Client Data Policy

All proprietary business records, customer contact lists, CRM databases, ecommerce transactions, sales figures, ad-account performance data, and confidential collateral entrusted by a client to Goafreet ("Client Data") remain the sole and exclusive property of the client. Nothing in our engagement terms transfers any proprietary right, title, or interest in Client Data to Goafreet.

Goafreet acts strictly as an authorized service provider or Data Processor with respect to Client Data. We process, access, and analyze Client Data solely to the extent necessary to deliver the specific services contracted in the applicable Statement of Work (SOW), such as managing marketplace stores, optimizing ad campaigns, executing SEO audits, or developing software.

To safeguard client accounts, Goafreet’s standard operating protocol mandates role-based delegated access, user invitations, and partner permissions (e.g., Amazon Seller Central User Permissions, Meta Business Manager Partner Sharing, Google Ads Manager link invitations). Clients must avoid sharing master administrative passwords, root login credentials, or recovery codes through ordinary email or messaging apps.

Access to Client Data within Goafreet is restricted strictly to assigned personnel, technical leads, and specialists who require such access to fulfill agreed deliverables on a need-to-know basis. All personnel operate under written confidentiality covenants and are trained in secure data handling.

When a client furnishes customer data, lead lists, or subscriber databases to Goafreet for campaign execution, the client represents and warrants that: (a) it possesses a valid lawful basis under applicable data protection laws; (b) all statutory notices have been provided; and (c) the data was obtained in compliance with telecommunications and anti-spam regulations.

Goafreet reserves the express right to refuse or suspend any client directive, outreach campaign, or data processing activity that reasonably appears to violate data protection laws, advertising standards, platform developer agreements, or telecommunication spam regulations.

Goafreet implements reasonable administrative, organizational, and technical security controls to protect Client Data against unauthorized access, accidental loss, or unlawful destruction. In the event of a confirmed security incident materially impacting Client Data under our direct control, Goafreet will notify the affected client and cooperate in containing the incident.

Upon the formal conclusion or termination of a client engagement, and following receipt of all due professional fees, Goafreet will, upon written request: (a) relinquish delegated platform permissions; (b) securely delete or return active Client Data files in our possession; and (c) allow residual server backups to expire according to standard backup rotation schedules, subject to statutory tax and accounting retention requirements.