Sellion Privacy Policy

This Privacy Policy explains how Sellion ("Sellion", "we", "us" or "our") collects, uses, stores, shares and protects personal information when you visit sellion.app, create an account, or use our mobile and web apps to manage orders (together, the "Service").

Sellion is built and operated from Kathmandu, Nepal. We process personal data in line with Nepal's Individual Privacy Act, 2075 (2018) and the Electronic Transactions Act, 2063 (2008), and we follow widely accepted data-protection practices such as data minimisation, purpose limitation and user access rights.

By creating a Sellion account or using the Service you confirm that you have read and understood this policy. If you do not agree with it, please do not use Sellion. Questions? Write to us at privacy@sellion.app.

We collect only the information needed to give you a working order management system. It falls into four groups.

a. Information you give us

• Account details — your name, business or store name, email address, mobile number and password (stored only as a salted hash, never in plain text).
• Business profile — store description, logo, product catalogue, price lists, delivery charges and preferred payment methods.
• Subscription details — the plan you choose, billing cycle, payment reference number and invoice history.
• Support communications — messages, screenshots and attachments you send through our contact form, email, WhatsApp or phone.

b. Order and customer data you enter

To manage sales you may record your customers' names, phone numbers, delivery addresses, order items, amounts, payment status and delivery notes. This data belongs to you — we simply store and process it on your behalf (see section 4).

c. Information collected automatically

• Device and technical data — device model, operating system, browser type, screen size, language and approximate location derived from your IP address.
• Usage data — pages viewed, features used, buttons clicked, session length and referring URL, used to understand which parts of Sellion help sellers most.
• Log data — IP address, timestamps, requested URLs and error traces, kept for security monitoring, fraud prevention and debugging.

d. Information from third parties

• Payment providers (for example eSewa, Khalti, IME Pay or a bank) confirm whether a subscription payment succeeded and share the transaction reference — never your full card or wallet credentials.
• Analytics and infrastructure providers give us aggregated, mostly de-identified statistics about performance and traffic.
• Referral or partner programmes may tell us that you signed up through a specific campaign link.

We use the information described above to:

• Create and secure your account, verify your identity and let you sign in.
• Provide core features — recording orders, tracking order status, managing customers, generating order capture links, reports and invoices.
• Send transactional messages such as password resets, order capture notifications, payment receipts, plan expiry reminders and security alerts.
• Process subscriptions, confirm payments, upgrade or downgrade plans and handle refund requests.
• Provide customer support and investigate problems you report.
• Improve the Service — measure which features are used, fix bugs, monitor performance and plan our roadmap.
• Protect Sellion and our sellers by detecting fraud, abuse, spam, fake orders and unauthorised access.
• Send occasional product updates, tips or offers where you have opted in — you can unsubscribe from these at any time.
• Comply with legal, tax, accounting and regulatory obligations in Nepal.

Our legal bases are: performing our contract with you (running your account), your consent (marketing messages and non-essential cookies), our legitimate interests (security, product improvement) and compliance with law. Where we rely on consent, you can withdraw it at any time.

We do not use your customer lists to advertise to your customers, and we do not sell personal data to anyone.

When you add a buyer to Sellion, or when a buyer fills in one of your order capture links (the /r/your-link pages), we act as a data processor and you act as the data controller. In plain language:

• You decide what customer information to collect and how long to keep it in your account.
• We process that information only to run the Service for you — never for our own marketing.
• You are responsible for telling your customers how their details will be used, and for having a lawful basis to collect them.
• Order capture pages are excluded from search engine indexing so your customers' submissions do not show up in Google.
• When you delete an order, customer or your whole account, the related records are removed from our live systems on the schedule in section 7.

If one of your customers contacts us directly with a privacy request, we will normally refer them to you and support you in responding.

Sellion uses cookies, local storage and similar technologies for three purposes:

• Essential — keeping you signed in, remembering your session and protecting forms against abuse. The Service cannot work without these.
• Preferences — remembering choices such as your dashboard filters, billing-cycle toggle or dismissed notices.
• Analytics — understanding aggregated, anonymised usage so we can improve the product. These are optional.

