Gap summary

What is missing today

No single list of customer data. Preorders, the loyalty sheet, the newsletter and catering emails each hold customer details, but nobody has written down where.
Paper sign-up sheet. The loyalty list is kept on paper at the counter, where anyone can read it.
No retention rule. Old catering emails and loyalty sheets are kept with no end date.
Unclear access. It is not written down who can log in to Square and Mailchimp.

Draft

This is a draft starting point. Review and adapt before use. Not legal, financial, or compliance advice.

Privacy Checklist — Maple Street Bakery

Owner: Owner/manager · Review: every 3 months

Where customer data lives

Data	Where it lives	Who can see it	Keep for
Online preorders (name, phone, order)	Square	Owner, shift leads	Square's records; export only what you need
Loyalty sign-ups (name, email)	Paper sheet at the counter → typed into Mailchimp weekly	Owner	Shred the sheet once typed in
Newsletter list	Mailchimp	Owner	Until the person unsubscribes
Catering inquiries	Bakery email inbox	Owner, catering lead	12 months after the event, then delete

Checks

Each person who logs in to Square and Mailchimp has their own login with two-step sign-in.
Former staff lose access on their last day.
The loyalty sheet is kept behind the counter, not on it.
Newsletter sign-ups say what people will receive and how to unsubscribe.
Card numbers are never written down; payments go through Square only.
Catering emails older than 12 months are deleted each quarter.

If something goes wrong

If a sheet is lost or an account is used by someone who should not have access, write down what happened and when, change the passwords, and ask an advisor whether customers need to be told.

[End of draft. Customize this document before sharing or publishing it.]

90-day checklist

Next 90 days

Week 1: Give every staff member their own Square login; turn on two-step sign-in.
Week 2: Move the loyalty sheet behind the counter; start shredding typed-in sheets.
Month 1: Delete catering emails older than 12 months.
Month 2: Check the Mailchimp sign-up wording.
Month 3: Walk through this checklist again and update the table.

See a sample draft

Pick a sample business and see the gap summary, draft and 90-day checklist the AI Orchestrator produces. The businesses are fictional; nothing you do here is stored.

What Maple Street Bakery told the Orchestrator