What we do with your information.

Gulf & Ponte is an automation practice founded and run by Yared Asefa, based in Seattle, Washington. We build workflow automations for accounting firms — systems that connect the tools a firm already uses, move and transform documents, and carry out repetitive operational work.

We operate from the United States. Email: yared@gulfandponte.com

If you email us or use the contact form, we receive whatever your message contains — typically:

• Your name, as you give it
• Your email address
• Your firm and its staff count, if you use the form
• Your message or inquiry

If you become a client, we also keep the ordinary records an engagement produces: contact details and correspondence. We do not ask for special categories of personal information, and there is no reason to send them.

We send business-to-business email to people at accounting firms that may need automation work. If you received an email from us and did not ask for it, this is the section that applies to you.

What we hold:

• Name
• Job title
• Business email address
• Employer
• Publicly available professional information about the role

We do not seek or hold personal email addresses, home addresses, personal phone numbers, or any special category information.

It comes from publicly available sources — including public licensee registries such as NASBA CPAverify — and from licensed business-to-business contact data providers. We use it to contact people at firms about services relevant to their professional role, and for nothing else.

For direct marketing, your right to object is absolute. If you object, we stop. There is no balancing test and no need to give a reason. Use the opt-out link in any email, or write to yared@gulfandponte.com. Either way we add you to a permanent suppression list so you are not contacted again.

• To reply to you
• To discuss a possible engagement
• To deliver work you have asked us for
• To keep the business records we need to keep
• To operate and protect the website and the business

We do not use what you send us for unrelated marketing.

Our engagements involve tax and accounting workflows, so taxpayer return information, as IRC §7216 and its regulations define it, is the category that matters most here. It is handled differently from everything else on this page, and deliberately so.

The workflows we build are designed to run in infrastructure controlled or contracted by the client firm, and to minimize unnecessary data movement. For the standard in-environment deployment, Gulf & Ponte does not operate a separate production document store. External model, cloud, portal, email and software providers may still process information under their own contractual terms, and a firm-owned account or API key does not change that.

To build and support a workflow we are granted scoped access to the firm’s environment, which the firm can revoke. That access may allow us to encounter information the workflow processes, so it is documented, and should be named, least-privilege, logged and time-limited where the firm’s systems support those controls. Where a workflow may involve disclosure or use requiring taxpayer consent, we say so during scoping and point to the current IRS guidance rather than routing data quietly.

Section 7216 treatment is fact-specific and we do not provide a determination or a legal opinion. Our responsibility is to document the technical facts — what is transmitted, which providers process it, where it rests, for how long, and who can reach it — so the firm and its counsel can make that determination.

Beyond TRI, an automation works on whatever the firm routes through it — business documents, practice-management records, operational data, messages. Some of that may contain personal information about the firm’s own clients, staff or contacts.

The firm decides what goes into the automation and why. We handle it to build and run what they asked for, on their instructions. Depending on the service and the law that applies, that generally makes the firm the controller and Gulf & Ponte a processor or service provider — the specific roles are set out in the agreement for that engagement.

We do not use client data for our own marketing, and we do not use it to develop or train our own products or models.

If you think a firm we work with holds information about you, that firm is the right place to send your request. Write to us and we will point you to them.

For information you send us: we use it to answer you, to carry out work you asked for, and to meet our own record-keeping obligations. For people we contact: legitimate interests — marketing relevant services to businesses that plausibly need them — limited to business contact details, work-relevant messages, and an immediate stop on request. For client data in an automation: the client firm determines the purpose, so the basis for that processing is theirs, not ours.

Depending on where you live, you may have rights to see the personal information we hold about you, correct it, delete it, restrict how it is used, object to that use, or receive it in a portable form. Ask us and we will tell you what we can do.

You can also complain to a supervisory authority — in the UK, the Information Commissioner’s Office; elsewhere, the data protection authority for your country.

We do not sell personal information, and we do not pass it to anyone for their own purposes. We use third-party services to run the business — hosting and email. They handle information in order to provide those services to us, not for themselves.

Where a workflow runs on infrastructure and providers the client firm contracts with directly, those relationships are the firm’s rather than ours — which does not mean those providers do not process data, and does not settle how any of them is legally classified. If a scope requires a service that we contract, it is named during scoping and approved by the firm before it processes client data.

We keep information for as long as it is needed for the purpose it was given, and for as long as we need to keep ordinary business records. When it is no longer needed, we delete it.

Contact records for people we have emailed are reviewed at least every 24 months. If there has been no engagement and the person no longer appears to hold the role we were contacting them about, the record is deleted.

Suppression records are the deliberate exception. If you opt out or object, we keep the minimum needed to recognize your address and exclude it — permanently. It is the only way to guarantee you are never contacted again, and it is never used for marketing.

This site sets no cookies of its own, runs no analytics, and loads no external fonts or trackers. Fonts are served from this domain. One page embeds a third party, and it is named below.

The booking page is the one exception. It embeds a scheduling calendar provided by a third party, and that calendar loads when the page opens. It sets its own cookies under its own privacy notice, it can see that your browser opened it, and booking a time gives the provider what you type into it. Every other page loads nothing from anyone else.

As with any hosted website, our host processes standard request information — such as your IP address — in order to serve the site and protect it from abuse.

We limit access to what a piece of work actually requires, and end that access when the work ends. Access to a client environment is scoped, named and revocable by the client at any time.

If we change how we handle personal information, we will update this page and change the date at the top of it. Questions about this notice, or a request about your own information, go to yared@gulfandponte.com.

If you need our postal address in writing — to make a request, or to satisfy your own records — email us and we will send it.