Privacy Policy

This policy explains how Paarus Vekaria, trading as StatimFP&A (“Statim”, “we”) collects and uses personal data when we act as a controller— that is, for the data we hold about the people who visit our websites, enquire about, buy, or operate the StatimFP&A service (the “Service”). Statim is not yet incorporated — once StatimFP&A's UAE company is licensed it becomes the controller of this data and we will tell you in writing.

Financial and personal data that our customers load into the Service — trial balances, transactions, client and portfolio-company records — is processed on our customers’ behalf as their processor, and is governed by the Data Processing Addendum and the customer’s own privacy notices, not this policy. If your data is in the Service because an accounting practice or investor group you work with put it there, contact them in the first instance.

We can be contacted about privacy at hello@statimfpa.ai (postal address on request).

As a controller we collect:

1. Account data — name, work email address, role, organisation, and authentication data (hashed passwords, MFA enrolment) for each account holder and Authorised User;
2. Billing data — billing contact details, plan, invoices and payment status (we do not take card payments yet; if we add a payment provider, it will hold card details, not us);
3. Usage and device data — log-ins, feature usage, IP address, browser and device information, collected to secure and improve the Service;
4. Support and correspondence — emails and messages you send us, including access requests and support tickets;
5. Prospect data — business contact details of people at organisations we believe may be interested in the Service, gathered from public sources (for example Companies House and company websites) or provided by you.

We use this data:

1. to provide, secure and administer the Service and accounts — performance of a contract, and legitimate interests in keeping the Service secure;
2. to bill and collect fees, and to keep accounting and tax records — performance of a contract and legal obligation;
3. to respond to enquiries and provide support — performance of a contract or legitimate interests;
4. to understand how the Service is used and improve it — legitimate interests;
5. to send business-to-business marketing about the Service, from which you can opt out at any time — legitimate interests, subject to the rules on electronic marketing;
6. to establish, exercise or defend legal claims — legitimate interests.

We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

We share personal data only with:

1. service providers who process it for us under contract — today hosting and infrastructure and the AI model provider used by the Service, and bank-connection providers only if you connect a bank (the current list is on our sub-processors page);
2. professional advisers (lawyers, accountants, insurers) under confidentiality;
3. authorities or regulators where disclosure is required by law; and
4. a buyer or successor in the event of a sale, merger or reorganisation of our business, with notice to you.

We are based in the United Arab Emirates and host the Service in Germany (EU) with Hetzner Online GmbH. Where a provider processes personal data outside the UK, we rely on UK adequacy regulations or appropriate safeguards — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — plus supplementary measures where needed.

We keep personal data no longer than needed. The table covers the data this policy is about and, for completeness, the Customer Data we process for our customers (clause 1.2):

We apply technical and organisational measures appropriate to the risk, including encryption in transit, hashed credentials, multi-factor authentication for privileged roles, tenant isolation with role-based and row-level access controls, least-privilege internal access, and routine backups. No system is perfectly secure; we will notify affected people and the ICO of any breach where the law requires it.

Under the UK GDPR you may ask us for access to your personal data, correction, erasure, restriction, portability, and to object to processing based on legitimate interests (including direct marketing, where objection is absolute). Write to hello@statimfpa.ai; we respond within one month. We may need to verify your identity first.

You may complain to the Information Commissioner’s Office (ico.org.uk), though we’d welcome the chance to resolve any concern first.

The Service uses strictly necessary cookies and browser storage for sign-in sessions and remembering your workspace selections. We do not use analytics cookies. We do not use third-party advertising cookies.

We may update this policy from time to time; material changes will be notified by email or in-product notice. The version date at the top shows when it last changed.