accounting records.
• When you visit this website: we count visits ourselves, so we know which pages help people and whether the site is found in search. For each page you read we note the page, the time, the website you came from (if any), the country and town your connection appears to be in, your IP address, the kind of device (phone, tablet or computer), the language your browser is set to, any campaign tag on the link that brought you (such as utm_source), whether the request looks like it came from an automated tool, and a "visitor code". We work the country and town out on our own server from a public list of address ranges (nothing is sent to anyone to do it). The town is a rough guide and is often where your internet provider is, not where you are. Your IP address is kept with the visit for 30 days and then deleted; the country and town stay with the visit. The code is a one-way scramble of your connection and browser with a random number that we delete every night. To tell a new visitor from one who has come back, we also put a small first-party cookie in your browser holding a random number (not your name, email or address), and we keep only a one-way scramble of it with each visit; it lasts 12 months. That is what lets us count how many different people visit and how many return. A small script on our own pages (loaded from this website, not from anyone else) also tells us, for a page that really was open in your browser, how long it was on screen, how far down you scrolled, whether you clicked, typed or scrolled, and the width of your window. It goes against the same nightly code, and it is how we tell people from robots and learn which pages get read. We keep your IP address for 30 days and nothing is sent to anyone else. We use it to tell visits from the same connection apart, to spot automated traffic and abuse, and to keep the site secure. If you open our payment page, we also note, against that payment, how you first and most recently arrived (for example 'from a search engine', or a campaign tag) and which pages those visits began on, using the same visitor cookie; this holds no name, email address or address, and is kept for as long as the order record, so that we can tell which parts of the website lead to customers. You can switch the counting off at any time with the button under "Cookies" below. If your browser sends "Do Not Track" or Global Privacy Control, we do not count you at all. Why: to run and improve the website. Basis: our legitimate interest in doing so, which we think has very little effect on your privacy.
• Your licenses: the Machine ID you send for each computer (a code worked out from that computer's Windows identifier), an optional name for the computer, and the license key we make for it (the key contains your email address, the order number and that Machine ID, and is checked by Sellhelm on your own computer), with a history of what was done to it, including the computers a license was moved away from, the date the program first activated it, when it last checked in, and when you revoked it if you did. Why: to issue and manage your keys, and to make sure a refunded license is not still used. Basis: contract and legitimate interests.
• Your account: your password (stored only as a one-way scrambled hash), when you last signed in, and your choice about emails for new versions. When you sign in we record your IP address and browser details for security, and which files you download and when. Why: to give you access, keep accounts secure, spot license abuse and handle disputes. Basis: contract and legitimate interests.
• If you link Discord: only if you choose to, in your account settings. We keep a one-time link code (as a one-way hash, for a month at most), your Discord user id and Discord username, and when you linked. It lets our Discord community check you are a current customer and give you a Verified role; it is not shared with anyone else. You can unlink at any time in your account settings, and erasing your account removes it. Basis: your consent.
• Support: the messages and diagnostics reports you send us and our replies. The diagnostics report is designed to contain no keys, orders or buyer details. Why: to help you. Basis: contract.
• Affiliate program: if you join, your name, email address, PayPal email address, how you plan to share Sellhelm (if you say), your link's code and click totals, the sales your link brought in (the pack and the date, never the buyer's name or address), and your payouts. If you arrive on an affiliate's link we also set a small cookie holding only the affiliate's code and the time (see Cookies below), so that a purchase can be credited to them. Why: to run the program and pay commission. Basis: contract with the affiliate, legal obligation for payment records, and legitimate interests in crediting the person who referred a sale.
• Contact form: your name (if you give it), email address and message, and our replies. Why: to answer you. Basis: legitimate interests (answering people who write to us) or, if you are asking about a purchase, contract.
• Shop requests: the shop's address, your note and, only if you choose to give one, your email address, so we can tell you when it is added. Basis: legitimate interests.
• Emails: a copy of the messages we send you, such as your order confirmation and license key. Why: so we and you can see what was sent. Basis: contract and legitimate interests.
• Emails about new versions. If you have bought Sellhelm we may email you when a new version of it is ready. That is about the product you bought, not advertising, and every one of these emails has a link to stop them, or you can switch them off under Account. Basis: legitimate interests. Order, license, password and support emails are part of the service and always continue.

Who else sees it

• Stripe processes payments. It is separately responsible for the payment details it collects; see stripe.com/gb/privacy. It may process information outside the UK.
• Anthropic runs the AI models behind Sellhelm’s AI tools (the photo check, the title writer, the description writer and the main photo chooser), only when you press one of those buttons, and only with what the description above says is sent. It is separately responsible for what it receives; see anthropic.com/legal/privacy.
• Our email provider delivers the messages we send you.
• Our hosting provider runs the server this website is on.
• Our accountant and HMRC may see order and payment records.
• Someone else if the law or a court requires it, or to protect our legal rights. We do not share your details with anyone else.

