Own your customer data with a private back office

Every lead this website has ever received, every visit, every section read and every demo tried sits in one database that I own. No cookie on the visitor, no request to any other company. That is the desk behind this site, and it is what a private CRM for a small business looks like at its smallest. A pipeline, a visitor ledger and a reports page, in your name, exported any day. The arrangement most small businesses run instead is their customers in one vendor's database, their analytics on another vendor's servers, and a cookie banner apologising for both.

This is what my own desk records and what it refuses to, and how the analytics work without a tracker. Then what US privacy law actually asks of a business your size, and where a private back office stops and the tools you rent begin.

The short version Keep your leads and your visits in a database opened in your name, so the record goes with the business and not with a login. Count visitors with an id that dies at midnight and send nothing to a third party, and the cookie banner has no reason to exist. Measure the five numbers an owner needs, leads by source, win rate, reply time, the funnel, and time to enquiry, on your own reports page. Rent the tools that do everybody's job, email and invoicing among them, and feed them from your own record.

What owning your data means in practice#

The difference shows up at the moments a subscription would rather you did not think about. When you add a person, a rented CRM adds a seat fee, and a system you own adds a login. Your data sits in their database on their terms, or in yours, exported any day. When you sell the business, the subscription ends with the login, and a system you own is an asset on the sheet that goes with the sale. When you outgrow a tier, they migrate you to the enterprise plan, and you change a plan on an account you already hold.

Analytics have the same shape, and the deletion is scheduled. Google's own help pages say a standard Analytics property keeps event data for 2 or 14 months, and that when data reaches the end of the retention period it is deleted automatically, monthly. That is Google's storage and Google's calendar. A ledger you own keeps what you decide, for as long as you decide, and the export is a query on your own table.

What my own desk records#

Four screens, one database, every action written to an audit trail. The homepage shows the systems I have built for clients. The desk is the one I built for myself, and it is the smallest honest version of a private back office.

The overview shows what needs me today: leads waiting, leads past my working-day promise, follow-ups due, and the open pipeline value. Below it, the wall: people by day, where they came from, which pages they read, which demos they tried, and how many bot hits were kept out.

The pipeline holds every lead with a stage, new, replied, call booked, won or lost, plus spam and archived, and a value, a follow-up date, a notes thread and a drafted reply. Each lead records where it came from: the referrer, the landing page, the campaign tags, the country, region and city, and the device. The day's visitor id is stored too, so the lead's own visit trail sits next to what they wrote. A repeat message from the same address while the first is unanswered is folded into the same lead, so I never answer one person twice.

Visits shows every visit, one by one, with pages, sections read, demos tried, clicks, device and place, and whether it became a lead. Reports gives the five numbers I actually need. Leads per week by source, need, budget and stage. Win rate and value won. Median reply time against the working-day promise. The visitor to lead funnel, and the time from first landing to sending.

What it refuses to record matters as much. It never records the desk itself. It drops crawlers, audit tools and headless browsers by their own user agent before anything is written, and counts them apart, by family and network, so the people numbers are people. And it stores no cookie on anyone.

Analytics without a tracker#

The page you are reading sends one small batch of events to my own server every few seconds and one more on the way out. The view, each section reached, each control touched, each demo milestone, the speed the page painted at on your own device, any script error, and how far you scrolled. Nothing goes anywhere else. The homepage puts the numbers next to the claim: zero third-party requests, zero cookies.

The visitor id is the whole trick. My server makes it by hashing today's date, a secret only the server knows, your address and your browser. The same person on the same day gets the same id, so a visit holds together. At midnight the date changes and the id changes with it, and nothing on the server can join yesterday's id to today's.

A second id lives in the tab and dies with the tab, so two people behind one office connection are told apart. No cookie is set, because there is nothing to remember.