We do not use third-party advertising cookies and we do not build advertising profiles. You can clear or block cookies in your browser settings at any time; blocking essential cookies will sign you out and break parts of the dashboard.

We never sell, rent or trade personal data. We share it only in these limited situations:

• Service providers — hosting, database, email delivery, SMS, analytics and error-monitoring partners who process data strictly on our instructions under confidentiality obligations.
• Payment providers — to charge, verify or refund a subscription payment.
• Your own team — any staff account you invite to your Sellion workspace can see the data you give them access to.
• Legal and safety — where disclosure is required by Nepali law, a valid court order or a government request, or where it is necessary to prevent fraud, abuse or harm.
• Business transfer — if Sellion is involved in a merger, acquisition or asset sale, data may transfer to the successor entity under this same policy; we will notify you beforehand.
• With your consent — for anything else, we will ask you first.

• Active accounts — we keep your data for as long as your account is open so your order history stays available.
• Deleted records — orders, customers and products you delete are removed from live systems immediately and purged from encrypted backups within 30 days.
• Closed accounts — after you request deletion we remove your personal data within 30 days.
• Inactive free accounts — we may delete accounts that have been unused for 24 months after emailing the address on file.
• Billing and tax records — invoices and payment references are retained for as long as Nepali tax and accounting law requires, even after account closure.
• Security logs — retained for up to 12 months for fraud prevention and incident investigation.

• HTTPS/TLS encryption for all data moving between your device and our servers.
• Passwords stored only as salted one-way hashes — no Sellion employee can read your password.
• Token-based authentication with expiry, plus rate limiting on login and password-reset endpoints.
• Role-based access control: staff access to production data is limited, logged and granted only when needed for support or maintenance.
• Encrypted, regularly tested backups and monitored infrastructure.

No online service can promise absolute security. Please use a strong, unique password, keep it private and sign out on shared devices. If you believe your account has been compromised, or if you discover a vulnerability, email support@sellion.app immediately. If a breach affects your personal data, we will notify you and the relevant authorities without undue delay.

Subject to applicable law, you can ask us to:

• Access — get a copy of the personal data we hold about you.
• Correct — fix inaccurate or incomplete details (most fields you can edit yourself in Settings).
• Delete — close your account and erase your personal data, subject to legal retention rules.
• Export — receive your orders and customer records in a portable, machine-readable format.
• Object or restrict — object to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
• Withdraw consent — opt out of marketing emails using the unsubscribe link, or by writing to us.

To exercise any of these rights, email privacy@sellion.app from your registered address. We may need to verify your identity before acting, and we aim to respond within 30 days. Exercising your rights is free and will never lead to worse service.

Sellion is a business tool intended for users aged 16 and above. We do not knowingly collect personal information from children. If you believe a child has created an account or that a child's data has been entered into Sellion, contact privacy@sellion.app and we will delete it promptly.

Sellion is operated from Nepal, but some of our infrastructure and service providers (hosting, email delivery, analytics) may store or process data on servers outside Nepal. Wherever your data travels, we require appropriate safeguards — contractual confidentiality and security commitments, encryption in transit and restricted access — so the protection described in this policy continues to apply.

Sellion links to third-party sites and tools such as social media profiles, app stores, payment gateways and WhatsApp. When you follow those links or share an order capture link through another platform, that platform's own privacy policy applies to the data it collects. We are not responsible for third-party practices, so please review their policies before sharing personal information.

Sellion does not connect to, read or store your Instagram, Facebook, TikTok or WhatsApp inbox. Order details reach Sellion only because you type them in or because a customer submits your order capture form.

We may update this policy as Sellion evolves or as the law changes. The "Last updated" date at the top always reflects the current version. For material changes — for example a new purpose for using your data — we will notify you by email or with an in-app notice before the change takes effect. Continuing to use Sellion after an update means you accept the revised policy.

For any privacy question, request or complaint, reach out to our team:

You can also use our contact form. If you are not satisfied with our response, you may escalate the matter to the competent data-protection or consumer authority in Nepal.