Sign in Book a demo

Privacy Policy

Mast Finance Sàrl. Effective date: 22 October 2026. Version 1.0

English version. This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails.

Mast Finance Sàrl ("Mast Finance", "Mast", "we", "us") is committed to protecting personal data. This Privacy Policy explains how we collect, use, and protect personal data in connection with the Mast Finance Service, and describes the rights of individuals under applicable data protection law, including the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (revFADP / nDSG).

1. Who We Are and Our Roles

Mast Finance Sàrl is a Swiss limited liability company registered under CHE-136.079.732, with registered address at Rue Centrale 15, 1003 Lausanne, Switzerland.

Depending on the context:

  • Data controller: Mast Finance acts as data controller for personal data it processes for its own business purposes, including account management, billing, security, and service improvement.
  • Data processor: Mast Finance acts as data processor when processing Customer Data on behalf of customers in the context of providing the Service. Such processing is governed by our Data Processing Agreement (DPA).

2. Personal Data We Process

We may process the following categories of personal data, depending on how you use the Service:

  • Account and contact data: names, job titles, email addresses, company name, billing contact details.
  • Enquiry data: what you tell us when you write to us through the contact form on our website or ask for a quote in the Service: your name, email address, phone number, company and role, the size of your team and, for a fiduciary firm, its number of client mandates, the software you use, and your message, together with our replies.
  • Authentication and access data: user IDs, login timestamps, session data, device identifiers. Note: IP addresses are processed by authentication infrastructure but are not stored by our analytics platform (see Section 4).
  • Service Data (collected by Mast Finance as controller for its own business purposes): account metadata, user identifiers, login events and frequency, session duration and activity, feature usage and adoption data, clickstream data, API call volumes, error rates, subscription and billing data, device identifiers, and any other technical or behavioural data generated through interaction with the Service. Service Data does not include the substantive financial, accounting, or business content uploaded by customers ("Customer Data"), which is processed separately as described in the Data Processing Agreement.
  • Billing and subscription data: invoices, payment status, subscription plan details.
  • Customer Data: financial, accounting, expense, and treasury data uploaded or generated through the Service, which may include data relating to employees, contractors, customers, or suppliers.
  • AI and automated feature data: inputs, prompts, configurations, and outputs submitted to or generated by AI-based or automated features.

Personal data is collected directly from customers, authorized users and the people who write to us, or generated automatically through use of the Service.

3. Purposes and Legal Bases

We process personal data for the following purposes:

  • Providing and operating the Service: legal basis — performance of a contract (Art. 6(1)(b) GDPR).
  • Billing and account management: legal basis — performance of a contract and legitimate interests.
  • Answering your enquiries and quote requests: on the legal basis of steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), then of legitimate interests (Art. 6(1)(f) GDPR) for keeping the exchange for the period stated in Section 9.
  • Security, fraud prevention, and misuse detection: legal basis — legitimate interests (Art. 6(1)(f) GDPR), balanced against individuals' rights.
  • Compliance with legal obligations: legal basis — legal obligation (Art. 6(1)(c) GDPR), including accounting, tax, and regulatory requirements.
  • Error tracking and service reliability monitoring: legal basis — legitimate interests (Art. 6(1)(f) GDPR). We use error tracking to identify and resolve technical issues. No personal data is collected by default; error reports contain only technical stack traces and metadata. Error-tracking data is processed in the EU (Frankfurt) by Sentry, a subprocessor listed in our Subprocessors page.
  • Business intelligence, product development, and commercial analytics (acting as controller): Mast Finance uses Service Data to analyse its customer base, measure feature adoption, monitor usage trends, inform product development and commercial decisions, and detect security threats. Legal basis — legitimate interests (Art. 6(1)(f) GDPR).
  • Cookie-based analytics: legal basis — consent (Art. 6(1)(a) GDPR), collected via cookie banner. See our Cookie Policy for full details.
  • AI-Powered Features (Mast AI): The Service includes an embedded AI assistant that helps you navigate the application, understand financial concepts, and analyse your data. When you use Mast AI, the content of your query and relevant financial context from your account (such as revenue and expense totals, cash position, and customer/supplier names) are sent to our AI infrastructure for processing. Responses are returned in real time and stored as part of your conversation history. The AI infrastructure is operated by the providers listed on our Subprocessors page. Customer Data is stored in Switzerland, and AI inference runs in Switzerland or in the European Union, in regions covered by the Switzerland–EU adequacy decision. None of these providers uses your prompts, completions or Customer Data to train or improve its models. That bar is contractual and admits no exception; no setting in the Service can change it. Mast Finance's own models likewise are not trained on your data, unless your organisation expressly enables the model improvement programme (disabled by default, enabled only by an owner or administrator, revocable at any time). This programme is not offered in the Service yet, so no such training takes place. Where enabled, Mast Finance uses only irreversibly anonymised training examples (no names, addresses, or account numbers, and amounts reduced to orders of magnitude), as described in our Terms of Service. The providers concerned are listed on our Subprocessors page. Legal basis — performance of contract (Art. 6(1)(b) GDPR).

