Privacy policy
Last updated: 2026-10-11. Version 2.1.
1. WHO WE ARE
1.1. The data controller is EJ Group MB, company code 308112520, Lvivo g. 91-48, LT-08104 Vilnius, Lithuania. 1.2. For data protection matters: info@3ecoach.eu. We have not appointed a Data Protection Officer as there is no legal requirement to do so; requests are handled at that address.
2. SCOPE AND ROLES
2.1. This policy covers the "3E GROUP" platform (3ecoach.eu) and its app. 2.2. Roles matter: we are the controller for accounts, sign-in, security, billing and the operation of the Platform itself. Your Coach is an independent controller of the coaching and health data they collect and use for their own purposes; in that respect we act as a processor on the Coach's instructions. 2.3. With the Coach as controller we enter into a data processing agreement under Article 28 GDPR – it is published at 3ecoach.eu/dpa and forms part of the Terms of Service; it also lists every sub-processor and the security measures. 2.4. So for rights concerning coaching content, contact your Coach first; for the account and Platform, contact us. We forward misdirected requests to the responsible party.
3. WHAT WE PROCESS
3.1. Account data: name, email, role (coach/client), language preference, password (stored only as a cryptographic hash — we cannot see it). 3.2. Profile data: photo, phone, date of birth, height, weight, goals, injuries, available equipment. 3.3. Training data: programmes, completed workouts, weights, reps, RPE, times, habits, notes. 3.4. Health and nutrition data: body measurements, weight history, food diary, well-being ratings, metrics synced from health apps or devices (if you enable this), progress photos. This is special-category (health) data under GDPR Article 9. 3.5. Communication data: messages with your Coach, uploaded files, documents, technique videos. 3.6. Billing data: subscription plan, payment status, Stripe identifiers. We never collect or store card details. 3.7. Technical data: sign-in records, IP address, device and browser type, error logs — for security and troubleshooting.
4. WHERE THE DATA COMES FROM
4.1. Directly from you — when registering and using the Platform. 4.2. From your Coach — a Coach may create your client record with your name and email and record coaching data before you sign in. In that case the source is the Coach. 4.3. From health apps or devices — only if you connect such syncing yourself.
5. PURPOSES AND LEGAL BASES
5.1. Providing the service and performing the contract — GDPR Art. 6(1)(b). 5.2. Health and nutrition features — your explicit consent, Art. 9(2)(a). You give it by knowingly using these features and may withdraw it at any time by ceasing to use them or deleting the data. 5.3. Account security, fraud and abuse prevention, service improvement — legitimate interests, Art. 6(1)(f). 5.4. Accounting and legal obligations — Art. 6(1)(c). 5.5. Establishing or defending legal claims — legitimate interests, Art. 6(1)(f), and for health data Art. 9(2)(f).
6. AI FEATURES
6.1. We use an AI service provided by Anthropic to interpret food descriptions. Only the food text you type is sent — without your name, email or other identifiers. 6.2. The provider does not use this data to train its models. 6.3. We do not carry out automated decision-making producing legal or similarly significant effects (GDPR Art. 22).
7. RECIPIENTS AND PROCESSORS
7.1. Your Coach (or, for a coach, their Clients) sees the data intended for them under the Platform's logic. 7.2. We use these processors: Supabase (database, authentication, file storage; EU region); Hostinger (server infrastructure, EU); Stripe (payments); Resend (transactional email); Anthropic (AI food recognition); Umami, self-hosted on our own server in the EU (cookieless, anonymous traffic statistics); Sentry (error monitoring — if enabled). 7.3. We may disclose data to law enforcement or authorities where legally required, and to legal advisers or auditors — only to the extent necessary. 7.4. In a business transfer or reorganisation data may pass to the successor, with prior notice. 7.5. We do not sell data or share it with third parties for marketing.
8. TRANSFERS OUTSIDE THE EEA
8.1. Core data is stored in the European Union. 8.2. Some processors (e.g. Stripe, Resend, Anthropic, Sentry) may process data in the USA or elsewhere. Appropriate safeguards then apply: the European Commission's Standard Contractual Clauses, supplementary technical measures and, where applicable, EU-US Data Privacy Framework certification.
9. RETENTION
9.1. Account data — while your account exists. 9.2. After deletion, personal data is erased or irreversibly anonymised without undue delay. 9.3. Accounting and payment records (without excess identifiers) — for the period required by law, generally 10 years. 9.4. Technical and security logs — up to 12 months. 9.5. Correspondence with us — up to 24 months after the enquiry closes. 9.6. Data needed to bring or defend claims — until the relevant limitation period expires.
10. BACKUPS
10.1. We take regular database backups. Deleted data may persist in backups until their rotation completes (typically up to 14 days), after which it is removed automatically. Backups are not restored into normal use.
11. SECURITY
11.1. We apply technical and organisational measures: encrypted transport (TLS), encryption at rest, row-level access control in the database (RLS), password hashing, need-to-know access, security headers, rate limiting, backups and regular security reviews. 11.2. No system is perfectly secure. If a personal data breach is likely to result in a high risk to your rights, we will inform you and the State Data Protection Inspectorate as required by law.
12. YOUR RIGHTS
12.1. You have the right to: access your data; have it rectified; have it erased; restrict processing; object to processing based on legitimate interests; data portability; withdraw consent (without affecting processing carried out beforehand). 12.2. Self-service is built in: Settings → data export (JSON) and account deletion. 12.3. We answer requests within one month; complex cases may be extended by two further months with notice. 12.4. If you believe we have infringed your rights, contact us or lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, www.vdai.lrv.lt).
13. COOKIES AND ANALYTICS
13.1. We use strictly necessary cookies only: sign-in session and language preference. The Platform could not work without them, so no consent banner is required. 13.2. Traffic statistics (Umami, on our own server) are collected without cookies and without identifying individuals. 13.3. With your consent we may use Microsoft Clarity, a tool that records how a page is used (clicks, scrolling, session replay). It uses cookies, so it loads only after consent and only on public pages (home, sign-in, legal). It is never loaded once you are signed in, where health and nutrition data is shown. 13.4. You can change or withdraw consent at any time on this page, under “Cookie and analytics consent”, and — once signed in — in the app settings. Withdrawal takes effect immediately and does not affect processing carried out before it. 13.5. With your consent we may also load the Meta Pixel (Meta Platforms Ireland Ltd.) on the public pages, to measure our own advertising. It sets cookies and loads only after consent, never inside the app. A coach's completed registration is also reported to Meta from our server for the same purpose, with the e-mail address hashed (SHA-256) and nothing else about the person; no client or health data ever leaves the Platform this way. 13.6. We use no other marketing, profiling or third-party tracking cookies.
14. CHILDREN
14.1. The Platform is intended only for people aged 18 and over. We do not knowingly collect data about younger people; if we learn such data has reached the Platform, we delete it. 14.2. Where a minor is being coached, the account must be held by their parent or guardian, who is responsible for the data and consents provided.
15. CHANGES
15.1. We may update this policy. Material changes will be announced in the Platform or by email. The current version is always published on this page.