Data Retention & Account Deletion Policy

Mast Finance Sàrl. Effective date: 16 October 2026. Version 1.0

English version. This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails.

1. Legal Framework

1.1 Swiss Code of Obligations (CO Art. 958f)

Swiss law requires entities subject to bookkeeping obligations (i.e., the company using Mast) to retain their accounting records for 10 years from the end of the fiscal year in which the last entry was made. This includes:

• Accounting books (journal, ledger, inventory)
• Supporting documents and vouchers
• Invoices (issued and received)
• Bank statements
• VAT documents
• Annual and audit reports

Important: This obligation belongs to the company (the data controller), not to Mast Finance Sàrl ("Mast Finance", "Mast") as the SaaS provider (data processor). When a company closes its Mast account, it is their responsibility to retain their records for the legally required period.

1.2 Swiss Federal Act on Data Protection (revFADP / nDSG)

Under the revFADP (effective September 1, 2023):

• Personal data must be deleted or anonymized when it is no longer needed for the purpose it was collected.
• Once the business relationship with a customer ends, Mast has no legal basis to retain that customer's data long-term.
• The data minimization principle requires that data retention be limited to what is strictly necessary.

1.3 Data Portability

The revFADP grants individuals the right to receive their personal data in a commonly used electronic format. Mast extends this to all tenant data (not just personal data) to ensure companies can export their complete financial records before account closure.

2. Account Deletion and Post-Termination Lifecycle

The same Day 0 / Day 30 / Day 90 clock applies whether the account is deleted at the customer's request or the subscription simply ends (cancellation, expiry of a free trial, cancellation for non-payment, or the end of the transitional period that follows a relationship with a fiduciary firm). Only the Day 0 step differs, as set out below.

2.1 Day 0: Deletion Requested, or the Subscription Ends

Deletion at your request. To have the account deleted, write to contact@mastfinance.io from the account owner's address. Before we confirm the deletion:

• we offer you a complete archive of all your tenant data (a ZIP file holding your financial records, your documents and the account's audit trail), which you may decline in writing;
• we record in the audit log who requested the deletion, whether the export was provided or declined, and the timestamp.

Once the deletion is confirmed, the tenant status is set to PENDING_DELETION. Members keep read-only access for 30 days, enough to export the data, and nothing can be changed. Access ends on Day 30. You are informed that the data is retained for 30 days and that you can ask us to cancel the deletion during that period.

Where Mast must preserve an account's data because of a dispute, or to establish, exercise or defend legal claims, every scheduled deletion of that data, those of the deletion clock included, is paused until this hold is lifted, apart from copies already handed over to you and backups, which expire as stated; access to the account still ends on Day 30.

End of subscription. Where the account simply reaches the end of a cancelled or unpaid subscription, or a free trial expires, no lockout applies at Day 0: you and your users keep read and export access for the 30-day grace period below. Access ends on Day 30. Cancellation for non-payment is described in §9.7 of the Terms of Service.

Account released by a fiduciary firm. Where a fiduciary firm stops paying for or holding a company's account, the company keeps access for the transitional period stated in the notice Mast sends it (§13 of the Terms of Service). If no one then pays for the account, its Day 0 is the end of that period, and the end of subscription above applies.

2.2 Day 0-30: Grace Period

• As soon as the account is closed, Mast prepares a complete archive of your data and emails the billing or contact address on the account. The account owner can download it from Settings > Data Export until Day 30.
• All data remains fully intact.
• You can sign in, read and export your data throughout this period via Settings > Data Export; nothing can be changed.
• To cancel a deletion and have the account reactivated, email contact@mastfinance.io. Reactivation checks seat availability — if an organisation has filled the vacated seat, reactivation into that organisation is blocked until its owner frees a seat, and we tell you which organisation(s) are at capacity.
• Export reminder emails are sent to the billing or contact address on the account around Day 20 ("10 days remaining") and again around Day 25 ("5 days remaining, final warning").
• Apart from preparing your archive, no automated processing of your data occurs during this period.

