Privacy and terms

Privacy

Fidiba helps organisations collect programme data, analyse it and report on it. This section explains what we collect, why, and the choices you have. In it, “we” means Fidiba, LLC and “you” means anyone who uses Fidiba or fills in a form made with it.

Who we are

Fidiba is run by Fidiba, LLC, a Delaware limited liability company in the United States. Fidiba, LLC is the controller of account data: it decides how that data is used. For the data an organisation keeps in Fidiba, the organisation is the controller and Fidiba, LLC is its processor. Our address is 131 Continental Dr, Suite 305, Newark, DE 19713, United States. You can reach us about privacy at [email protected].

Two kinds of data

Your account. When you create an account we keep your name, email address and the organisation you belong to. We are responsible for this data as its controller.

Your organisation's data. The forms, answers, records, dashboards and reports an organisation keeps in Fidiba belong to that organisation, which is their controller. We store and process them only to run the service for it, following its instructions, as its processor. If you answered a form made with Fidiba, contact the organisation that sent it about your answers.

What we collect

• Account details: name, email address, a hash of your password (never the password itself), and your roles.
• Sign-in details: if you sign in with Google, the name, email address and account ID Google shares with us. If you add a passkey, its public key and a name for the device; the private key never leaves your device.
• Usage and security records: sign-in times, the address and browser that signed in, and a log of important actions in your organisation, so we and your organisation can keep accounts safe.
• Billing: if your organisation pays, our payment provider handles the card details. We keep the plan, invoices and billing contact, never the full card number.
• Messages: emails we send you, such as sign-in links, invitations and scheduled reports. We keep their content for up to 30 days, then only the fact that they were delivered.

How we use it

• To run Fidiba: sign you in, store and show your data, and send the emails you ask for.
• To keep the service safe: limit sign-in attempts, investigate misuse and fix faults.
• To bill organisations on paid plans.
• To answer your questions when you contact us.

We do not sell personal data, show advertising or use your organisation's data to train AI models.

AI features

When someone asks a question in plain language, the question and a description of the project's fields go to an AI provider, which returns a query for Fidiba to run. Written notes on a chart use only the totals shown on that chart. Individual form answers are not sent to an AI provider, with two exceptions an Owner chooses. If they turn on reading paper forms, a photo of a filled paper form, with the answers written on it, goes to the AI provider to be read into a response. Fidiba keeps the photo, encrypted, for 30 days so the person entering the response can check it, then deletes it. If they let the AI read the answers of a data source, the written answers to its open questions go to the AI provider to suggest themes, sort answers into them, sum them up and translate them. Personal answers are never sent, and what the AI suggests is kept only when a person accepts it. Both are off until an Owner turns them on, and an Owner can turn AI features off.

Who else processes data

We use a small number of providers, called sub-processors, to run Fidiba:

• DigitalOcean: hosting, the database and file storage.
• Cloudflare: delivering the website and app and protecting them from attacks.
• Better Stack: server logs, uptime monitoring and error reports, so we can find and fix faults.
• Resend: sending emails, such as sign-in links, invitations and scheduled reports.
• Stripe: taking payments for paid plans.
• Anthropic: the AI features described above.
• Meta (WhatsApp): sending a form to someone over WhatsApp when an organisation chooses to.
• Google: signing in, when you choose to sign in with Google, and picking files from Google Drive to import. Drive files go from your browser to Fidiba; we send Google none of your organisation's data.

Each gets only what it needs for its part and must protect it. Our security page lists what each one receives. Some of them process data outside the country where you live, including in the United States. We will update this list before adding a new provider. We may also disclose data when the law requires it.

Cookies and browser storage

Fidiba uses only the cookies it needs to work: one that keeps you signed in and a short-lived one while you sign in with Google. The app also keeps a few preferences in your browser, such as where you left off. The website has no advertising or tracking cookies.

How long we keep data

We keep account details while your account exists. An organisation's data stays until the organisation deletes it or closes its account. Downloaded report files expire after a few days, and email content after 30 days.

Exporting your data

An Owner can export everything the organisation holds at any time, for example before deleting it, as one ZIP file: its data sources as CSV files, photos, dashboards, saved analyses, codebooks and the member list. Personal answers are left out. We email the Owner a link when it is ready; only they can download it, signed in, for 7 days, even if they delete the organisation in the meantime. Owners and project managers can also export any project they manage as CSV files. Only the person who made an export can download it, and every export is deleted after 7 days.