Where a provider processes information outside the UK, we rely on the UK's approved safeguards (an adequacy decision or the standard contract clauses) so that it is protected to the same standard. If you use the US site, you should know that your information is sent to us in the United Kingdom and kept there and by the providers listed above. We give everyone the rights listed under "Your rights" below, wherever they live.

How long we keep it

• Order, payment and invoice records: six years from the end of the tax year they relate to, because tax law requires it.
• License records (Machine IDs, keys and their history): for as long as the license is active and then up to six years, so we can prove what was sold.
• Support tickets and contact-form messages: two years after they are closed or last answered, then deleted.
• Copies of emails we sent, and shop requests: two years, then deleted (for shop requests, your email address and note are removed and only the shop's address is kept).
• IP addresses in download records: 90 days, then removed. Sign-in records expire automatically (within 30 days, and within 8 hours for staff). Our security log is kept for two years. Like every website, our web server keeps an ordinary access log (the page asked for, the visitor's IP address and the time) for up to 14 days, for security and fault-finding.
• Discord link: until you unlink it or your account is erased. Link codes are removed within a month.
• Website visit counts: the page-by-page counts described above (country and town included) are kept for 13 months, then deleted; the IP address on each visit is deleted after 30 days (and is gone from our backups about a month after that). The nightly random number is deleted the next day.
• Backups: copies of our database are taken every hour and kept on two servers for up to 30 days, so something we delete is gone from our backups within about a month.
• When you ask us to erase your account, we remove your account, email address, messages and other personal details. We keep the order and license records we are legally required to keep, and for those orders that includes the name and billing address on the order, because our accounts need them; they are kept for the six years above.

Cookies

We use one essential cookie to keep you signed in to your account. It is needed for the service you asked for, so the law does not require your consent. We also use optional advertising cookies from Meta (Facebook and Instagram), set only if you press Accept on the banner: they let us see which of our adverts led to a visit or a purchase, and show our adverts to people who have visited. Nothing from Meta loads, and no Meta cookie is set, unless you accept. You can change your choice at any time with the button below. We also use optional cookies from Google Analytics, set only if you press Accept on the banner: they let us see, in aggregate, which pages are found in search and read, where visitors come from, whether visitors reach the prices and the payment page, and which visits ended in a confirmed purchase (the amount, the currency and the payment reference, never your name, email address, license key or card details). We tell Google Analytics the page you are on with everything after the address removed, apart from campaign tags such as utm_source, and we switch off its advertising and cross-site features. Nothing from Google Analytics loads, and no Google Analytics cookie is set, unless you accept; if you decline, change nothing: the site works the same and our own private counting above carries on, which does not use Google. You can change your choice at any time with the button below. We also set one anonymous visitor cookie (called sh_v, set only on the pages you read, 12 months) so that we can count different and returning visitors on our own server. It is used only to count and improve the website, never for advertising, is never shared with anyone, and is not set at all if your browser sends Do Not Track or Global Privacy Control, or if you switch counting off with the button below. We also remember your region (UK or US) in a cookie called sh_region for 12 months so the site shows the right prices, and, if you arrive from one of our own campaign pages, a cookie called sh_lp for 30 days so we can tell which page led to your visit; neither is used for advertising. Apart from the optional cookies above, which are set only if you accept, we use no advertising or analytics cookies, and we load no scripts, fonts or images from other websites, with one exception: the payment page shows Stripe's payment form inside our page, so that page loads Stripe's code (from js.stripe.com) and Stripe may set its own cookies for fraud prevention and to process the payment; they are described on Stripe's site.

If you arrive through an affiliate's link we set one more cookie, which holds only the code of that link and the time you clicked. It lasts for the number of days in the affiliate terms (28 unless we change it) and is used for one thing: crediting the person who sent you if you buy. It is not set if your browser sends Do Not Track or Global Privacy Control, or if you have turned off counting with the switch below.

Keeping it safe

The website uses an encrypted (https) connection, passwords are stored only as scrambled hashes, and access to the administration area is limited to us. No system is perfect: if a breach ever puts your information at real risk we will tell you and the Information Commissioner as the law requires.

Your rights

You can ask to see the information we hold about you, to have it corrected or erased, to restrict or object to how we use it (including the emails about new versions), and to receive a copy you can move elsewhere. Some rights are limited where the law requires us to keep records. Write to support@sellhelm.co.uk; we will normally reply within one month and will not charge you. You can turn off new-version emails yourself at any time under Account.

Complaints

If you are unhappy with how we handle your information, please tell us first, by email at support@sellhelm.co.uk or through the contact page. We will acknowledge your complaint within 30 days (usually much sooner), look into it without undue delay, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes

If we change this notice in a way that matters, we will change the date at the top and tell customers by email.