Privacy
Sitampu helps audit firms test their clients' payments, collect the evidence and seal the working paper. This section explains what we collect, why, and the choices you have. In it, “we” means Fidiba, LLC and “you” means anyone who uses Sitampu, including a firm's client who answers a request through a Sitampu link.
Who we are
Sitampu is a product of Fidiba, LLC, a Delaware limited liability company in the United States. Fidiba, LLC is the controller of account data: it decides how that data is used. For the client records an audit firm keeps in Sitampu, the firm is the controller and Fidiba, LLC is its processor. Our address is 131 Continental Dr, Suite 305, Newark, DE 19713, United States. You can reach us about privacy at hello@fidiba.com.
Two kinds of data
Your account. When you join a firm on Sitampu we keep your name, email address, the firm you belong to and your role. We are responsible for this data as its controller.
Your firm's audit data. The ledgers, bank and mobile-money statements, evidence, judgments and working papers a firm keeps in Sitampu belong to that firm, which is their controller. We store and process them only to run the service for it, following its instructions, as its processor. If an audit firm asked you for documents through Sitampu, contact that firm about what you sent.
What we collect
- Account details: name, email address, a hash of your password (never the password itself), your two-step verification secret, and your roles and clients.
- Sign-in details: if you sign in with Microsoft or Google, the name, email address and account ID they share with us. If you add a passkey, its public key and a name for the device; the private key never leaves your device.
- Client contacts: the name, role and mobile number a firm gives us for someone at its client, so we can text them a request link and a sign-in code. Phone numbers are stored encrypted and shown masked.
- Field devices: when a firm member pairs a phone, the device name and its pairing. Photos taken in the field stay encrypted on the phone until they sync, with the time and, if the member allows it, the place they were taken.
- Usage and security records: sign-in times, the address and browser that signed in, and an audit trail of each judgment, sign-off, permission change and export, so the firm can show who did what and when.
- Billing: our payment provider handles card details. We keep the firm's invoices, receipts and billing contact, never the full card number.
- Messages: the emails and texts we send, such as invitations, sign-in codes and request links. We keep their content for up to 30 days, then only the fact that they were delivered.
How we use it
- To run Sitampu: sign you in, store and show your firm's files, and send the emails and texts the firm asks for.
- To keep the service safe: limit sign-in attempts, investigate misuse and fix faults.
- To bill firms for the client files they test.
- To answer your questions when you contact us.
We do not sell personal data, show advertising or use your firm's data to train AI models.
AI features
When a firm uploads scanned invoices, goods received notes and similar documents, or a client sends one through a request link, the image goes to an AI provider to be read into fields such as the date, amount and quantity, and to check that it is readable. The AI doesn't judge anything: a named person at the firm judges every exception and decides whether to accept every document. The provider doesn't use what it reads to train models.
Who else processes data
We use a small number of providers, called sub-processors, to run Sitampu:
- DigitalOcean: hosting.
- Stripe: card payments.
- Resend: email.
- Anthropic: reading documents.
- Twilio: sms.
Each gets only what it needs for its part and must protect it. Firms' data is stored in London, UK. Some providers process data outside the country where you live, including in the United States. We will update this list before adding a new provider. We may also disclose data when the law requires it.
Cookies and browser storage
Sitampu uses only the cookies it needs to work: one that keeps you signed in, a short-lived one while you sign in, and, for a client answering a request, one that keeps their link open after the code. The app also keeps a few preferences in your browser. The website has no advertising or tracking cookies.
How long we keep data
We keep account details while your account exists. A sealed working paper and the evidence and audit trail behind it are kept for the period the firm sets, 7 years after sealing by default, then deleted, with a record that they were. Email and text content is kept for 30 days and a firm's export file for 7 days.
Exporting your data
An Owner can export every file, working paper, piece of evidence and audit trail the firm holds at any time, as one ZIP file. We email them when it is ready; only people who manage the firm can download it, signed in, for 7 days.
Closing your firm's account
An Owner can close the firm's account in Settings, after confirming who they are. Everyone loses access at once, the request links they sent stop working and Sitampu data is wiped from their paired phones. Sealed working papers stay checkable at their links until the firm's retention period ends, because auditors must be able to show them; then they are deleted. Our payment provider, Stripe, keeps its own payment records as the law requires.
Your choices and rights
You can see and change your name, email address, password, passkeys and two-step verification in your account settings. You can ask us for a copy of your personal data, to correct it, to delete your account or to object to how we use it by emailing hello@fidiba.com. Where your data is part of an audit firm's file, we will pass your request to that firm, which decides. We reply within 30 days. You can also complain to the data protection authority where you live.
Security
Data travels over encrypted connections and is encrypted at rest. Each firm's data is kept apart from every other firm's by database rules, and personal data such as payee account numbers is masked from people without permission. No service is perfectly secure; if a breach affects your data, we will tell you and the firm without undue delay. Our security and data page describes where data lives and who can see it in more detail.
Children
Sitampu accounts are for adults acting for an audit firm or its client.
Changes
When we change this notice we update the date above, and we email account holders about important changes before they take effect.