4. Hosting and Infrastructure

The Service is hosted on Amazon Web Services (AWS). Customer Data is stored in the AWS Switzerland (Zurich) region (eu-central-2), backups included:

  • Backups. The production database is backed up continuously, with point-in-time recovery over 35 days, and a monthly snapshot is kept for 12 months. A copy of each monthly backup is kept for 12 months in a separate Mast account, also in Zurich, encrypted with that account's own key and locked so that nobody can delete it before it expires; it protects the data against the loss or compromise of the production account. Backups are used only to restore the Service after a disaster.

Document recognition (OCR). A scanned or photographed bill, receipt or expense document whose text cannot be read directly is sent to Microsoft Azure AI Document Intelligence in Switzerland (Azure Switzerland North, Zurich), which returns the recognised text. Microsoft processes the document in that region and deletes it and the result within 24 hours. No Customer Data leaves Switzerland in this flow. Microsoft is listed on our Subprocessors page.

Bank connections (bLink). Where you connect a bank account through bLink, the Swiss open banking platform operated by SIX BBS AG (Zurich), your bank sends that account's information to Mast through SIX: its identifier and holder, its balance and its booked transactions, which name the counterparties and carry each payment's references. Where the Service offers it, the payment orders you send to your bank travel the same way, with each beneficiary's name, address and account, the amount and the reference. SIX also keeps, on Mast's behalf, the access token your bank issues when you give your consent (SIX's Consent-as-a-Service); Mast keeps only a reference to it. For the operations you start yourself (connecting or disconnecting a bank, choosing accounts, syncing on request), the IP address and browser of your device are passed to SIX and to your bank, as bLink requires. These data are used only to provide the Service to you. Connecting a bank requires your express consent, given in a separate step, to the access and processing outside Switzerland that apply to these data, described in §3.5 of our Terms of Service and in Section 7; you withdraw it by disconnecting the bank. SIX operates bLink only in Switzerland and passes these data on without keeping or analysing their content; it is responsible for its own processing as the operator of bLink. Your bank processes them under your agreement with it and its own privacy notice.

One limited flow places Customer Data at rest inside the EU rather than Switzerland, under the Switzerland–EU adequacy decision and the AWS Data Processing Addendum:

  • Inbound invoice email. Where you enable bill reception by email, messages addressed to the Mast invoice address and their attachments are received by AWS SES and held transiently in AWS Ireland (eu-west-1) for at most 7 days before being ingested into your tenant in Switzerland. SES email receiving is not offered in the Zurich region.

Analytics and error tracking:

  • Product analytics (PostHog) is processed in the EU (Frankfurt) by PostHog Cloud EU, a subprocessor. Analytics covers usage events, feature adoption, and — where enabled — anonymised session recordings with masked input fields. IP addresses are not collected. This is Service Data only; no Customer Data (financial or accounting records) is ever transmitted.
  • Error tracking (Sentry) is processed in the EU (Frankfurt) by Sentry Cloud EU, a subprocessor. No personal data is collected by default; error reports contain only technical stack traces and metadata. Email addresses that appear in error messages are automatically redacted before transmission.

Both subprocessors are listed with full legal entity names and SCC basis on our Subprocessors page.

Transactional email delivery uses AWS SES in the EU (Ireland, eu-west-1), as SES is not available in eu-central-2. Account emails sent by our authentication service (sign-up verification codes and password resets) are delivered through AWS SES in the EU (Frankfurt, eu-central-1); these carry your email address and a one-time code, and no Customer Data. Static frontend assets are served via AWS CloudFront, AWS's content delivery network, from its edge locations; the Service's traffic, Customer Data included, may also be routed through CloudFront, encrypted and without being stored there, via the edge location nearest to the user, which can be outside Switzerland. All AWS services are covered by a single AWS Data Processing Addendum (DPA).

