Cookie & Tracking Technologies Policy
Detailed disclosure of cookies, local storage identifiers, telemetry scripts, and privacy consent controls implemented across the StrataRelay platform in strict adherence to EU GDPR and the ePrivacy Directive.
Manage or Revoke Your Preferences
Under GDPR Article 7(3), you can adjust your consent choices or withdraw them at any time with immediate effect.
01.What Are Cookies and Local Storage Technologies?
Cookies are compact text strings stored on your computing terminal (desktop, smartphone, or tablet) by your web browser when visiting web portals. They allow the server to distinguish individual browsers, sustain authenticated login sessions, and guarantee session security across stateless HTTP transactions.
In addition to standard HTTP cookies, StrataRelay utilizes modern browser LocalStorage and SessionStorage APIs. Unlike traditional cookies, LocalStorage data is not transmitted automatically in HTTP request headers on every server trip, lowering network overhead and ensuring strict client-side isolation for cryptographic identifiers and client layout states.
02.Legal Basis under EU Law (GDPR & ePrivacy Directive)
StrataRelay operates under the legal framework established by the ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC) and the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR):
Strictly necessary technical cookies do not require prior opt-in consent because they are essential to transmit communications over an electronic network or to deliver an information society service explicitly requested by the user (e.g. maintaining authenticated trader sessions).
All optional categories (aggregated latency analytics, performance telemetry, and non-essential functional preferences) are blocked by default. They are only loaded if you provide an affirmative, unambiguous opt-in choice. In accordance with EDPB Guidelines 03/2022, declining optional cookies is as easy and prominent as accepting them.
03.Technology Categories Used by StrataRelay
A. Strictly Necessary Technologies (Always Active)Essential
These technologies are required for the technical operation, authentication, and security integrity of the StrataRelay application. They facilitate JSON Web Token (JWT) session persistence, multi-tenant database boundary verification, Cross-Site Request Forgery (CSRF) mitigation, and retention of your consent decision. They cannot be deactivated.
B. Performance & Latency Telemetry (Optional)Opt-In Only
With your consent, we benchmark network round-trip latencies, WebSocket event propagation times, and API responsiveness across major European financial hubs (Frankfurt, Dublin, Zurich). All statistical telemetry is aggregated without personal profiling or cross-website tracking.
C. Functional & Workspace Preferences (Optional)Opt-In Only
Retains your user interface choices across sessions, such as selected language, candlestick view layout, and default table density.
04.Comprehensive Cookie & Storage Inventory
The table below provides a full inventory of all storage items, keys, providers, retention periods, and technical functions:
| Identifier / Key | Type | Category | Provider / Domain | Purpose & Description | Retention |
|---|---|---|---|---|---|
| stratarelay_cookie_consent_v1 | LocalStorage | Necessary | First-Party | Stores user cookie consent choices (analytics/functional flags, timestamp, version). | 12 Months |
| access_token | Secure Cookie / LocalStorage | Necessary | First-Party API | Cryptographically signed HS256/RS256 JWT for tenant-isolated authentication. | 8 Hours |
| user_data | LocalStorage | Necessary | First-Party | Caches user profile, subscription plan tier, and active tenant ID for UI state. | Session |
| stratarelay_lang | LocalStorage | Functional | First-Party | Remembers user selected language code for multilingual UI routing. | 12 Months |
| stratarelay_perf_telemetry | LocalStorage | Analytics | First-Party | Aggregated latency pings to measure API latency from client to EU endpoints. | 30 Days |
| _ga, _ga_* | HTTP Cookie | Analytics | Google Ireland Ltd | Google Analytics 4 with IP anonymization (Google Consent Mode v2 default denied). | 14 Months |
05.Google Consent Mode v2 Implementation
In full compliance with European Commission Digital Markets Act (DMA) requirements and Google Consent Mode v2 specifications:
- Before explicit consent is recorded, all default signals (analytics_storage, ad_storage, ad_user_data, and ad_personalization) are initialized strictly as denied.
- Only upon affirmative consent is an update signal dispatched. If consent is revoked or denied, tags remain strictly blocked.
- StrataRelay operates a zero-advertising policy: ad_storage and ad_personalization remain perpetually denied across all tiers.
06.How to Control Cookies Directly in Your Browser
In addition to our on-site Cookie Preferences Manager, you can control, inspect, or delete cookies directly in your browser settings:
07.Data Hosting & Sub-processors (GDPR Art. 28)
All primary StrataRelay compute workers, control plane APIs, and encrypted databases are hosted exclusively within certified Tier-3 European data centers (Frankfurt, Germany & Amsterdam, Netherlands). We do not sell, rent, or transfer personal data or exchange secrets to data brokers or advertising exchanges.
Any auxiliary technical service providers operating as data sub-processors under GDPR Article 28 do so pursuant to mandatory Data Processing Agreements (DPAs) incorporating European Commission Standard Contractual Clauses (SCCs).
08.Your Rights as a Data Subject under GDPR
Under Chapter III of the General Data Protection Regulation, you are entitled to exercise the following enforceable rights:
Request confirmation of processing and obtain a full export of your personal data.
Correction of inaccurate, outdated, or incomplete personal data records.
Permanent deletion of your account and personal identifiers.
Revoke your cookie or communication consent at any time without negative consequences.
For questions or data subject access requests (DSAR), contact our Data Protection Officer at: [email protected].