Supabase Privacy Policy

This Privacy Notice governs Supabase, Inc.'s collection, use, and disclosure of personal information in connection with its website (supabase.com) and associated developer services, operating as data controller for visitor and customer account data while acting as data processor for Customer Data submitted through the platform under a separate Data Processing Addendum. The policy states that Supabase collects registration data (name, email, GitHub username), payment transaction data (routed through Stripe), communications, usage and device data, and tracking information via cookies and third-party analytics tools; the terms authorize sharing with service providers, business partners, marketing partners, and in connection with corporate transactions such as mergers or acquisitions. Notably, the policy explicitly carves out Customer Data (end-user data processed on behalf of enterprise customers) from this Notice's scope and directs affected individuals to the respective customer's privacy notice, which is operationally distinct and may create transparency gaps for end users of applications built on Supabase. The policy expressly engages GDPR (for EEA, UK, and Switzerland users), CCPA (for California residents), and references Nevada's Chapter 603A; Supabase relies on contractual necessity, legitimate interests, and consent as lawful bases under GDPR, and the DPA governs processor-side obligations separately.