Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“We may share limited personal information, such as contact identifiers (including email addresses or cryptographic hashes of email addresses), with advertising and marketing partners...”
“Please note the country to which personal data is transferred may not provide the same level of protection for personal information as the country from which it was transferred.”
“We use this information to send you marketing communications in accordance with your preferences. We will only use your personal information in this way to the extent you have given us consent to do so.”
“We may transfer any information we collect in the event we sell or transfer all or a portion of our business or assets...we will use reasonable efforts to ensure that any transferred information is treated in a manner consistent...”
“Our services are not intended for children under the age of 13. We do not knowingly solicit or collect personal information from children under the age of 13.”
“These third parties are subject to reasonable confidentiality terms and provisions restricting their use of your personal information”
This document explains what data Supabase collects about you, how it uses and shares that data, and your rights around it. Supabase collects everything you submit to its AI tools and uses your personal information for marketing, but it will not share the content of your databases or your User Content with third parties for advertising purposes. Supabase can change these privacy terms at any time in its sole discretion.
The Supabase Privacy Policy establishes the conditions under which Supabase collects, uses, shares, and transfers personal information and User Content. Supabase collects the full content of AI tool interactions — both user inputs and generated outputs — as part of normal Service operation, while committing not to access the content of user databases without consent. Personal information may be shared with advertising and marketing partners, including via hashed email addresses, and may be transferred in connection with a business sale or asset transfer, though User Content is absolutely prohibited from third-party marketing use absent explicit user submission for that purpose. International data transfers carry an acknowledged risk of reduced legal protection in destination countries. Supabase reserves the right to amend the policy in its sole discretion.
Supabase collects both the prompts you submit to its AI tools and the outputs generated in response, and uses your personal information — including potentially a hashed version of your email address — for marketing and advertising purposes. Supabase will not send you marketing communications unless you have given consent, so withdrawing or withholding that consent limits its authority to contact you for marketing. The content of your databases and the information you manage through the Service will not be accessed by Supabase without your consent, and your User Content will not be shared with third parties for marketing or advertising unless you have explicitly submitted it for that purpose.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
2 important changes detected
5 versions captured · Latest change detected by ConductAtlas: September 2026
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“We may share limited personal information, such as contact identifiers (including email addresses or cryptographic hashes of email addresses), with advertising and marketing partners...”
“Please note the country to which personal data is transferred may not provide the same level of protection for personal information as the country from which it was transferred.”
“We use this information to send you marketing communications in accordance with your preferences. We will only use your personal information in this way to the extent you have given us consent to do so.”
“We may transfer any information we collect in the event we sell or transfer all or a portion of our business or assets...we will use reasonable efforts to ensure that any transferred information is treated in a manner consistent...”
“Our services are not intended for children under the age of 13. We do not knowingly solicit or collect personal information from children under the age of 13.”
“These third parties are subject to reasonable confidentiality terms and provisions restricting their use of your personal information”
“When you submit a query through our Supabase AI tool, we will collect the content of your query (i.e. your inputs or prompts), and the corresponding generated output.”
“We reserve the right to change this Privacy Notice from time to time in our sole discretion.”
“We will not access the content of the databases itself or the information you manage through the Service without your consent.”
“This includes any inputs you provide to our AI-powered support tools and outputs generated in response to your inputs. User Content and any information contained in the User Content...is stored and collected as part of the Service.”
“we do not use User Content to send you ads, and we will never share User Content with any third parties for marketing or advertising purposes, unless you have explicitly submitted it to us for that purpose”
“For marketing and advertising purposes, such as to market to you or offer you with information and updates on our products or services we think that you may be interested in...”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Supabase has updated this document before. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Access and deletion requests not guaranteed to be satisfied and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.