What we hold, and why

An account holds an email address, a name, a hashed password and the times you last signed in and last changed that password. The password itself is never stored — only a bcrypt hash of it, which cannot be reversed. We never log a password, a reset link or a session token.

Sessions are stored as a keyed hash rather than the token itself, with the key held outside the database. A copy of the database on its own cannot be used to sign in as you.

Whatever you type: a name, an email address, a phone number, a delivery address, what they bought and any note you wrote. That is all. Sellerly does not enrich it, does not buy anything to add to it, does not track your customers anywhere, and does not build a profile of them.

This data belongs to your business. We do not use it to train anything and we do not sell it. You can export all of it as CSV at any time.

Every business using Sellerly is isolated inside the database, not merely in the interface. Each row carries the business it belongs to, and PostgreSQL refuses a read or a write from a different one before the application is involved. Which business a request acts on is resolved on the server from a verified membership; it is never taken from something the browser sent.

Techvora’s own operator console can see the name, plan and activity of a business. It holds no permission of any kind on your orders, customers, products or stock — running the service does not mean reading your order book.

We keep a short administrative record of security-relevant actions: signing in, changing a password, changing who has access, changing settings. IP addresses are never stored as addresses — only as a keyed pseudonym used for throttling, which cannot be turned back into an address.

These records are kept for about 400 days and then deleted automatically.

Two, both strictly necessary and neither used for tracking. sellerly_session keeps you signed in, and sellerly_org remembers which of your businesses you were last working in. Both are HttpOnly, both are Secure in production, and there is no analytics or advertising cookie anywhere in Sellerly.

Sellerly runs on Vercel with a PostgreSQL database hosted by Supabase in the EU (Ireland). Email, when a business has it configured, is sent through Postmark.

You can see, correct, export and delete the data in your business from inside the product. For anything the product does not cover — a full deletion of your account, or a question about how something is handled — write to us and a person will answer.

A support address is not published yet; use the contact form and it reaches the same people.