Where your data lives, and where it does not.
Siesie touches invoices, crew, suppliers and money. That is a serious amount of your business to hand anyone, so this page is the part your accountant will want, written before they ask for it.
This page covers a client engagement. What happens when you fill in a form on this website is on the privacy page.
The whole answer, in one sentence.
Nothing is copied to a system I control. I hold no database of your customers, your crew, or your invoices.
Your accounts, in your name, from day one.
I do not create a workspace of mine and invite you into it. Every account the build touches is opened by you, or already yours, and the work happens inside it. That is why there is nothing of yours for me to keep.
If you stop working with me, nothing switches off.
What I can reach, and for exactly how long.
Access is something you grant, to your own accounts, with your own permissions. It is used to configure, test and document, and for nothing else.
Granted by you, listed by me, revoked by you.
Delegated or invited access wherever the platform supports it. A shared password is a last resort, and you change it at handover.
Configuring, testing, documenting.
Setting the thing up, running it against the normal, exception and failure paths, and writing down where everything lives so you can run it without me.
Anything else at all.
Not to look at your numbers out of interest, not to build a list, not to test something for another client. There is no second purpose.
What Siesie actually touches, role by role.
Worth reading properly. This is more of your business than a front desk sees, and you should know the surface before you sign anything.
Scheduling
Nothing about a crew member beyond what the job itself needs.
Money
I connect the tools you already use. I do not process, hold or move your money.
Coordination
Written by you, approved by you, sent from your accounts.
Account management
Migrated from the source you name in the scope, and nowhere else.
Reporting
No new data is collected just to make a report exist.
Every third-party provider in the chain is named in writing in your agreement, before you sign it. If a build would need a provider you are not comfortable with, we find another route or I tell you it cannot be done.
You get the list, and you decide what I keep.
The Ownership Pack includes every access I hold, written out. You revoke whatever you want to revoke, that day, and nothing stops working. If you take a care plan, we agree in writing which access continues and why, and that list is reviewed at every quarterly review.
Messages go out as you, under your own policy.
Anything automated is sent from your accounts, in your words, approved by you before launch. Every sequence carries a working opt-out, and stopping means stopping on the first request. You owe your customers a privacy notice, and I will walk you through what yours needs during the build.
What I do keep, and for how long.
Not your customer data. The paperwork of the engagement itself, because a business has to be able to show what it agreed to.
The engagement record.
Your Operations Map, the scope of work, the test record, the launch log and our correspondence. Held for seven years as ordinary business records, then deleted.
Exports of your data.
No copy of your customer list, your invoices, your crew or your client records is retained after handover. Anything used during a build lived in your accounts the whole time.
Deleted within 30 days.
Email and ask. No form, no account to log into, no charge. I confirm in writing when it is done. Where a record is legally required to exist, I tell you which one and why.
Confidential, both ways.
I do not discuss your operations, your numbers or your processes with anyone. Named as a client only if you say yes, in writing, to specific wording.
If something goes wrong, you hear it from me first.
Said plainly, because the providers who go quiet are the ones you read about later.
In writing, with what I know.
If I become aware of unauthorised access involving your accounts through work I performed, you get a written note inside 72 hours: what happened, what I know so far, what I have already done, and what I need from you.
Even if I do not have the full picture.
A partial answer on time beats a complete one after you have found out another way. The follow-up comes when I know more.
Strong unique passwords, two-factor, access limited to me.
That is the true version and I am not going to claim more than it. Anyone promising you enterprise-grade security from a one-person business is telling you something they cannot back.
Two-factor on every account we touch.
The weakest link in most small businesses is a reused password, not a provider. It is part of onboarding, and it is not optional. If an account cannot do two-factor, customer data does not go in it.
Ask me anything on this page before you sign.
Email hello@frimpomaasync.com and I will answer it myself, in writing, so you have the answer on paper. Everything here is written into the agreement you sign.