Change record
CA-X-002132
Supabase Privacy Policy
Entity
Date detected
May 15, 2026
Severity
Low
Direction
Neutral
Taxonomy
Disclosure requirement change
Changes
+4 sentences added · 3 sentences modified

Impact Summary

Generated by a model from the captured document; not read by a person
Low Neutral for users
Affected users
All users Business users

Supabase expanded its marketing practices and vendor disclosures in its privacy policy. The updated terms now explicitly state that the company may use business contact information to identify organizations for sales and marketing outreach, and that it relies on user consent for three marketing-related purposes: sending marketing communications, using approximate location information to determine relevant communications, and combining personal information from different sources for relevance. The policy also now discloses that Customer.io is used as a service provider to help send and segment marketing communications, and clarifies that marketing-related consents are independent and can be withdrawn separately.

Stay ahead of the changes
Track Supabase and hear on the next check after its terms change. We check daily where we can, and show you where we can't.
Share 𝕏 Share in Share 🔒 PDF

What this means for you

Generated by a model from the captured document; not read by a person

The updated policy clarifies that Supabase relies on your consent for three specific marketing purposes: sending marketing communications, using approximate location information to determine which communications are relevant to you, and combining personal information from different sources to determine relevance. The policy now explicitly discloses that Customer.io is used to help send and segment marketing communications. The updated terms state that these marketing consents are independent of one another, meaning you can give or withdraw any of them without affecting the others. You can manage these consents separately according to the mechanisms Supabase provides.

What you can do

→ Review the updated marketing consent options in your Supabase account settings to understand which marketing purposes you have consented to.

→ Withdraw any marketing consents you do not wish to provide, noting that each consent is independent and can be withdrawn separately.

Key Clauses Affected

Generated by a model from the captured document; not read by a person
Marketing consent framework

Policy now explicitly itemizes three independent marketing-related consent purposes: sending communications, using location data for relevance, and combining personal information for relevance.

Service provider disclosure

Policy now names Customer.io as a service provider used to send and segment marketing communications.

Full clause-by-clause analysis available with Insight.
ⓘ

This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology

Evidence Verification

✓ Verified
Previous Version
2cff08d82b7b8221c2013b71675ff3f9be44665cb217bf333c53624b94d69114
May 5, 2026 06:38 UTC
✓ Verified
Current Version
7df721dc6d9c35ddc3e51a229e364e46fa9c80975d256d592eac70d7094298d3
May 15, 2026 01:20 UTC
✓ Verified
Change Detected
May 15, 2026 01:20 UTC
✓
Analysis Methodology
✓ Verified
Source Document
https://supabase.com/privacy
Record history

Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.

2026-10-11 · Feed summary edited · summary regenerated by summarize_events
Previous text
Adds disclosure of business contact use for marketing outreach and Customer.io data sharing; requires consent for location-based and cross-source marketing analysis.
2026-10-11 · Impact summary edited · summary regenerated by summarize_events
Previous text
The updated policy discloses that Supabase may use business contact information, including email domains, to identify organizations for sales and marketing outreach. The policy now explicitly states that personal information will be shared with Customer.io, a marketing communications service provider. For marketing communications, the policy relies on user consent for three purposes: sending marketing messages, using approximate location information to determine relevant communications, and combining personal information from different sources for relevance determination. These three consents operate independently, meaning you can grant or withdraw any of them without affecting the others. You can manage these marketing-related consents separately through the consent mechanisms available in your account or in response to marketing communications.
2026-10-11 · Summary edited · summary regenerated by summarize_events
Previous text
Supabase updated its privacy policy on May 15, 2026 to disclose expanded use of business contact information for sales and marketing outreach, expanded sharing of personal information with the marketing service provider Customer.io, and clarified consent requirements for marketing communications including location-based and cross-source data analysis. The updated policy establishes that marketing-related consents are independent and can be managed separately.
2026-10-07 · Change line edited · change line rewritten to the 2026-10-07 template: no detection date, no sentence counts
Previous text
Supabase updated their Supabase Privacy Policy on May 15, 2026. Change detected: 4 sentence(s) added, 3 sentence(s) modified. Document contained 317 sentences after update.
Citation Record
Entity: Supabase
Document: Supabase Privacy Policy
Record ID: CA-X-002132
Version: CA-V-002658
Captured: 2026-05-15 01:20:27 UTC
URL: https://conductatlas.com/change/2026-05-15-supabase-supabase-privacy-policy-2132/
Accessed: Oct. 24, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
For legal and compliance teams

Institutional Analysis

Generated by a model from the captured document; not read by a person
Assessment

Supabase clarified its marketing consent framework and expanded vendor disclosures. The change adds explicit language describing three distinct marketing-related consent purposes and names Customer.io as a service provider for marketing communications and segmentation. This aligns …

🔒 Full institutional analysis

Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.

Unlock the full institutional analysis — Insight

ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-002132.

Full Changes

View complete diff →

Document Context

Version history → Policy drift analysis → Document page →
Document
Supabase Privacy Policy
Entity
Supabase
Captured
May 15, 2026
Source URL
https://supabase.com/privacy
Other changes to Supabase Privacy Policy
Next change Sep 17, 2026
Supabase updated its Privacy Policy to reflect a change in corporate entity from Supabase, Inc. to Supabase Pte. Ltd., which …
Low Neutral
View full version history →
More from Supabase
Oct 7, 2026 Medium
Supabase Terms of Service

Supabase revised its Terms of Service to clarify the contracting entity and expand the definition of Customer Data to include …

Sep 17, 2026 Low
Supabase Privacy Policy

Supabase updated its Privacy Policy to reflect a change in corporate entity from Supabase, Inc. to Supabase Pte. Ltd., which …

Jul 31, 2026 Low
Supabase Terms of Service

Supabase revised its Terms of Service with primarily formatting and clarification changes. The most substantive change adds language stating that …

Get the weekly coverage letter

Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.

Stay ahead of the changes

Track Supabase policy changes

Get alerted when this policy changes again, including what changed and why it matters.

All Supabase changes →