The bakery's social media account was still logged in on Josee's phone

The situation

Josee had eleven days left before the bakery's main ordering account would flag her old recovery email as unrecognized and lock her out entirely, which would have been a relief on any other week, except that Genevieve, the new owner, still could not get into it either. Right now, only Josee could actually get in, and she was the one who least wanted to be the one holding the keys. Once that eleven-day window closed, neither of them would have working access to the account customers actually used to place their weekend orders, and there would be no quick way back in for either of them.

Josee had run the bakery for nine years before a health diagnosis earlier that year made the decision for her: she needed to sell, and she needed to sell soon, on terms that did not require her to stay involved in daily operations. Genevieve, who had worked front-of-house at a similar shop for years, agreed to buy the business outright, in a price range typical for a small independent food business, financed mostly through savings and a modest loan. Dirk, a longtime regular who worked as a security guard and had helped Josee informally with deliveries and occasional social media posts, stayed on with the new ownership in a part-time capacity.

The asset purchase agreement Josee and Genevieve signed, drafted quickly to close before Josee's treatment schedule made negotiation harder, listed the usual items: equipment, the lease, supplier relationships, recipes. It did not specifically address the bakery's social media accounts or its online ordering profile, because neither side thought of them as something that needed a clause. Josee had built the account's following personally over years, mostly from her own phone, posting photos of custom cakes between shifts, and had never treated the login credentials as a business record in the way she treated her supplier invoices or her lease.

After closing, customers kept messaging the account to place custom cake orders, and those messages kept arriving on Josee's phone, because she was still the only one with working login access. Genevieve had no way in without Josee's help, and Josee, in the middle of treatment and trying to step back from the business entirely, did not want to be the one fielding cake orders for a shop she no longer owned. When she came to us, the deadline was concrete: the platform's own account-recovery process would only accept a change of login email for a limited window after unusual access was flagged, and that window was closing fast, with no guarantee that a slower identity-verification process would finish in time to save the account at all.

The complication

Dirk, watching from the sidelines as the regular who had helped with posts, put it plainly to Josee at the time: the shop's whole identity online lived inside a phone that belonged to her personally, and nothing about the sale had actually moved that identity anywhere else. The core complication was that whether an online account already counts as something sold turns on how the purchase agreement is written, not simply on whether an account is property the way a mixer or a lease is. Broad wording — a catch-all for all assets used in the business, a transfer of the goodwill and everything associated with it, or a covenant to sign further documents on request — can capture an account nobody thought to name individually, so the fact that no one listed the login in Josee and Genevieve's agreement did not, on its own, settle whether Josee was already obligated to hand it over. Their agreement was narrower than that: it listed specific items like equipment, the lease, supplier relationships and recipes, with nothing broad enough to clearly pull the account in either, which left the question genuinely open rather than resolved against Genevieve. Legally, the goodwill of the business, its name, reputation and customer relationships, had transferred to Genevieve as part of the sale; what remained uncertain was whether the specific digital tool customers used to reach that goodwill had gone with it, and the platform itself had no obligation to sort that out between two private parties.

Adding pressure, the account had recently had a password reset attempt from an unfamiliar device, most likely Genevieve trying to log in on her own phone using guessed credentials, which had triggered the platform's standard security hold. That hold gave a limited window during which the account's registered recovery email could still be updated by whoever currently had access, after which recovering the account would become a much longer and less certain process involving proof of identity and business ownership that neither Josee nor Genevieve had time or money to pursue if it dragged on.

Money was a real constraint on both sides. Josee's sale proceeds were earmarked for medical costs, and Genevieve had used most of her financing on the purchase price and initial working capital. Neither wanted, or could afford, a drawn-out dispute over who owned the account, and a lengthy platform dispute process risked losing the account and its following entirely regardless of who was in the right. The strategy had to be narrow: fix the specific problem in front of them, quickly and cheaply, rather than open a broader negotiation about everything the original agreement had left out.

