What we touch, and what we never ask for.

Access is yours, and revocable

We work inside the tools you already own, using accounts you create, with permissions scoped to exactly what the work needs. You issue that access and you can withdraw it at any time without asking us. We do not take copies of systems to work on privately.

Read-only first, and connecting to your ERP

We start with read-only access, and nothing is written into your systems until you approve it. An ERP connects through its own API where it has one, a scheduled export, or a service account you create and approve. An ERP on your own servers connects through an export, or a gateway you host and control.

New work runs side by side with the old way before it goes live. If you want to go back, the agent is switched off and the desk carries on as it did before.

The Operations Diagnostic, and the rest of the IT questions →

What we never ask for

• —Banking credentials or payment rails.
• —Payroll systems.
• —Stored customer payment details.
• —Administrative control of anything we do not need to touch to do the work.

Your data is not training data

Not under the configurations we deploy. We use business-tier arrangements with AI providers that exclude training on your content, and we put which ones in writing as part of the engagement, so it is a term you can hold us to, not an assurance in a sales conversation.

What happens when it ends

What we built stays with you — the configurations, the workflows, the playbooks and the documentation, in your own accounts. Our access ends when you revoke it. There is no licence to keep paying for and nothing that stops working because we are no longer involved.

Where data sits

Your operational data stays in the systems you already use. The work is done inside your tools, and we take no private copies of your operational records — no customer lists, no job histories, no message archives leave your accounts.

What we do keep is the record of the engagement itself: the agreement, the Diagnostic findings, the baseline figures you gave us, the monthly accounts, and the invoices. Those live in our own engagement system, hosted on Vercel and Neon in the United States, and you can see your own through a sign-in link we send you. Where an engagement introduces any other third-party service, we tell you which one and where it is hosted before it is introduced, not after.

Monitoring, not silence

If we build something, we watch it. A system that fails quietly is worse than the manual process it replaced, so automation we put in is monitored and a person is accountable for it. Anything a customer or a supplier will read is drafted by the agent and sent by a human.

This website

The site counts page views with Cloudflare Web Analytics, a counter that sets no cookie and identifies no one; beyond that it sets no cookie on any page you can read — the staff sign-in is the one page that sets one, for the member of staff signing in. The two things the site keeps in your browser are the setting of the Motion switch and any process you add to an industry page's Operations Blueprint, both only if you use them. The calculators compute entirely on your own machine and transmit nothing unless you choose to email yourself a result, and a process you add to the blueprint, and any plan written for it, stays in your browser. The privacy policy sets out the detail, including what our host records, what that one send contains, and what happens if you use the booking calendar.

Questions we have not answered here

Security questionnaires, NDAs, insurance certificates and anything specific to your own compliance obligations go to support@mexabuild.com. If we do not have something you need, we will say so. We will not send you a document that implies otherwise.