The HQ Users page controls who can get into your HQ — the network-wide view across all your locations — and what each person can do there. It's part of the HQ add-on. Access to an individual shop is separate and is still managed in that shop's own team settings (see Set up team roles and permissions).
Getting there
From your HQ view, click Users under Network in the HQ sidebar. The Permission sets button at the top of that page opens the permission sets page.
Three counters run across the top: HQ members, Shop users (distinct), and Pending invites.
The three HQ roles
- Owner — full access, billing, and can remove owners.
- Admin — manage shops, invite users, no billing.
- Viewer — read-only across all shops.
Only an HQ Owner can give someone the Owner role. Your HQ always keeps at least one Owner — you can't demote or remove the only one.
Inviting someone to HQ
- Click Invite user.
- Enter their Email.
- Pick a Role: Owner, Admin, or Viewer. (Owner only appears if you're an Owner.)
- Optional: check Franchise Sales CRM only to limit them to the Franchise Sales CRM — no HQ dashboard, Royalty, or Document Library access. Owner isn't available with this option.
- Click Send invite.
The next screen shows the invite link with a Copy link button. If the email went out, the title reads Invite sent; if not, it reads Invite created and you'll need to share the link yourself. Links expire after 7 days, and the person must accept while signed in with the same email address the invite was sent to.
Unaccepted invites appear under Pending invites with the role, who invited them, and the expiry date. Use the copy icon to grab the link again, or the trash icon to Revoke invite.
Changing someone's role or removing them
In the HQ members table, use the role dropdown next to a person to switch between Owner, Admin, and Viewer. Click the trash icon to remove them from HQ — they lose HQ access, but their memberships at individual shops are unaffected.
These controls are only active if you have the Manage org members permission. Otherwise they appear greyed out.
Confining someone to the Franchise Sales CRM
For any member who isn't an Owner, the CRM only checkbox under their role turns off their access to the HQ dashboard, Royalty, the Document Library, and ACH bank-account settings, leaving them in the Franchise Sales CRM. Uncheck it to put their access back to normal. Members with this restriction show a CRM only badge.
Building a permission set
A permission set is a named, reusable bundle of permissions — say, "Regional Manager" — that you can assign to several HQ members instead of setting each person up by hand.
- On the Users page, click Permission sets, then New set.
- Give it a Set name.
- For each permission, choose Allow, Deny, or leave it at Not set. Permissions are grouped into Franchise operations, Financial, Team, Franchise Sales CRM, and Module access (HQ Dashboard, Franchise Sales CRM, Royalty, Document Library).
- Click Create set.
Anything left at Not set isn't part of the set — the member keeps whatever their role already gives them for that permission. Each set in the list shows how many permissions it allows, denies, and leaves at default. Use Edit to change one, or the trash icon to delete it.
Sets are shared across every HQ member of your organization.
Assigning a permission set to someone
Back on the Users page, a permission-set dropdown appears under each non-Owner member once at least one set exists. Pick a set, or choose No set (custom overrides only) to remove it.
How the pieces fit together
For each permission, SalesThumb checks in this order and uses the first answer it finds:
- A setting made just for that person (for example, the CRM only checkbox).
- Their assigned permission set, if the set includes that permission.
- The default for their role. By default, Owners and Admins have every HQ permission; Viewers can open the HQ dashboard, Franchise Sales CRM, Royalty, and Document Library but can't manage anything.
If you delete a set, anyone using it simply falls back to their role default plus any of their own settings — nobody is locked out.
Who can change permissions
The CRM only checkbox, the permission-set dropdown, and the Permission sets page all require the Manage permissions permission. To keep things safe, you can't take away your own Manage permissions access, at least one member must always keep it, and you can't give someone a permission you don't have yourself.
Need help? Email info@roffik.com.
Frequently asked questions
Q: What's the difference between HQ Admin and HQ Viewer?
A: Admins can manage shops and invite users but don't handle billing. Viewers have read-only access across all shops.
Q: Does removing someone from HQ remove them from their shop?
A: No. Removing an HQ member only ends their HQ access. Their memberships at individual shops stay as they are.
Q: How long is an HQ invite link good for?
A: 7 days. After that, send a new invite. The person has to accept while signed in with the email address the invite was sent to.
Q: What happens to members when I delete a permission set?
A: They fall back to their role's default permissions plus any settings made just for them. Nobody loses access outright.
Q: Can I give an Owner a permission set or the CRM only restriction?
A: No. Those options only appear for Admins and Viewers. Owners have full access.