Is client data stored outside the EU?

The database, file storage and the application server are in the EU — Ireland and Lithuania. Where a listed service processes data outside the EEA, the European Commission's Standard Contractual Clauses apply, and the EU-US Data Privacy Framework where it covers that service.

Who is the controller of my clients' data?

You are. 3E COACH processes your clients' data on your behalf, under the data processing agreement.

Will you tell me before adding a new sub-processor?

Yes — at least 14 days ahead, by updating the list in the agreement and writing to your account's e-mail. You may object within that time.

Your clients' data stays in the European Union

Coaching data is health data: injuries, bodyweight, photos, what someone eats. Here is exactly where it is kept, who handles it, and what you sign.

Where the data lives

The database, sign-in and file storage (progress photos, form-check videos, documents) run on Supabase in its EU region — Amazon Web Services in Ireland. The application server runs in a data centre in Vilnius, Lithuania. Backups are taken daily in the same EU-region infrastructure.

Who processes it

3E COACH is made by EJ Group MB, a company in Vilnius, Lithuania. For your clients' data you are the controller and we are your processor. The services we use are listed by name in the data processing agreement, with what each one does:

Supabase — database, sign-in and file storage, held in the EU (Ireland)
Hostinger — the application server, in Vilnius, Lithuania
Stripe Payments Europe (Ireland) — card payments
Resend — transactional e-mail such as invitations and reminders
Sentry — error monitoring, with personal data stripped from reports
Anthropic — reading food from text in the AI features; only the text typed is sent

How it is protected

Every coach sees only their own clients, and every client only their own data — the database enforces it on every row, not just the screen. Traffic is encrypted in transit and the database, files and backups at rest. Passwords are stored only as hashes, sign-in attempts are rate-limited, and coaches can turn on two-factor sign-in.

The agreement you are covered by

A data processing agreement under Article 28 of the GDPR is part of the terms every coach accepts, and it is public: instructions, confidentiality, security measures, sub-processors, breach notification, and what happens to data when you leave. A signed copy is available on request.

Your clients can export their data and delete their account from their own settings. Deletion removes or anonymises their data across the system and in file storage.

Questions

Is client data stored outside the EU?: The database, file storage and the application server are in the EU — Ireland and Lithuania. Where a listed service processes data outside the EEA, the European Commission's Standard Contractual Clauses apply, and the EU-US Data Privacy Framework where it covers that service.
Who is the controller of my clients' data?: You are. 3E COACH processes your clients' data on your behalf, under the data processing agreement.
Will you tell me before adding a new sub-processor?: Yes — at least 14 days ahead, by updating the list in the agreement and writing to your account's e-mail. You may object within that time.
Can I get a signed data processing agreement?: Yes. Write to info@3ecoach.eu.

Start free

No card. Nothing to install. Free for up to 3 clients.