Subprocessors
Last updated: October 2026
REPPPS uses three service providers that process personal data on our behalf: Railway (hosting, database and cache), Resend (transactional email) and Stripe (payment processing for the coaching area). Each is bound by the provider's data processing agreement linked below. We use no other services that process personal data: no analytics or tracking services, no third-party error monitoring and no third-party content delivery network in front of the app; fonts are served from our own server.
Railway Corporation
- Role
- Application hosting, PostgreSQL database including backups, Redis cache for rate limiting
- Jurisdiction
- USA (registered office); application, database and cache in the europe-west4 region (Netherlands)
- Notes
- Hosts the database holding all REPPPS data: account and workout data, body weight, notes, studio and coach data, and the security log. The Redis cache holds only rate-limiting counters; their keys contain IP addresses or user IDs, and they expire after one hour at most. The platform's HTTP logs (including IP address, user agent and requested address) are kept for 30 days, the daily database backups for 6 days, and the point-in-time recovery archive, stored in the Amsterdam storage region, keeps data for about 4 weeks. Where data is transferred to the USA, this is based on Railway's DPA (EU standard contractual clauses or the EU-US Data Privacy Framework, where the recipient is certified).
Plus Five Five, Inc. (Resend)
- Role
- Transactional email delivery
- Jurisdiction
- USA; sending for the reppps.app domain via the eu-west-1 region (Ireland)
- Notes
- Receives the recipient address and content of the emails REPPPS sends automatically: email address confirmation, password reset, sign-in codes and security notices for two-factor authentication, studio invitations, and end-of-trial notices. No marketing or newsletter emails. According to Resend, processing takes place mainly in the USA; transfers are based on the EU-US Data Privacy Framework (Resend is certified) and EU standard contractual clauses.
Stripe Payments Europe, Limited
- Role
- Payment processing and billing for coaching-area subscriptions (Solo and Studio plans)
- Jurisdiction
- Ireland (EU); transfers to Stripe, LLC (USA)
- Notes
- Applies only to people who create a coaching area, not to athletes; Stripe receives no workout data. REPPPS passes on the email address of the person creating the coaching area and an internal studio identifier. Payment details are entered directly on Stripe-hosted pages (Checkout and the customer portal); REPPPS receives no card data and stores only the customer and subscription IDs, the plan, the subscription status, and the end of the trial and of the current billing period. For its own purposes, such as fraud prevention and compliance with legal obligations, Stripe acts as an independent controller. Transfers to the USA are based on the EU-US Data Privacy Framework and EU standard contractual clauses.