This policy explains how Relay Solutions Ltd, 730, West Shewrapara, Dhaka-1216, Bangladesh, uses cookies and similar technologies on relayerp.app and in its hosted, installable Relay ERP web app. Read it with our Privacy Policy, which explains personal-information processing, recipients, international transfers, and your rights.
Contact us at contact@relayerp.app.
1What these technologies do
Cookies are small values a website stores in your browser and receives with later requests. A session cookie normally lasts for a browser session; a persistent cookie has an expiry time. Browsers can clear, shorten, or otherwise limit either kind.
Local storage keeps values on your device across visits until they are changed, removed, or cleared. Session storage keeps values for a particular browser tab's session, including across ordinary reloads. Browser session-restoration settings can affect how long it survives. Service-worker caches store selected app resources on the device.
Tags and pixels, including Google Analytics and Meta Pixel, run code or make requests to measure interactions. They can transmit information even without a conventional third-party cookie. This policy covers that storage, access, and tracking as well as cookies.
A first-party cookie is set for the site you are visiting. A third-party service can also cause a first-party cookie to be set and receive the information associated with it. A cookie being first-party does not make its purpose essential or its data anonymous.
2Purposes and consent
We distinguish the following purposes:
- Authentication and essential operation: maintain a signed-in session, apply security protections, and support a service operation you request.
- Functionality and preferences: record choices such as language, organization navigation, appearance, table columns, and selected form behavior.
- Optional analytics: use Google Analytics to understand visits and interactions.
- Optional advertising and measurement: use Meta Pixel to measure events and campaign performance and support advertising-related processing.
Our consent controls block Google Analytics and Meta Pixel until you agree to the relevant optional processing. You can decline optional tracking and continue to use the core ERP. Viewing a page, signing in, or reading this policy is not consent to optional tracking.
Where the law requires consent for a functionality or preference technology, that requirement also applies; describing a technology as functional does not make it automatically exempt. Technologies strictly necessary for a service you request can be used without optional tracking consent where the law permits that exception.
3Relay ERP cookies
These cookies are set for the Relay ERP service. Lifetimes run from the time the cookie is set or renewed unless it is removed sooner.
| Cookie name | Purpose and information | Category | Configured lifetime |
|---|---|---|---|
__Secure-relay.session_token | Holds an opaque, signed session identifier so the server can authenticate you. The business records and password are not stored in this cookie. | Authentication; essential for signed-in use. | Up to 7 days, renewed as an eligible active session is refreshed. Signing out invalidates the session. |
relay_last_org | Records the last organization slug used to choose an organization landing page. It does not grant access to that organization. | Functionality / navigation preference. | 365 days; renewed when the service records organization navigation. |
relay_locale | Records a selected interface language, such as English or Bengali. A signed-in language preference can also be stored in the account. | Functionality / language preference. | 365 days from setting or renewal. |
sidebar_state | Records whether the desktop sidebar is expanded or collapsed. | Functionality / interface preference. | 7 days from setting or renewal. |
The production session cookie uses the Secure, HttpOnly, and SameSite=Lax protections. HttpOnly prevents ordinary page JavaScript from reading that cookie. These protections do not mean every preference cookie is inaccessible to JavaScript or that a shared device is safe to leave signed in.
4Other browser storage
In the table below, * means a variable suffix in a storage name, such as the applicable column set, organization identifier, membership identifier, or app version. It does not mean that every possible value is created.
| Storage name or pattern | Technology and purpose | Lifetime or removal rule |
|---|---|---|
theme | Local storage for the appearance preference used by the app's theme system. | No fixed automatic expiry; remains until changed, removed, or browser site data is cleared. |
relayerp.tableColumns.* | Local storage for table-column visibility choices. Stores column identifiers, not the table's business-record contents. | No fixed automatic expiry; removed when the stored choice is cleared or browser site data is cleared. |
relayerp.payments.autoAllocate | Local storage for the selected payment auto-allocation behavior. Stores a preference flag, not a payment amount or account balance. | No fixed automatic expiry; removed when the preference is turned off or browser site data is cleared. |
relayerp.sales.deliveryAutofill | Local storage for the selected sales-delivery quantity autofill behavior. Stores a preference flag, not order contents. | No fixed automatic expiry; removed when the preference is turned off or browser site data is cleared. |
relay:export-downloads:* | Session storage containing organization- and membership-scoped pending export identifiers and deadlines so download tracking can recover after a reload. It does not store the exported file. | Entries are removed when download tracking completes or is stopped; tracking has a 2-minute waiting deadline. Remaining session storage follows the browser tab's session lifecycle. |
relayerp-static-* and relayerp-offline-* | Service-worker caches for static app assets and the offline page, including scripts, styles, icons, and the local barcode-decoder asset. | Replaced across app versions; older app caches are removed when the new worker activates. Current caches remain until replaced, evicted by the browser, or cleared as site data. |
The service worker does not cache ERP API responses, authenticated business pages, business document downloads, or cross-origin file URLs. The app remains online-only for business operations. Limited local preferences and pending export identifiers described above are separate from those caches.
