Privacy and data hosting
Evidence Based Change Builder helps organizations, coaches, and researchers deliver research-informed activities, exercises, and measures while keeping the data setup clear.
Last updated: July 2, 2026
This page is for general product and data-handling information. It is not legal advice, and each organization should confirm how GDPR applies to its own use case, survey content, participants, and data-processing agreements.
Platform data is hosted within the European Union when backend storage is used. Backend data is stored in Supabase on AWS eu-west-1 in Ireland, and server-side application functions run on Vercel in Dublin, Ireland (dub1 / eu-west-1).
Static assets may be served via Vercel's CDN, but static assets do not contain participant survey responses or user-specific data.
Evidence Based Change Builder lets you add links to surveys from an approved survey provider, such as Qualtrics, Tally, or another platform your organization already uses, within the experience.
If a project needs Evidence Based Change Builder to help create or manage survey forms directly, that can be scoped separately with the right privacy, retention, and data-processing arrangements in place.
Survey responses stay in your existing survey system, under your organization's survey governance, privacy notice, consent wording, and data-processing arrangements.
Where an organization does not already have a suitable survey platform, Evidence Based Change Builder can prepare project-specific survey links using an EU-based form provider such as Tally.
In this setup, the organization remains responsible for the survey purpose, content, participant notice, and lawful basis, while Evidence Based Change Builder can support form setup, link preparation, and agreed response handling for that project.
Evidence Based Change Builder can be used in a survey-link mode that does not require participants or clients to create platform accounts:
In this mode, Evidence Based Change Builder is not the controller or processor for survey participant data or participant survey responses collected in the external survey platform. The organization using that survey platform remains responsible for the survey data collected there.
If you contact us by email, we process your name, email address, message content, and any other information you choose to include so that we can respond to your enquiry.
We use Proton Mail to provide our email service. Proton AG is based in Switzerland and provides encrypted email services. Proton may process limited personal data on our behalf, such as email metadata and account/service data, in accordance with its Data Processing Agreement and Privacy Policy.
Proton DPA: https://proton.me/legal/dpa
Proton Privacy Policy: https://proton.me/legal/privacy
The Evidence Based Change Builder waitlist collects the email address you choose to submit and basic signup context, such as the page or product source for the signup. This is personal data, but it is separate from participant survey responses and is not used as participant survey-response storage.
We use waitlist signups to send Evidence Based Change Builder updates, launch details, and relevant early-access invitations. Please do not submit sensitive personal information, health information, employee records, or participant-identifying details through the waitlist.
| Surface | Location / provider | Used in survey-link mode? | Notes |
|---|---|---|---|
| Backend platform data | Supabase on AWS eu-west-1, Ireland | No. N/A in account-free survey-link mode. | Used only if backend storage, account access, or in-platform data features are enabled. |
| Evidence Based Change Builder waitlist signups | Supabase on AWS eu-west-1, Ireland | N/A. Separate website signup, not participant survey-response storage. | Used for Evidence Based Change Builder updates, launch details, and relevant early-access invitations. |
| Email enquiries | Proton Mail, Proton AG, Switzerland | N/A. Separate email enquiry channel, not participant survey-response storage. | Used to receive and respond to enquiries sent by email. Proton AG is based in Switzerland, which is recognised by the European Commission as providing an adequate level of data protection. |
| Server-side application functions | Vercel dub1 / eu-west-1, Dublin, Ireland | Only if dynamic app logic is used. | Static rollout pages can be served without participant data entering backend storage. Where functions are used, they are configured to run in Dublin. |
| Static website assets | Vercel global CDN | Yes | Static assets do not contain participant survey responses or user-specific data. |
| Authentication records | Supabase, when account-based access is used | No. N/A in account-free survey-link mode. | Used only if account-based access is enabled. |
When account-based access is used, authentication is handled with Better Auth, with auth records stored in Supabase. This keeps account and session records inside the same Ireland-hosted backend setup rather than adding another hosted identity provider.
Evidence Based Change Builder uses Supabase for backend data hosting and Vercel for application hosting and server-side functions. Customer deployment details can be confirmed during onboarding.
Where a customer or collaborator supplies external survey links, they remain responsible for the survey platform, survey content, participant notices, consent wording, lawful basis, retention, and any data collected in that survey system.
Evidence Based Change Builder can also use Tally for a first project where an EU-hosted form tool is preferred, or work with the survey platform an organization already has approved.
Evidence Based Change Builder currently uses necessary cookies and similar technologies only. We do not currently use optional analytics cookies, marketing cookies, social media pixels, or third-party tracking.
Read the cookies policy for the current necessary-only cookies and browser-storage position.