Data Retention and Deletion Policy

Typical retention by category:

• Waitlist and marketing contact data (including Google Forms responses): while you remain subscribed or we have a lawful basis to contact you about jastado (including product updates, launch news, and marketing), until you unsubscribe, object to marketing, or request erasure where applicable under law.
• Usage, analytics, and audience insight data: as needed to secure and improve the Services and understand interest in our products; often retained in identifiable form for a limited period (e.g., up to 24 months) and longer in aggregated or de-identified form that no longer identifies you.
• Account profile (email, phone, name): while your product account is active; removed or anonymized on account deletion except limited records kept for fraud prevention, disputes, or legal compliance.
• Authentication artifacts (OTP codes, sessions): short TTL (minutes to days); auto-expired.
• App PIN: stored as a secure hash while your account is active.
• Plaid access tokens: while a bank connection is active; encrypted at rest; removed on disconnect or account deletion.
• Plaid-derived transactions and balances: deleted when you disconnect that bank.
• Manually entered finance data: while your account is active; deleted on account deletion.
• Match profile and related data: while your account is active or until you wipe Match data in Settings.
• Identity verification records: as required by applicable AML/KYC law; may be retained after account deletion where legally required.
• Security and admin audit logs: up to 24 months, or longer if required for security or compliance.

When you disconnect a linked institution in the app:

• We revoke access at Plaid (item/remove).
• We delete local connection records and linked finance accounts for that bank.
• We delete Plaid-sourced transactions associated with that connection.

Product account deletion generally:

• Removes all Plaid connections at Plaid and in our systems.
• Deletes in-app finance, Match, and profile data per this policy.
• Deactivates your product account; backups are purged on a rolling basis within 30 days except where limited records must be kept for fraud prevention, disputes, legal compliance, or security.