Signing out does not necessarily clear preferences, session storage, service-worker caches, or files you downloaded. Clear site data and remove downloaded files when appropriate on a shared device. Removing an installed web app may leave browser site data behind.
5Google Analytics and Meta Pixel
These optional services can process browser identifiers, page URLs, events, referral or campaign information, timestamps, and device or network information. Meta can associate events with information it holds about a Facebook or Instagram user. Consent to these services is separate from signing in or requesting Gemini AI assistance.
The following table identifies the principal cookie families used by these products. Vendor defaults are stated as defaults, not as a guarantee that a browser will retain a cookie for the full period. Site configuration can shorten them, browsers can impose shorter limits, and returning visits can renew a cookie.
| Cookie name or pattern | Provider and purpose | Vendor default lifetime | Consent category |
|---|---|---|---|
_ga | Google Analytics; distinguishes browsers for usage measurement. | 2 years, subject to browser limits and configuration. | Optional analytics. |
_ga_* | Google Analytics 4; maintains measurement-session state for the applicable property. | 2 years, subject to browser limits and configuration. | Optional analytics. |
_fbp | Meta Pixel; browser identifier used for event measurement and advertising-related processing. | Usually 90 days, subject to browser limits and configuration. | Optional advertising / measurement. |
_fbc | Meta Pixel; preserves a Meta ad-click identifier when the applicable ad-click information is present. It is not set on every visit. | Usually 90 days, subject to browser limits and configuration. | Optional advertising / measurement. |
A provider may also receive an existing identifier from its own domain when a consented request is made. Its handling of that identifier is subject to its privacy and cookie arrangements. Blocking third-party cookies alone does not necessarily block a tag, a first-party measurement cookie, or an event request.
For provider information and additional controls, see:
- Google Analytics cookie documentation.
- How Google uses information from sites and apps that use its services.
- Google Privacy Policy and Google advertising controls.
- Meta Privacy Policy, Meta Cookie Policy, and Meta ad preferences.
We do not sell personal information for money. Depending on a provider's use of event data and the applicable law, these disclosures can nevertheless fall within legal definitions of sale, sharing for cross-context behavioral advertising, or targeted advertising. You can exercise the applicable choice by declining the relevant optional tracking and can contact us about additional statutory opt-out rights.
Cookie expiry is not a promise that all information already sent to a provider is deleted on that date. Server-side retention and your deletion rights are addressed in the Privacy Policy and the relevant provider's notice.
6Changing your choices
Use the Relay ERP consent controls. Review or change optional tracking consent through the controls available on the site. You can withdraw consent for future optional analytics or advertising processing. Withdrawal does not affect the lawfulness of earlier processing. If the controls are unavailable or you need help, contact us at contact@relayerp.app.
Manage browser site data. Your browser's privacy settings let you inspect, block, or delete cookies and clear local storage, session storage, and cached site resources. Blocking authentication cookies can prevent sign-in; clearing preferences resets the corresponding choices. Clearing a saved tracking choice may cause the consent controls to ask again.
Apply choices on each browser or device. Browser-based preferences generally apply to that browser and device. Apply your choices again when using a different browser, a private browsing session, or another device.
Distinguish browser signals from consent choices. A browser's “Do Not Track” setting is not the same as recording a choice in our consent controls. Any right under applicable law to use a legally recognized universal opt-out signal, such as Global Privacy Control, is unaffected by this policy. You can also submit an applicable opt-out request through our privacy contact.
Request deletion separately. Removing cookies or withdrawing consent stops or limits future tracking but does not automatically erase data already collected. Contact us or the relevant provider to exercise an available deletion right. Provider advertising preferences can offer additional controls over that provider's wider activities; they do not replace your Relay ERP consent choice.
7Changes and contact
We update this policy when the technologies or purposes change and revise the dates at the top. We obtain fresh consent before a new optional use that requires it. A policy update alone does not grant consent.
For questions, help with choices, or a privacy request, contact:
Relay Solutions Ltd
730, West Shewrapara, Dhaka-1216, Bangladesh
Email: contact@relayerp.app
Website: relayerp.app