2.3 Day 30: PII Anonymization

• Individual personal data anonymized: User first names, last names, email addresses, phone numbers, and address/bank fields are replaced with SHA-256 hashes or cleared.
• Cognito user permanently deleted from AWS Cognito.
• Audit trail erased: the account's audit trail, which your archive contains, is deleted from the Service. Mast keeps only cryptographic fingerprints of it, which hold none of its content but let a copy you produce be checked. If you neither received an archive nor declined one, the trail is kept until Day 90.
• Tenant status changed to ARCHIVED. Tenant settings JSON cleared.
• Company name retained: The tenant's company name and creation date are kept as business data (not individual PII) for Mast's own billing cross-reference.
• Reactivation is no longer possible after this point.

2.4 Day 90: Financial Data Purge

• All tenant-scoped financial data permanently deleted:

  • Invoices, credit notes, offers, orders, delivery notes
  • Bills, expenses, purchase orders
  • Journal entries and journal lines
  • Bank accounts and bank transactions
  • Customers, suppliers, products, cost centers
  • Fixed assets and depreciation schedules
  • Fiscal years, accounting periods
  • Tax rates, VAT settings
  • Chart of accounts
  • Company profile and settings
  • Roles and permissions
  • Teams and team memberships

• User records deleted (already anonymized at Day 30).

The purge takes place once your data has been handed over in an archive, or you have declined the archive in writing. Until then it is kept.

If your account closed before you downloaded your archive, we may email the billing or contact address on the account a link to download it. The link works for seven days and for up to five downloads, and we email that address each time it is used. Anyone who has the link can download the archive, so do not forward the email. We delete your data once you have downloaded the archive and the link has closed, or once you have declined the archive in writing. A waiver must come in writing from the account's owner, a person who signs for your company, or your representative under a mandate.

• Retained by Mast (for Mast's own 10-year bookkeeping obligation under CO Art. 958f):
  • Tenant record (id, company name, slug, subscription plan, creation date, deletion date, purge date) — serves as the billing cross-reference to identify which company Mast issued invoices to.
  • Cryptographic fingerprints of the audit trail (hashes only, no content), so that the archive you received can still be shown intact.
  • Stripe billing records (subscription invoices, payment history) — retained externally in Stripe, linkable via tenant ID.

This structure ensures Mast can always identify which company it billed and for what period, satisfying the 10-year retention requirement, without retaining any of the customer's own financial or personal data.

3. Data Export

3.1 Export Availability

The account owner can export all tenant data at any time via:

• the Settings > Data Export page in the application, including while the account is read only or within the 30-day grace period;
• the export Mast Finance offers before confirming a deletion request.

3.2 Export Contents

The export includes all tenant-scoped data organized by entity type:

3.3 Export Format

A ZIP archive: your data by entity type, as JSON or as CSV, your documents in their original format, and a manifest listing each document with its SHA-256 fingerprint. It is built in the background; the account owner downloads it from Settings > Data Export, where it stays available for 30 days after it is built.

3.4 Legal Notice

The export includes a notice reminding the company that they are responsible for retaining their accounting records for 10 years under Swiss law (CO Art. 958f).

4. What Mast Retains After Full Purge

After the 90-day purge completes, the only data Mast retains is:

No individual personal data (names, personal emails, phone numbers) or customer financial data (invoices, journals, bank transactions) is retained in the Service after the 90-day purge. Encrypted backups of the production database taken before then, kept apart from the Service, expire within 12 months of being taken and are used only to restore the Service after a disaster (Privacy Policy, section 4). The tenant record retains only the company name and subscription metadata needed for Mast to identify who it billed, as required by Swiss bookkeeping law.

5. Contact

For questions about data retention or to request account reactivation during the grace period:

• Email: contact@mastfinance.io
• Subject: "Account Reactivation Request" (include company name and owner email)

6. Language

This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails. A rendering in any other language is provided for information only.

Mast Finance Sàrl — Rue Centrale 15, 1003 Lausanne, Switzerland — contact@mastfinance.io