Who can do what

Menu: no screen of its own — a person's role is set on Setup → Users · Who: everybody (only the owner hands roles out)

Sellify has ten roles. Nine of them are yours to hand out; the tenth belongs to Sellify.

Kitchen and Waiter are for restaurants. A shop with no kitchen and no tables is never offered either — not a hidden menu item, the API refuses the role outright.

Neither needs a till. A waiter's phone and a kitchen screen take no money, so there is no pairing code, nobody has to approve the device, and neither counts against the number of tills your plan includes. Both sign in on any browser and land straight on their own screen — see The kitchen and Taking an order at the table.

Company-wide roles have no branch: the owner, the three call-centre roles and HR. An agent orders into any outlet; HR keeps a book that is not one shop's. Everybody else is bound to a branch, and that binding is enforced on the server: a manager who asks for another branch's figures is answered with one of their own, never with a refusal they could work around.

A manager may run more than one shop. A chain with four outlets and one man over all four gives him a home branch and ticks the rest under Also manages on his user — see Users. He picks one at a time from the branch dropdown, exactly as an owner does, and everything else about him is unchanged: no settings he does not run, no billing, no plan. A cashier and a waiter are always one shop.

Two things are grants, not roles, because "the cashier who is allowed to haggle" and "the accountant who sees the payroll" are not job titles. The owner gives each on the user:

The company-wide roles in one line each

• A call-centre agent takes orders, and takes no money. The order is confirmed; the branch takes the cash on its own till. So an agent needs no terminal to quote or to place an order — and still needs one to complete, void or correct anything.
• A call-centre HOD staffs their own floor and gives standing discounts. They cannot mint another HOD, and they touch no settings, no billing, no catalog, no stock and no day close.
• A waiter takes an order at the table, and takes no money. Their phone is not a till and never pairs with one: the order is confirmed and lands on every counter in the branch, and the bill is settled wherever the customer walks up to. They cannot hold, pay, discount, write off, apply an offer or type a price — each is refused by the server, not merely absent from their screen. See Taking an order at the table.
• HR keeps the employee book. No settings, no billing, no catalog, no stock, no day close, no till. A role that exists to keep the book has no business in the sales summary, and asking for one is refused rather than merely hidden.

The short version

• Sellify handles the account. Your plan, your invoices, your payments, and approving a new till. They cannot ring a sale, read your reports or touch your catalog — that is not a hidden menu, the API refuses it.
• The owner runs the business. Everything inside their company, except the commercial terms they are being sold.
• The manager runs a shop — or several. Everything operational, in their own branches only, except the things that are company-wide by nature.
• The cashier sells. Nothing else.
• The waiter takes the order. Nothing else — no money changes hands on their phone.

The table

✅ can · ⛔ cannot · 🏬 their own branches only

The kitchen role signs in for kitchen tickets only; it takes no sale and changes no data.

What stays with Sellify

These are the commercial controls, and they stay with us deliberately — an owner who could move their own company onto a bigger plan, or mark their own invoice paid, is not on a plan at all. Asking for one of these is not blocked by a hidden menu: the API refuses the request, so it makes no difference what is sent to it.

You can see your plan, your usage and your invoices, and you can tell us you have transferred the money — see Billing. That is the whole of the boundary, and it is the same for every customer.

Two things worth knowing, because they surprise people:

• A company owner cannot change their own plan, status or trial dates. The API rejects the attempt rather than quietly ignoring it, so nobody is left wondering whether it worked.
• Shutting a lost till out is yours; letting a new one in is ours. You can disable a stolen tablet the second you notice, without ringing anybody. Approving a device is our call, and a re-enabled terminal pairs again from scratch.