Cookie Policy

Drel is an AI-native security assessment platform operated by Atela Capital S.L., registered in Madrid, Spain ("Drel", "we", "us"). For data protection purposes, Atela Capital S.L. is the data controller.

We use a minimal set of cookies to operate the service. We do not use advertising cookies, we do not participate in cross-site tracking networks, and we do not sell cookie data to third parties.

This policy explains what cookies we use, why we use them, and how you can manage your preferences. For full details on how we handle personal data, see our Privacy Policy at /privacy.

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, provide analytics information, and remember your preferences.

Cookies can be "first-party" (set by the site you are visiting) or "third-party" (set by a different domain). They can be "session" cookies (deleted when you close your browser) or "persistent" cookies (remain until they expire or you delete them).

Essential cookies are required for Drel to function. They handle authentication, security, and basic preferences. These are all first-party cookies set by drel.ai and app.drel.ai. They cannot be disabled — without them, you cannot sign in or use the platform.

__clerk_session. Maintains your authenticated session after sign-in. Without this cookie, you would need to re-authenticate on every page load. Duration: 7 days. First-party.

__clerk_db_jwt. Short-lived token used to verify your identity on each request. Duration: session (deleted when browser closes). First-party.

__csrf. Protects against cross-site request forgery attacks by validating that form submissions originate from Drel. Duration: session. First-party.

Locale/preference cookies. Store your language and display preferences so the interface renders correctly. Duration: 1 year. First-party.

We use Amplitude for product analytics to understand how features are used, identify usability issues, and improve the platform. Analytics cookies do not identify you personally and are never used for advertising.

EU/EEA, UK, and Switzerland. Analytics cookies are set only after you actively consent via the cookie banner shown on your first visit. If you decline, no analytics cookies are placed and no usage data is collected.

Rest of world. Analytics cookies are set by default. You can decline at any time using the "Cookie Preferences" link in the site footer. Your choice is remembered for one year and applies across drel.ai and app.drel.ai.

amp_* cookies. Used by Amplitude to associate anonymous usage events with a consistent device identifier. No cross-site tracking. No data shared with advertising networks. Duration: 1 year. First-party.

Browser settings. All modern browsers let you view, manage, and delete cookies. Check your browser's help documentation for instructions specific to Chrome, Firefox, Safari, or Edge.

Drel cookie preferences. Use the "Cookie Preferences" link in the site footer to change your analytics cookie consent at any time. Your choice takes effect immediately.

Note on essential cookies. If you block essential cookies via browser settings, Drel will not function — you will not be able to sign in or use the platform. We recommend leaving essential cookies enabled and managing only analytics preferences through our footer link.

Drel minimizes third-party cookie usage. We do not use advertising networks, social media trackers, or remarketing pixels.

Stripe (payment processing). When you interact with payment flows (checkout, subscription management), Stripe may set cookies for fraud prevention and session management. These are scoped to payment interactions only and are not used for advertising or tracking across sites.

_stripe_mid. Stripe's device identifier for fraud prevention during payment flows. Duration: 1 year. Third-party (stripe.com).

No other third-party cookies are set by Drel.

The following table lists all cookies used by Drel:

__clerk_session — Category: Essential — Purpose: Session authentication — Duration: 7 days — Party: First

__clerk_db_jwt — Category: Essential — Purpose: Request authentication token — Duration: Session — Party: First

__csrf — Category: Essential — Purpose: CSRF protection — Duration: Session — Party: First

amp_* — Category: Analytics — Purpose: Anonymous product usage — Duration: 1 year — Party: First

_stripe_mid — Category: Payment — Purpose: Fraud prevention — Duration: 1 year — Party: Third (stripe.com)

We will update this table if our cookie usage changes.

We may update this Cookie Policy from time to time to reflect changes in our cookie usage or applicable regulations. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you via email or an in-app notice.

Continued use of the service after changes take effect constitutes acceptance of the updated policy.