What you give up is real, and I will name it. You cannot follow a person across days, so there is no returning-visitor number and no thirty-day attribution window. You cannot see what someone did on another site. If you run paid ads, the ad platform's own reporting is the only place the click-to-sale chain exists, and you will use it. What you keep is what an owner actually reads on a Monday: how many people came, from where, what they read, what they tried, and who wrote.

US cookie consent, honestly#

I am not a lawyer, and the law here is a patchwork that changes every session. The IAPP's state privacy law report counted nineteen states with comprehensive consumer privacy laws as of October 2025. The oldest and broadest is California's. The California Privacy Protection Agency says it applies to a for-profit business that meets any one of three tests. Gross annual revenue of 26.625 million dollars or more. Buying, selling or sharing the personal information of 100,000 or more California residents or households. Or deriving half or more of its revenue from selling or sharing it.

Most businesses reading this fall under all three, and the other states' laws mostly set thresholds of a similar shape. So the banner on a small business's site is rarely there because a law demanded it. It is there because a third-party tracker was installed, and the tracker's vendor recommended the banner to cover itself. Remove the tracker and count visitors the way described above, and the banner has nothing left to ask permission for.

Ask a lawyer about your state before you rely on that sentence. What I can promise is the engineering half: a ledger that stores nothing about a person past midnight has removed the reason the banner exists.

"A spreadsheet or a free CRM already does this"#

The spreadsheet does it until two people edit it on the same afternoon, or a lead arrives at 9 pm and sits in an inbox until someone copies it across. It has no visit trail, so you never learn which page produced the lead, and it cannot measure your own reply time, which is the number that decides whether you are losing jobs. For one person with a few leads a month it is fine, and I would tell you so.

The free CRM tier does more, and the price is the database. Your contacts sit in the vendor's tables, and the trail, which pages, which demo, which day, is not in them, because the vendor's tracker is not your ledger. Export gives you the contacts and leaves the story behind. Then the free tier ends where the vendor decided it should, at a contact count or a feature, and the seat fee begins.

None of that is wicked. It is the shape of renting, and for a job everybody has the same way I rent too. Leads and visits are not that job. They are the record of your business, and the argument for owning that piece is the guide on custom software for a small business.

The private part#

A private back office is only private if the door holds, so here is the door on mine, in plain words. The desk lives at an address nobody is told, and the usual addresses answer with a not-found page. Signing in takes a password, checked against a slow hash, and a one-time code from a phone app when that second step is switched on. Five wrong tries from one address lock the door for fifteen minutes, and every attempt is logged with where it came from.

A signed-in session is a signed cookie bound to the browser that opened it, so a copied cookie fails elsewhere, and it lasts twelve hours. Every action anyone takes on the desk, a stage change, a note, an export, a sign-in, is written to the audit trail with the time.

The public side is guarded too. The contact form is checked by a proof of work the browser computes and a rate limit of three sends per address per ten minutes. A spam mark blocks the sender's address and email from then on. A second message from someone whose first is still unanswered is folded into the same lead rather than becoming a new one. None of it needs a third party, and all of it is yours to read.

What it does not do#

It sends no email campaigns, raises no invoices and keeps no calendar of its own. The booking form asks for a day and a part of the day, and I confirm the time by email, because a calendar is a job everybody has and the rented ones are good. It does not answer messages; that is the inbox, which feeds leads into a pipeline like this one. It does not take orders; that is the store, and a store's back office is its own subject, starting with why the checkout is slow.

A private back office is one narrow piece: the record of who wrote, where they came from, what happened next, and the five numbers that fall out of it. It hands that record to the tools that do the rest, by export or by a connection. It is built the way every system I ship is built, in four stages on a fixed price, on accounts in your name.

Start with your export#

Go to wherever your customers live today, the CRM, the form tool, the spreadsheet, and export everything you are allowed to. Count the fields you got back, and write down the ones you could not get: which page each lead came from, what they read before writing, how long you took to reply. That list is the record you do not own, and it is the specification for the one you should.

If the list is long, send me a message. I will tell you whether the answer is a private back office, a better export, or a spreadsheet and a rule.