yutaiPrivacy · Data retention
How long we keep your data
This policy explains how long Yutai Technologies, Inc. ("Yutai", "we") keeps personal data and bank data, and how we delete it. It applies to the Yutai app at app.yutai.com, our API and developer services, and every backup and log behind them.
Our principles
- We collect only what we need to verify holdings and to recognise purchases that unlock the benefits you have chosen.
- We use bank data for one purpose: matching your purchases to benefits. Access is read-only. We cannot move money or make payments.
- We do not sell, rent or license your data, and we do not use it for advertising.
- We keep data no longer than the periods below, then delete it or irreversibly anonymise it.
- Sensitive data is encrypted: bank connection credentials, account identifiers and raw bank records are encrypted at rest, and all data travels over encrypted connections.
Retention periods
| Data | How long we keep it | What happens then |
|---|---|---|
| Bank connection credentials | While the connection is active. Revoked when you disconnect, close your account, or after 12 months without use | Revoked with the open banking provider and deleted within 7 days |
| Bank account and transaction records | 13 months on a rolling basis | Deleted automatically |
| Purchase matches (for example, a qualifying purchase at a brand on a date) | While your account is open, plus 12 months | Deleted or anonymised |
| Your account and profile (email, country, linked wallets, consents) | While your account is open | Deleted within 30 days of account closure |
| Benefit claims and delivery records | 6 years after the claim, for tax, accounting and dispute purposes | Deleted |
| Wallet holding records | While your account is open, plus 12 months | Deleted or anonymised |
| Sign-in and security data (sessions, sign-in attempts, network addresses) | 90 days | Deleted automatically |
| Application and API logs | 90 days | Deleted automatically |
| Security audit logs | 6 years | Deleted |
| Backups | 35 days | Overwritten or deleted on rotation |
If the law, a regulator or an active dispute requires us to keep specific data longer, we keep only that data, only for that purpose, and delete it when the obligation ends.
Your choices and rights
- You can disconnect any bank account in the Yutai app at any time. We then revoke the connection and delete its credentials and bank records as set out above.
- You can ask to access, correct or delete your data by writing to [email protected]. We verify your identity and complete the request within 30 days, or 45 days where US state law allows, and confirm in writing.
- When you delete your account, we erase your personal data, except records we must keep by law (such as claim records for tax), which we restrict from any other use.
How we delete data
- Automated retention jobs delete or anonymise data on schedule, and each run is logged.
- Encrypted data becomes unreadable on deletion, and retired encryption keys are destroyed.
- Deleted data leaves our backups within 35 days as they rotate.
Review
We review this policy at least once a year and whenever we add a data provider, a new type of data or a new country. The version and date at the top show the latest version. Questions go to [email protected].