Privacy Policy

1Who we are

SellyPOS is a point-of-sale and business-management application for retailers in Pakistan, published by Selly Systems ("we", "us"), based at Muhammad Center, Opposite Soneri Bank, Jalalpur Jattan Road, Gujrat, Pakistan.

For questions about this policy or about your data, write to hello@sellypos.com.

2The short version

We hold a small account record — who you are, which business you registered, and how to help you recover administrator access if you lose it. That is the substance of what we keep.

3What we collect

3.1Google account information, when you sign in with Google

SellyPOS uses Sign in with Google to identify the person who owns the business account. We request three standard scopes — openid, email and profile — and from them we receive and store:

We do not receive, request or store your Google password. Authentication happens entirely on Google's own pages in your web browser. We never see the credentials you type there.

We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service, and the technical configuration of our application does not permit it.

3.2Business registration details

When you set up SellyPOS we record: your business name, business type, city and province, a contact telephone number, and the username (not the password) of the administrator account you create.

The telephone number is how our support team calls you back to verify your identity if you ever lose access to your administrator account.

3.3Device information

We do not collect your computer's name, your Windows username, your MAC address, your IP-based location, or any hardware serial number.

3.4Administrator recovery material

SellyPOS generates a recovery key so that you can regain administrator access if you forget your password. Depending on your version, this key is either held only by you, or held by us in encrypted form so that our support team can help you recover by telephone.

This key allows a password to be reset by a person sitting at your computer. It does not allow anyone — including us — to sign in to your system remotely, and it does not decrypt your business data.

3.5Aggregate usage counts

SellyPOS may send us anonymous counts describing how the software is used, so we can improve it. For example: how many sales were completed in a day, how many times a particular feature was opened, how many errors or crashes occurred, and which version you are running.

These are counts only. They carry no monetary values and no records about any person.

4What we never collect

This list is deliberate and we intend to be held to it. SellyPOS does not send us:

• Any monetary figure — no sales amounts, turnover, prices, costs, margins, discounts or cash balances
• Any customer information — no names, telephone numbers, addresses, credit balances or ledgers
• Your product catalogue — no product names, barcodes, SKUs or stock levels
• Any supplier or purchase information
• Your tax records or FBR submissions, or their contents
• Any receipt, invoice, quotation or document you produce
• Passwords or PINs — not in plain text, not encrypted, not hashed, not in any form at all
• Your datastore, your backups, or any file containing your business records

5Where your business data lives

On your computer, in a file you control, under your Windows user account.

You are responsible for backing it up. SellyPOS provides backup tools, including to a USB drive or a folder of your choosing. Unless you separately subscribe to a cloud service we offer, we hold no copy of your business data and cannot restore it for you.

6How we use what we collect

• To create and maintain your account and licence
• To verify your identity when you contact support
• To help you recover administrator access
• To send you information about your subscription, and about updates and security matters
• To understand which features are used, so we can improve the product
• To detect and prevent fraud, abuse and unauthorised use of licences
• To meet our legal obligations

We do not use your data for advertising. We do not sell it. We do not share it with data brokers.

7Our legal basis

We process this data to perform the contract you enter into when you use SellyPOS, on the basis of your consent where you give it (for example, when you choose to sign in with Google), and where we have a legitimate interest in securing and improving the service. We process data in accordance with applicable Pakistani law.

Where you have given consent, you may withdraw it — see §10.

8Who we share it with

We use no advertising networks and no third-party analytics services inside the desktop application.

8.1Google user data — limited use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google is used only to provide and improve the sign-in and account-recovery features described in this policy; it is not transferred to others except as set out in §8; it is not used for advertising; and no human reads it except where you have explicitly asked us to for support, where it is necessary for security purposes, or where the law requires it.

9How long we keep it

10Your rights

You may ask us to:

• Show you what we hold about you
• Correct anything inaccurate
• Delete your account and the data attached to it
• Export your account record in a machine-readable form
• Withdraw consent to sign in with Google, and to disconnect your Google account
• Stop sending usage counts — you may turn these off in the application's settings

Write to hello@sellypos.com. We will respond within 30 days.

You may also revoke our application's access at any time from your Google account's permissions page.

11Changes to this policy

If we materially change what we collect or how we use it, we will publish the revised policy here with a new effective date and notify you by email and in the application before the change takes effect. Continuing to use SellyPOS after that date means you accept the revision.

12Security

Data in transit is protected with TLS. Recovery material is encrypted at rest under keys held in a managed key service, separate from the database. Access by our staff is restricted, requires multi-factor authentication, and every access to recovery material is logged with the identity of the person who made it and the reason they gave.

13Children

SellyPOS is business software and is not directed at children. We do not knowingly collect data from anyone under 18.

14International transfers

Our servers are located in Singapore (Asia-Pacific). Because this is outside Pakistan, your account data is transferred and stored there under contractual safeguards with our provider.

15Contact

See also our Terms of Service.