Privacy Policy & GDPR Compliance
Last Updated: September 29, 2026
1. Data Minimization
StrataRelay collects only necessary operational information: email address, tenant identifier, masked exchange API keys, encrypted secret references, and execution preferences. We do not sell personal data to third parties.
2. Storage of Sensitive Exchange Secrets
Exchange API secrets are stored using envelope encryption (AES-256-GCM) with tenant-isolated data encryption keys. Plaintext keys are never stored in databases, application logs, or browser storage.
3. User Rights under GDPR
Users have the right to request export of their account data, revocation of all API tokens and exchange keys, and full account deletion. Legal and security audit logs are retained as required by financial regulations.
4. Cookies and Tracking Technologies
Our website uses strictly necessary technical cookies and LocalStorage to enable secure user authentication, tenant isolation, and CSRF protection. Optional analytics and functional cookies are loaded only upon affirmative user opt-in in accordance with the ePrivacy Directive and GDPR Article 6(1)(a). For comprehensive disclosures, cookie retention periods, and to manage your preferences, please consult our dedicated Cookie Policy.