What made this urgent rather than merely annoying was that once the recovery window closed, there would be no efficient way back in. Platforms generally do have a slower path for a legitimate business to reclaim a locked account, but it typically asks for proof of identity, proof of ownership and sometimes a formal dispute filing, and none of that process runs on a timeline a small operator with a closing loan payment coming due can count on. The bakery would have to rebuild its online presence and its following from nothing, at exactly the moment a new owner most needed continuity with existing customers to keep orders coming in.

What we did

1. Confirmed the exact recovery deadline directly with the platform's own account tools. Rather than relying on Josee's memory of a warning notice, we had her check the account's security settings directly to confirm precisely how many days remained before the recovery window closed, so every later step was built around a real deadline rather than a guess and nothing was left to chance in the final stretch.
2. Drafted a short, targeted account transfer addendum. Instead of reopening the whole purchase agreement, which neither side had budget for, we prepared a one-page addendum specifically assigning the bakery's social media and online ordering accounts to Genevieve, with Josee's written consent, that could be signed within a day, required no further negotiation between the parties, and cost a fraction of what redrafting the original agreement would have.
3. Had Josee update the recovery email herself while access still worked. Because the account was still logged in on Josee's phone, we walked her through changing the registered recovery email to one Genevieve controlled, using the access that still existed rather than waiting on the platform's slower identity-verification process, which could easily have taken longer than the eleven-day window allowed and might not have succeeded at all.
4. Documented the change with a timestamped written record. We kept a clear written account of exactly what was changed, by whom and when, signed by both parties, so that if the platform later flagged the change as suspicious, there was an immediate paper trail showing it was a legitimate, consensual business transfer rather than unauthorized access to a personal account by a stranger.
5. Redirected the customer messages during the transition. We had Josee post a brief, professional notice on the account directing customers to Genevieve going forward, closing the gap where customers were unknowingly still reaching the former owner for orders the new owner needed to be filling and could not even see arriving, some of them time-sensitive cake orders for the coming weekend.
6. Confirmed Dirk's access was separate and properly scoped. Since Dirk had informally helped manage posts before the sale, we made sure his ongoing access under the new ownership was set up fresh, under Genevieve's control, rather than left as a leftover permission from the old arrangement that nobody had reviewed, approved or could easily revoke later if the working relationship changed.
7. Reviewed the rest of the business's digital footprint for the same gap. Once the immediate deadline was handled, we asked Genevieve to list every other online tool the bakery relied on, from its supplier ordering portal to its loyalty program login, so the same oversight could not resurface somewhere less obvious, and less recoverable, a few months later when nobody was watching for it.

The outcome

The recovery email was changed with two days to spare before the platform's window closed, and Genevieve had full working control of the account before any order was missed or misdirected. The addendum cost both sides very little in time or fees, reflecting the narrow, practical fix it was rather than a full renegotiation of the sale, and it meant neither Josee nor Genevieve had to spend money they did not have on a dispute that a faster, cheaper fix could avoid entirely.

No customer order was lost during the transition, and the handful of messages that had piled up on Josee's phone during the confusion were forwarded to Genevieve so nothing fell through entirely. Josee was able to step back from the business fully once the transfer was confirmed, without lingering responsibility for a shop she no longer owned, and without the stress of fielding cake orders while managing her own health.

Because the problem was caught and fixed before the recovery window actually closed, the bakery's online following and ordering history carried forward intact into Genevieve's ownership, rather than being rebuilt from zero at the worst possible moment for a new owner trying to establish herself. The near miss did prompt one lasting change to how the file was closed out: a short list of every account, login and digital tool tied to the business, confirmed as transferred in writing, so nothing else discovered after closing would depend on a deadline nobody was watching.

The review of the wider digital footprint turned up two smaller accounts, a loyalty rewards login and a supplier ordering portal, that were still registered to Josee's old email as well. Both were updated in the same week, at no additional cost, closing off two problems that might otherwise have surfaced quietly, months later, in the middle of a busy season, when neither Josee nor Genevieve would have had the time to sort out who was supposed to be in control.

What you can learn from this