Monday morning, I nearly sent the customer list to the wrong group
Last Monday morning, I was chasing an overdue payment from a client in a shared office in Hangzhou and accidentally posted a spreadsheet into our work chat. It included customer names, WeChat contacts, and order notes. I recalled the message immediately, but my heart was still racing. None of that information should have been visible to anyone outside the team. When I saw that Meta had been fined $887 million over access to Android users’ data, my first thought wasn’t about Big Tech. It was: if someone clicks the wrong button today, what happens to our customer data?
What this fine really exposes is access and retention
To me, this was more an industry signal than a tool review. For people like us who freelance, run side projects, or lead small teams, the useful part is the reminder: customer data isn’t safe just because it lives on our computers. Access permissions, export logs, and retention periods matter too. The timeline is straightforward: on November 14, 2026, Reuters reported that Italy had fined Meta $887 million over access to Android users’ data. After the report appeared, it earned 103 points and 32 comments on Hacker News.
I know a small-business owner, Chen Lan, who manages customer relationships. In October 2026, she moved her customer spreadsheet from a shared cloud drive to a management page with member-level permissions. Her assistants can only see the clients they handle, along with notes customers prefer not to disclose. She later added an internal rule: after a customer requests deletion, the records are purged within a week. She has no programmer helping her, but she built risk controls into her daily workflow.
You don’t need an expensive system to start
The lowest-cost setup can use your existing computer and an encrypted cloud drive: about RMB 0–30 per month, 45 minutes for the first cleanup, and a technical barrier low enough that you only need the right mouse button, file uploads, and sharing permissions—no coding required. The first step is to open the cloud drive or spreadsheet app where you keep customer data, find the “Share,” “Member permissions,” or “Version history” area, list everyone who can see the files, and revoke access one by one. Then make a simple inventory: why each record was collected, who uses it, how long it is kept, and when it gets deleted after a customer requests removal.
I got this wrong too. At first, I thought recalling a misdirected file meant it never happened. Later, I realized the file might already have been downloaded, and messages and forwards can’t be pulled back. So I switched to a two-person check: sensitive information is split across separate files, and another person reviews it before anything goes out. A free cloud drive doesn’t offer unlimited storage, but it can be enough for a small team to get running. There’s no need to reorganize everything today, but at minimum, don’t mix ID numbers, bank card details, and long-unused chat logs in one spreadsheet. Once your customer base grows, consider a more complete CRM.
Match the setup to your stage
If you’re just starting with a handful of customers, I’d use one streamlined spreadsheet and a cloud drive with access logs, then delete what you don’t need today. If you have one or two clients, I’d tag the purpose and deletion date for every customer record and have each team member check the permissions. If you’re scaling, I’d put access approval, offboarding, and regular cleanup into the workflow, then ask someone who understands computer security to review it once. Meta’s fine may feel far away from our work, but customer trust is close. The most useful question right now may not be which complicated tool to research. It may be: who can see our customer data right now?