Your personal data is stored and processed primarily in the US, and may also be sent to PlanetScale's partners in other countries with potentially weaker privacy protections; PlanetScale commits to using legal transfer mechanisms such as adequacy decisions or Standard Contractual Clauses.
This analysis describes what PlanetScale's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
EU, UK, and Swiss users have their data transferred to the US, a jurisdiction that historically has not met the EU's adequacy standard without specific frameworks; the policy's reference to both DPF and contractual protections suggests a layered approach, but the adequacy of those protections depends on which mechanism is applied and whether it remains legally valid.
Personal data from EU, UK, and Swiss users is transferred to and processed in the United States under the Data Privacy Framework or Standard Contractual Clauses; users in these regions should be aware that US national security law may permit governmental access to this data in ways that may not be available under their home country's laws.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"You will provide personal information directly to our website in the United States. We may also transfer personal information to our partners and service providers in the United States and other jurisdictions. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country. When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for personal information and we will comply with applicable data protection laws, in particular by relying on an EU Commission or UK government adequacy decision or on contractual protections for the transfer of personal information.Excerpt from PlanetScale's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR Chapter V governs international data transfers, requiring either an adequacy decision, appropriate safeguards (such as Standard Contractual Clauses under Article 46), or specific derogations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
EU, UK, and Swiss users have their data transferred to the US, a jurisdiction that historically has not met the EU's adequacy standard without specific frameworks; the policy's reference to both DPF and contractual protections suggests a layered approach, but the adequacy of those protections depends on which mechanism is applied and whether it remains legally valid.
Personal data from EU, UK, and Swiss users is transferred to and processed in the United States under the Data Privacy Framework or Standard Contractual Clauses; users in these regions should be aware that US national security law may permit governmental access to this data in ways that may not be available under their home country's laws.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PlanetScale.