5. The Mast App for iOS and Android

The Mast app for iPhone and Android phones (the "app") is part of the Service. You sign in to it with your existing Mast account; the app creates no accounts and sells nothing. What you do in the app is processed by the same systems and under the same roles as in the web application: Customer Data under the Data Processing Agreement, Service Data as described in Section 2.

  • Camera and photos. The app asks for your camera or your photo library only when you photograph or choose a receipt, a bill, or a picture to attach to a request or to a question for Mast AI. The picture you choose is sent to your organisation's Mast account and processed as Customer Data, like a document uploaded in the web application. The app reads no other photo, and deletes its own copies from the phone once the picture has been sent.
  • Face ID, Touch ID and fingerprint. After a few minutes away from the app, it asks your phone to confirm it is you before showing anything. Your phone's operating system performs that check; the app learns only whether it succeeded, and Mast never receives biometric data.
  • On your phone. The app keeps your session in the phone's secure storage (the Keychain on iOS, the Keystore on Android) and removes it when you sign out. What the app shows you is held in memory while you use it and is not stored on the phone.
  • Error reports. If the app fails, it sends a technical report to Sentry, the error-tracking subprocessor described in Sections 3 and 4, in the EU (Frankfurt): the error, the app version, the device model and the operating system version. Reports carry no Customer Data and no account identity; email addresses and account numbers that appear in an error message are removed on the phone before anything is sent.
  • No advertising, no analytics, no tracking. The app contains no advertising and no product analytics, and does not track you across other companies' apps or websites.
  • Apple and Google distribute the app. Your download and your App Store or Google Play account are governed by their privacy policies, not by this one.

6. Subprocessors

We engage a limited number of subprocessors to provide components of the Service. A current and up-to-date list of subprocessors is publicly available at mastfinance.io/subprocessors. Customers may object to new subprocessors on legitimate data protection grounds as set out in our Data Processing Agreement.

Note: Product analytics (PostHog) and error tracking (Sentry) are both EU-based subprocessors processing data in Frankfurt. Customer Data — your financial and accounting records — is never transmitted to these services. They receive only Service Data (telemetry, usage events, error metadata), as described in Section 2. Scanned documents are read by Microsoft Azure AI Document Intelligence in Switzerland, as described in Section 4.

7. International Data Transfers

We store and process Customer Data primarily in Switzerland (AWS Zurich). Data flows outside Switzerland in the following limited and documented circumstances:

  1. Transactional emails are routed through AWS SES in the EU (Ireland, eu-west-1), which is covered by the AWS DPA.
  2. AWS CloudFront, AWS's content delivery network, delivers the static frontend assets and may route the Service's traffic, Customer Data included, encrypted and without storing it, through the edge location nearest to the user, which can be outside Switzerland, in particular when the user is abroad. Covered by the AWS DPA.
  3. Billing contact data is processed by Stripe, a US-based payment processor certified under both the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. As a Swiss controller, Mast Finance relies on the Swiss-US Data Privacy Framework for its own transfers of personal data to Stripe in the United States.
  4. Product analytics (usage events, session recordings with masked inputs) is processed by PostHog Cloud EU in Frankfurt. No Customer Data is transmitted.
  5. Error tracking (stack traces and technical metadata) is processed by Sentry Cloud EU in Frankfurt. No Customer Data is transmitted.
  6. AI inference (Mast AI) runs in Switzerland or in the European Union, with the providers listed on our Subprocessors page. Query content and the financial context described in Section 3 are involved. Covered by the Switzerland–EU adequacy decision.
  7. Where you enable bill reception by email, inbound invoice messages are held transiently, for up to 7 days, in AWS Ireland (eu-west-1), as described in Section 4. Customer Data is involved.
  8. When Mast Finance staff deliver support, onboarding, data import or setup, or diagnose and maintain the Service, they may use an AI assistant from a provider listed on our Subprocessors page. The data the task requires, which can include Customer Data and personal data, is then processed in the country that page states for that provider, the United States at the date of this policy, under the data processing agreement concluded with it and, outside Switzerland and the European Union, the Standard Contractual Clauses it incorporates. The provider does not use the data to train its models and keeps it no longer than that page states.
  9. Mast staff, like the contractors listed on our Subprocessors page, access Customer Data only from Switzerland or from a country that the Swiss Federal Council recognises as providing adequate data protection for all organisations there, including when travelling, and from nowhere else. At the date of this policy, those countries are the states of the European Economic Area, the United Kingdom, Andorra, Argentina, the Faroe Islands, Gibraltar, Guernsey, the Isle of Man, Israel, Jersey, Monaco, New Zealand and Uruguay. Canada and the United States, which the Federal Council recognises only for certain organisations, are not among them. That access is covered by the Federal Council's adequacy decisions (Annex 1 to the Data Protection Ordinance).

