Cookie Policy

Mast Finance Sàrl. Effective date: 11 October 2026. Version 1.0

English version. This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails.

This Cookie Policy explains what cookies and similar technologies are, which ones Mast Finance Sàrl ("Mast Finance", "Mast") uses on the Service, why we use them, and how you can manage your preferences. It should be read alongside our Privacy Policy.

1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website or use an online service. They allow the service to recognise your device across sessions and store certain preferences. Cookies may be session cookies (deleted when you close your browser) or persistent cookies (retained for a defined period).

This policy also covers local storage, a similar browser technology used to store small amounts of data on your device.

2. Cookies and Local Storage We Use

2.1 Essential (Strictly Necessary)

These are strictly necessary for the Service to function. They cannot be disabled without impairing core functionality. They are placed without requiring your consent.

Essential storage is used for:

• Authentication and session management — keeping you logged in securely.
• Security — protecting against cross-site request forgery and other threats.
• Consent preference — remembering your cookie choice.

2.2 Analytics (Consent Required)

These are placed only with your consent. They allow us to understand how users navigate and use the Service to improve performance and usability. Analytics data does not identify you personally.

Analytics storage is used for:

• measuring page views, session durations, and feature usage;
• identifying errors or areas of poor performance;
• informing product development decisions.

Privacy safeguards:

• EU-based processing — Our analytics are processed in the EU (Frankfurt) by PostHog, Inc. via PostHog Cloud EU, a subprocessor listed in our Subprocessors page. Data is resident in the EU under Standard Contractual Clauses; see the Subprocessors page for the transfer basis.
• IP anonymisation — IP addresses are not stored or processed.
• Session recording masking — Form inputs are automatically masked; rendered elements holding Customer Data are further masked via the data-ph-mask mechanism so financial figures and personal identifiers do not appear in recordings.
• No Customer Data transmitted — only Service Data (behavioural telemetry, bucketed amounts, enum metadata). Financial records, customer names, IBANs, and other Customer Data stay in AWS Switzerland.
• No analytics before consent — The analytics library loads in a disabled state and makes no network request until you consent. No analytics events are captured, and no ph_* or other tracking cookies or storage entries are set, before you provide consent. Fonts, icons, and other static assets are served from our own infrastructure, so loading the page does not transmit your IP address to any third party. If you decline, the analytics library stays disabled and no behavioural data is collected.

3. Storage Details

Note: Analytics entries (ph_*) are only created after you provide consent. Before consent, no analytics events are captured and no tracking identifiers are set; the analytics library remains loaded in a disabled state.

4. Managing Your Cookie Preferences

You can manage your preferences in the following ways:

• Cookie banner — On your first visit, you can accept or decline analytics cookies.
• Cookie settings — Update your preference at any time via the "Cookie settings" control in the footer.
• Browser settings — Most browsers allow you to block or delete cookies and local storage. Blocking essential storage will impair your ability to use the Service.

Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

5. Third-Party Cookies

We do not use third-party advertising or tracking cookies. Analytics is provided by PostHog Cloud EU (Frankfurt) as a subprocessor under our DPA — see Subprocessors page for the complete list of third parties and their roles.

6. Data Retention for Analytics

• Event data (page views, feature usage): 90 days.
• Session recordings: 30 days.

After these periods, data is automatically and permanently deleted.

7. Changes to This Policy

We may update this Cookie Policy at any time. The current version is always available at /cookies.

8. Contact

For questions about cookies or this policy, please contact us at contact@mastfinance.io.

9. Language

This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails. A rendering in any other language is provided for information only.

Mast Finance Sàrl — Rue Centrale 15, 1003 Lausanne, Switzerland — contact@mastfinance.io