Privacy Policy

1. Who we are and what this covers

Stralfa LLC operates this website and is responsible for the processing described here. You can contact us at legal@stralfa.com or at the mailing address below. This Policy covers our website and portal; an underlying account provider or an external platform may handle information under its own privacy notice.

2. Information we collect and receive

• Contact and membership information. Your email address, user identifier, account assignment, role, access status, and related timestamps. An administrator may provide your email address and assign an account before your first visit.
• Account information. Account identifiers, names, currency, status, balances, available funds, and profit or loss information received from a connected account-data provider. Members are shown information for their assigned account; authorized administrators can view connected accounts and manage assignments.
• Sign-in and security information. Session records, hashed sign-in tokens, expiry times, records of sign-ins and administrative changes, and information used to limit abusive requests. The website does not ask members to create a password.
• Technical information. Our servers receive IP addresses, request times, requested addresses, browser or user-agent information, response status, and related diagnostic data. Server and security logs may retain this information.
• Correspondence. If you contact us, we receive your email address, message, and information you choose to provide. Please do not email passwords, sign-in links, full payment-card details, or unnecessary sensitive documents.

The current website does not collect payment-card details, government identity documents, precise device location, or biometric information through its forms. It does not execute trades or process deposits or withdrawals.

3. How we use information

We use information to provide the portal, authenticate invited users, display assigned account data, manage access, respond to requests, maintain and troubleshoot the service, prevent abuse, investigate security issues, and meet applicable legal obligations or establish and defend legal claims.

Where applicable law requires a legal basis, the basis depends on the purpose: providing a service you request, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where required. We do not treat acceptance of this Policy as blanket consent to unrelated processing.

4. Access and disclosures

Personal information may be accessible to:

• Authorized Stralfa administrators. They manage invitations, assignments, and access, and can view connected account information needed to operate the service.
• Infrastructure and service providers. Hosting and technical providers process information needed to run and secure the website. The current hosting platform is Vultr. When email sign-in delivery is enabled, Resend processes recipient addresses, sign-in email contents, and delivery information. The current account-data integration retrieves information from Capital.com to display in the portal.
• Legal and professional recipients. We may disclose information where reasonably necessary to comply with lawful requests, obtain professional advice, investigate abuse, protect rights or safety, or establish or defend legal claims.
• A successor to the business. Information may be transferred as part of a merger, acquisition, or similar transaction, subject to applicable law and appropriate notice of material changes in its use.

We do not sell personal information collected through this website or share it for cross-context behavioral advertising. Other members cannot use the portal to view your assigned account. External social-media links do not embed social tracking widgets; if you follow a link, the destination's own privacy practices apply.

5. Cookies and browser controls

The website uses an essential first-party session cookie, currently named __Host-stralfa, to support sign-in and protection against forged requests. It may be set when you open a sign-in form or use authenticated features. Signed-in access expires after approximately eight hours; pre-sign-in session cookies generally last for the browser session, subject to your browser's restore settings.

The current website does not use advertising cookies, analytics trackers, tracking pixels, or third-party embedded social widgets. Fonts and visual assets are served from our website. We do not use browser storage for advertising profiles.

You can clear or block cookies through your browser. Blocking the essential cookie can prevent sign-in and other protected actions. The website does not currently change its essential-cookie behavior in response to Do Not Track or Global Privacy Control signals; it does not engage in the sale or targeted-advertising activities those opt-out signals address.

6. Retention and deletion

Retention depends on the type of record, whether it is needed to provide access, investigate or prevent abuse, resolve a request or dispute, or satisfy a legal obligation. Account records and administrative audit history remain in the service until removed through an administrative review or a verified request, subject to those needs. Revoking portal access does not automatically erase all related records.

Sign-in links expire after 15 minutes and authenticated sessions after approximately eight hours. Expiration prevents further use; it does not mean every associated database record or log entry is immediately deleted. Logs and backups are held separately and may remain until rotation or deletion, or longer where needed for security, recovery, or legal obligations.

To request deletion or ask about retention of your information, contact legal@stralfa.com. If information must be retained despite a request, we will explain the applicable reason where permitted by law. Deleting portal records does not necessarily delete information held independently by an underlying account provider.

7. Security

We use safeguards including encrypted HTTPS connections, restricted administrative access, account-level access controls, hashed sign-in tokens, and security monitoring. Sign-in links are single use. No internet service or security measure can guarantee complete protection. Protect your email account and device, and contact us promptly if you suspect unauthorized access.

8. Your choices and privacy requests

You can choose not to provide information, although some information is necessary for member access. You can stop using the service, ask for access to be revoked, and request correction of an email address or assignment.

Depending on your location and which laws apply, you may have rights to access or obtain a copy of personal information, correct it, request deletion, restrict or object to processing, withdraw consent for processing that relies on consent, or appeal a decision on a request. Withdrawal of consent does not affect processing that was lawful before withdrawal. You may also have the right to complain to a competent privacy regulator.

Send requests, or an appeal of our response, to legal@stralfa.com with enough detail to identify the relevant account and request. We may need proportionate verification of your identity or an authorized agent's authority before disclosing or changing information. Do not send a sign-in link or password. We will respond within the period required by applicable law and will not unlawfully discriminate against you for exercising a privacy right.

9. International processing

Stralfa LLC is based in the United States. Hosting, account-data, and communications providers may process information in other countries where they operate, and local privacy protections may differ. Contact us for information about processing locations and any safeguards applicable to your information. Nothing in this Policy waives protections or transfer requirements provided by applicable law.

10. Children

The member service is intended for adults aged 18 and over and is not directed to children. If you believe a child has provided personal information through the service, contact us so we can investigate and take appropriate steps, including deleting information where required.

11. Changes to this Policy

We will post updates here with a revised effective date. If our practices materially change, we will provide a prominent website notice or other appropriate notice, and obtain consent where required before using information for a new purpose. Please review this Policy periodically.