Where transfers outside the EEA occur, we ensure appropriate safeguards are in place, including:

  • adequacy decisions by the European Commission or the Swiss Federal Council;
  • Standard Contractual Clauses (SCCs) approved under the GDPR or the Swiss equivalent;
  • other recognised transfer mechanisms as required.

8. Cookies and Analytics

We use essential cookies to operate the Service and, with your consent, analytics cookies to understand usage and improve performance. Analytics data is processed in the EU (Frankfurt) by PostHog Cloud EU. Please see our Cookie Policy for full details.

9. Retention

We retain personal data only for as long as necessary. Typical retention periods:

  • Account and billing data (Mast's invoices to you and the related payments): duration of subscription plus up to 10 years (Swiss accounting law, CO Art. 958f).
  • Record of the terms accepted (which document and version, when, from which user account): until 10 years after the end of the year in which the account closes (the limitation period of contractual claims, CO Art. 127). The user account itself is deleted by Day 90; the record keeps only its identifier.
  • Enquiries and quote requests: deleted 24 months after the last activity on them, at once if you ask us to erase them, and, for a request made from a customer account, when that account's personal data is anonymised (Day 30). A request that led to a contract is kept with the records of that contract, without the requester's contact details.
  • Usage and technical logs: application logs 180 days; database logs 365 days; network and web application firewall logs 90 days.
  • IP address and browser recorded with each change you make in the Service: 12 months, for the security of the Service.
  • Analytics event data: 90 days.
  • Session recordings: 30 days.
  • Customer Data: duration of the subscription. After termination it remains intact and exportable for 30 days; personal data within it is anonymised at Day 30; the remaining tenant-scoped financial data is permanently purged from the Service at Day 90. Backups taken before then expire within 12 months of being taken (Section 4). See the Data Retention & Account Deletion Policy.
  • A customer account's audit trail: for the life of the account (entries are removed ten years after the end of the financial year they belong to); when the account closes it is handed over in the customer's archive and erased 30 days later, only its cryptographic fingerprints being kept. See the Data Retention & Account Deletion Policy.
  • Bank connections (bLink): the reference to the access token SIX keeps, as long as the connection is active; it is deleted with the token, within 24 hours at most of your disconnecting the bank or of the end of the Service. The record of when the consent was given and withdrawn is kept with your account's data and deleted with it.
  • During a hold: where we must preserve data because of a dispute, or to establish, exercise or defend legal claims, the deletions above are paused for that data until the hold is lifted, apart from copies already handed over to you and backups.

10. Your Rights

Under the GDPR and the Swiss revFADP, you have the following rights:

  • Right of access — to obtain a copy of your personal data.
  • Right to rectification — to correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — subject to legal retention obligations.
  • Right to restriction of processing.
  • Right to data portability — to receive your data in a structured, machine-readable format.
  • Right to object — to processing based on legitimate interests.
  • Right to withdraw consent — where processing is based on consent, without affecting prior processing.

To exercise your rights, please contact us at contact@mastfinance.io. We will respond within the timeframe required by applicable law (generally within 30 days).

11. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

  • Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch
  • EU/EEA: the data protection authority in your country of residence or place of work.

12. Contact and Data Protection

For privacy-related questions or to exercise your rights:

Mast Finance Sàrl — Attn: Data Protection
Rue Centrale 15, 1003 Lausanne, Switzerland
contact@mastfinance.io

Data protection contact: Sabine Pebrier — contact@mastfinance.io

EU Representative (Art. 27 GDPR): Given the nature and current scale of our processing activities, and that we do not process special categories of personal data on a large scale, Mast Finance relies on the exemption under Article 27(2) GDPR. We will appoint an EU-based representative if and when required by the scale of our operations. In the meantime, data protection enquiries from EU/EEA residents may be directed to Sabine Pebrier at contact@mastfinance.io.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The current version is always available at /privacy.

14. Language

This document exists in French and in English, maintained together. In case of a difference between the two versions, the French version prevails. A rendering in any other language is provided for information only.

Mast Finance Sàrl — Rue Centrale 15, 1003 Lausanne, Switzerland — contact@mastfinance.io