← Zaisei

Data Retention & Disposal Policy

Version 1.0 · Last updated 4 July 2026

This policy explains how long Zaisei keeps each type of data and how it is securely disposed of, consistent with the data-minimisation and storage-limitation principles of applicable data-protection laws (e.g. GDPR/UK GDPR and CCPA/CPRA). It complements our Privacy Policy.

1. Principles

• We keep personal data only as long as needed for the purpose it was collected.
• Sensitive financial detail (balances, transactions, holdings) is not stored on our servers — it is fetched live from your providers on demand.
• When you delete your account, your data is erased from our active systems immediately and purged from backups within the backup rotation window.

2. Retention schedule

Data	Where	Retention
Account (email, password hash)	Server (Postgres)	Until you delete your account
Bank/brokerage access tokens (encrypted)	Server (Postgres)	Until you remove the linked institution or delete your account
Property records	Server (Postgres)	Until you remove the property or delete your account
Balances, transactions, holdings, recurring	Not stored server-side	Fetched live; only cached on your device
Sessions (login tokens)	Server (Postgres)	Full-access: 30 days, extended on use. Read-only shares: the lifetime you choose. Expired sessions are cleared automatically.
On-device caches (transactions, holdings, FX, logos)	Your device	Until you log out or switch accounts (then wiped); also refreshed periodically
Server request logs (IP, path, status)	Server	31 days, then deleted automatically
Encrypted database backups	Backup storage	30 days, then rotated out automatically

3. Deleting your account (right to erasure)

You can delete your account at any time from Profile → Delete account in the app. When you do:

• Your linked bank connections are revoked at the provider (Plaid/Powens) so they stop syncing.
• Your account record is deleted, and every related record is removed by cascading deletion: sessions, linked identities, bank links, provider users and properties.
• Sensitive financial detail was never stored on our servers, so there is nothing further to erase there.
• On-device caches are cleared when the session ends.
• Residual copies in encrypted backups are purged within the backup rotation window noted above.

We may retain the minimum data required to comply with legal obligations (e.g. tax, anti-fraud) or to resolve disputes, for only as long as the law requires.

4. Disposal method

Records are removed from the live database via cascading deletes. Backups are stored encrypted and rotated out on the schedule above; media at end of life is cryptographically erased. Third-party providers dispose of data per their own retention terms once a connection is revoked.

5. Requests & contact

Most retention and deletion actions are self-service in the app. For any other request (access, correction, export, or deletion assistance), contact [email protected]. We aim to respond within the timeframe required by applicable law (e.g. 30 days under GDPR).