Deleting your organisation

An Owner can delete the organisation at any time in Settings > Your data. Everyone is signed out at once, and its data source links and public dashboards stop working. We then permanently delete its projects, data sources, submissions, records, dashboards, reports and uploaded files, normally within minutes. Deleting also ends your subscription straight away, with no refund for the time left. Our payment provider, Stripe, keeps its own payment and invoice records as the law requires. Members keep their personal Fidiba accounts and any other organisations they belong to. Deleted data can remain in encrypted database backups until those expire under our hosting provider's backup retention, and is not restored from them.

Your choices and rights

You can see and change your name, email address, password and passkeys in your account settings. You can ask us for a copy of your personal data, to correct it, to delete your account or to object to how we use it by emailing [email protected]. We reply within 30 days. You can also complain to the data protection authority where you live.

Security

Data travels over encrypted connections. Each organisation's data is kept apart by database rules, and questions an organisation marks as personal are encrypted and hidden from people without permission. No service is perfectly secure; if a breach affects your data, we will tell you and the organisation without undue delay. Our security and privacy summary describes where data lives, who can see it, backups and deletion in more detail.

Children

Fidiba accounts are for adults acting for an organisation. An organisation that collects data about children through its forms is responsible for getting the consent the law requires.

Changes

When we change this notice we update the date above, and we email account holders about important changes before they take effect.

Terms of service

These terms are an agreement between you or your organisation and Fidiba, LLC, a Delaware limited liability company in the United States, which runs Fidiba. They apply when you use Fidiba. By creating an account or using the service you agree to them. If you accept them for an organisation, you confirm you may do so.

Your account

Give accurate details, keep your sign-in details to yourself and tell us at [email protected] if you think someone else has used your account. The person who creates an organisation is its Owner and decides who joins it and what they can do.

Your data

Your organisation owns the data it puts into Fidiba. You give us permission to store, process and display it only to run the service for you. You are responsible for having the right to collect it, including any consent the people you collect it from must give. You can export your data while your account is open.

Acceptable use

Do not use Fidiba to:

• break the law or collect data you have no right to collect;
• send spam or deceive the people who fill in your forms;
• upload malware or try to get into accounts or data that are not yours;
• overload, probe or reverse-engineer the service, or get around plan limits.

We may suspend an account that breaks these rules. We will tell you why unless the law or safety stops us.

Plans and payment

The Free plan costs nothing. Paid plans are billed in advance, monthly or yearly, at the prices on our pricing page, plus any tax. Team plans are charged for each member. You can change or cancel a plan at any time; a cancelled plan runs to the end of the period already paid and is not refunded unless the law requires it. If a payment fails and is not fixed, the organisation moves to the Free plan; its data stays, but it may not be able to add more beyond the Free limits. We will give at least 30 days' notice of a price change.

The service

We work to keep Fidiba available and your data safe, but we provide the service “as is”, without promising it will never be interrupted or error-free. Features may change as the product grows; we will give notice before removing something you rely on. AI features can make mistakes, so check their answers before you act on them.

Liability

As far as the law allows, we are not liable for indirect or consequential losses, such as lost profits or lost data you could have exported. Our total liability in any year is limited to what your organisation paid us in the 12 months before the claim. Nothing in these terms limits liability that the law does not allow us to limit.

Ending the agreement

You can stop using Fidiba at any time. An Owner can delete the organisation in Settings > Your data, which deletes its data straight away as described in the privacy section above. We may close an account that seriously or repeatedly breaks these terms. If we close it, you have 30 days to ask for an export, after which we delete the organisation's data, except what the law requires us to keep.

Changes to these terms

We may update these terms. We will email account holders at least 30 days before important changes take effect. Continuing to use Fidiba after that means you accept them.

Governing law

These terms are governed by the laws of the State of Delaware, United States, and any dispute about them goes to the state or federal courts in Delaware. If the law where you live gives you the right to bring a claim in your own courts or under your own laws, these terms do not take that away.

Contact

Fidiba, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. Questions about privacy or these terms: [email protected].