Selenic Orders is a sales catalogue and ordering app for field sales representatives. It is published by Selenic Systems Ltd, registered in England and Wales, company number 17312090, registered office Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE.
Questions about this policy: [email protected].
The short version
Selenic Orders has no servers for your data, and we receive none of your business data.
The app stores everything on the tablet it is installed on. When it syncs, it reads and writes files in a location you choose and control: a folder on the tablet, your own Google Drive account, or your own FTP or SFTP server. Your data goes from your ERP to your rep's tablet and back to your ERP. It does not pass through us at any point, because there is nowhere for it to pass through.
There is no advertising and no tracking in this app, and we collect no analytics. The one thing that does reach us is a crash report when the app fails (what kind of error, and where in the app), and it never contains your customers, products or orders. Your administrator can switch it off for every tablet. See Crash reports below.
The app can also read a barcode or a licence QR code with the tablet's camera. The picture is read on the tablet and never leaves it, but the Google component that reads it sends Google its own usage statistics. See Scanning with the camera below.
Each tablet also checks its licence with our licensing service now and then. That sends your licence key, a random identifier the app creates for the tablet, and the name you gave the tablet, never your customers, orders, products or prices. See Your subscription and licence below.
Who is responsible for what
Under UK GDPR, the business that licenses Selenic Orders is the data controller for everything in it: the customer records imported from your ERP, the orders your reps take, and the accounts your reps sign in with. You decide what goes in and where it syncs to.
Selenic Systems Ltd supplies the software. Because nothing we operate touches your catalogue, customers or orders, we are not a processor of that data either. We cannot read your catalogue, your customers or your orders, and there is no mechanism by which we could.
The one thing that follows from this: if you lose the tablet, or the sync folder, we cannot recover anything for you. There is no copy anywhere else.
What the app stores on the device
All of it in a local database on the tablet, and in the tablet's own private app storage:
- Catalogue data: products, prices, categories, promotions, images.
- Customer records, as imported from your ERP: names, addresses, contact details, tax and EORI numbers, credit limits, trading terms, tags and notes. Customers created by a rep in the field are stored the same way and exported back to you.
- Orders: lines, quantities, prices, discounts, tax, delivery details, and the signature captured at the point of order, stored as an image file alongside the order.
- User accounts: the names of your reps and administrators, and their PINs. PINs are never stored as typed: they are hashed with PBKDF2-HMAC-SHA256 under a per-user random salt. Backup codes are hashed the same way.
- Settings and templates: your branding, business rules, and the import and export templates that describe your ERP's file formats.
Product photographs a rep takes are stored on the device and are shared by image key rather than by product, so they are never deleted automatically; they accumulate until the data is reset.
What leaves the device, and where it goes
Only what you have configured, to the destination you configured:
- A folder on the tablet: orders, new customers and error logs. Controlled by you.
- Your Google Drive: orders, new customers and error logs. Controlled by you.
- Your FTP or SFTP server: orders, new customers and error logs. Controlled by you.
None of your business data is sent anywhere else, and none of it is sent to Selenic Systems Ltd. The only exception to "nothing reaches us" is the crash report described below, which carries no business data.
Google Drive. Where you choose Drive, the app requests the
drive.file scope only. That grants access to files the app itself created and
nothing else. It cannot see, list or read anything else in the account, including files
placed in a folder the app made. The sign-in is to your account, and the token is held on
the device.
FTP and SFTP. Credentials you enter are stored on the device so the sync can run unattended. They are removed from any configuration file the app writes out, so a configuration shared between tablets does not carry your server password with it.
Crash reports
When the app fails, it can send a crash report to us through Firebase Crashlytics, a Google service, so that the fault can be found and fixed. Tablets running this app are at your premises and your customers', where we will never see them fail; without this we would not learn of a fault at all.
What a crash report contains:
-
the type of error (for example
FormatException), never its message, because an error message can quote the data being worked on; - the point in the app's own code where it happened, and a fixed label for the area of the app (such as "checkout" or "sync");
- the app version, device model, Android version, and technical state at the time (free memory and storage, orientation);
- a random identifier created by Firebase for this installation of the app, which is not linked to any person or account, and the times the app was started, so that crash-free rates can be counted.
What it never contains: customer records, products, prices, orders, signatures, rep names, PINs, sync credentials, or anything else you put in the app. This is enforced in the code rather than by filtering: the part that sends reports can only accept a fixed list of labels, so there is no way to hand it a customer's name.
Switching it off. Settings › Business Rules › General › Send crash reports. It is a managed setting, so an administrator can turn it off for every tablet from your sync folder and a rep cannot turn it back on. When it is off, nothing is sent, and any report already held on the tablet is deleted rather than sent later.
Lawful basis: legitimate interest in keeping the software working. Google processes crash reports on our behalf as our processor and keeps them for 90 days; see Google's Firebase privacy information.
Scanning with the camera
A rep can scan a product barcode or a licence QR code with the tablet's camera. The camera is only on while the scanner is on screen, and the picture is read on the tablet, by Google's ML Kit. It is never stored, and neither the picture nor what the code says is sent anywhere, not to us, and not to Google.
What ML Kit does send, to Google. ML Kit is Google's software and it reports on its own performance to Google. By Google's own description, that is: the device's make, model and Android version; the app's name and version; how long a scan took, and the size and format of the image it looked at; which kind of event happened and any error code; and an identifier Google says is not intended to identify a person or a device. It never includes the image or the barcode. Google describes it in its ML Kit data disclosure.
This is data shared with a third party, and we say so. It goes to Google, not to us, and Google uses it for its own purposes (to run and improve ML Kit) rather than on our behalf, so it is not the same arrangement as crash reports. We declare it as shared on Google Play. Google is responsible for it under the Google Privacy Policy.
ML Kit offers no setting to switch it off. A tablet whose reps never use the camera scanner still carries ML Kit as part of the app. Barcodes from a Bluetooth or USB scanner, typed, and licence keys pasted or loaded from a file do not use it.
Network connections the app makes
- To your chosen sync destination, when a sync runs.
-
To
selenicsystems.com, only if somebody taps Help or Contact Support, which opens the page in the device's browser. - To Google's Firebase Crashlytics service, to send crash reports, unless crash reports are switched off.
- To Google, from ML Kit, the camera scanner's usage statistics described above.
- To Selenic Systems' licensing service, to check this tablet's licence: it sends your licence key, a random identifier the app creates for the tablet, and the name you gave the tablet, never your customers, orders, products or prices. It happens when the app starts and after a sync, and a tablet keeps working for weeks without it.
Those three are the only connections the app makes that you did not configure.
That is the complete list. The licence itself is checked on the device, using a cryptographic signature, so the app works with no connection; the licensing service is asked only to renew it, as above. A licence issued for a tablet that cannot go online is checked entirely on the device and never contacts anything.
Permissions the app asks for, and why
Selenic Orders declares three Android permissions:
- Internet: for the sync transport you choose, for crash reports, and for renewing the tablet's licence.
- View network connections: so crash reports wait until the tablet is online instead of failing to send.
- Camera: to scan a barcode or a licence QR code. Android asks the first time somebody scans, and refusing it leaves everything else working: a Bluetooth or USB scanner, typing and pasting all still do. The camera is on only while the scanner is on screen.
The first two are granted at install and give access to nothing on the tablet.
That is the whole list. It deliberately does not ask for storage:
- No storage permission. Reading your ERP's files uses Android's Storage Access Framework: you pick one folder, and the app can reach that folder and nothing else. It does not have, and cannot request, the "All files access" permission that would let it read the rest of the tablet.
A product photograph is still taken by the tablet's own camera app, which hands the picture back. Android asks for the camera permission before that too (an app that declares it has to hold it before opening the camera app), but the app itself sees only the finished photograph.
Your subscription and licence
For the subscription itself (not the app's data), Selenic Systems Ltd is the data controller, registered with the Information Commissioner's Office under reference ZC285459. We hold:
- Your business's name and contact email address, from when you subscribed, to send your licence key and tell you about your subscription.
- Your licence key, and for each tablet using it the random identifier the app created, the name you gave it, and when it last checked in, so the number of tablets matches what you subscribed for, and your administrator can see and remove them.
- A record of the emails we have sent you about your licence, so a delivery problem can be traced and nothing is sent twice.
- Your invoices and number of tablets over time, so a change to your subscription reaches the licence correctly.
- Notes we make about your account while helping you, for example what was agreed in a support conversation.
- Your answer to "Email me about new features" at checkout, and when you gave it. We send product news only if you chose "Yes please", and every such email lets you stop them. Emails about your subscription do not depend on it.
- Requests to "Email me my key": the address typed and when, so the same address cannot be sent its key repeatedly. That form is protected by Cloudflare Turnstile.
Payments are taken by Stripe, which holds your card or bank details, billing address and any tax number you give at checkout; we never see card or bank details. Licence emails are sent through Resend, and the licensing service runs on Cloudflare. Each processes this information for us only to provide that service.
We keep it while you are a customer, and afterwards only as long as we need to for our accounts (invoices and payment records for six years, as UK accounting law requires) and to answer questions about your subscription. Ask us at [email protected] to delete what we do not need to keep.
How long data is kept
For as long as it is on the tablet. The app does not expire or delete records on its own. Orders are kept as a history and are deliberately never rewritten by a later catalogue sync, so what a customer signed for stays what the record says.
Settings › Admin › Reset Data clears products, orders, or performs a full factory reset of the app's data on that tablet. Uninstalling the app removes its local database and files. Neither touches what is already in your sync folder or your ERP. Deleting your data sets out each way to remove it, step by step.
Children
Selenic Orders is a business tool for sales representatives. It is not directed at children and collects nothing from them.
Your rights
Because you are the controller of the data in the app, requests from your own customers (access, correction, erasure, portability) are answered from your ERP and your copy of the data. We hold nothing to answer them from.
If you believe Selenic Systems Ltd holds personal data about you (for example, because you have subscribed or contacted support), write to [email protected] and we will respond within one month. You may also complain to the Information Commissioner's Office at ico.org.uk.
Changes to this policy
If this policy changes, the updated version will be published at this address and the date at the top will change. Where a change affects what the app does with data, it will ship alongside the release that makes the change.
Contact
Selenic Systems Ltd
Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE
[email protected]