Supabase Privacy Policy

This privacy notice governs Supabase, Inc.'s collection, use, and disclosure of personal information in connection with its website (supabase.com) and associated developer services, operating under a dual controller/processor framework: Supabase acts as data controller for its own user data and as a data processor for Customer Data submitted through its platform, the latter governed by a separate data processing addendum. The policy states that Supabase collects registration information (name, email, GitHub username), payment transaction data routed through Stripe, communications content, SSO authentication data, usage and device data via cookies and analytics tools, and AI support tool inputs and outputs; it authorizes sharing with service providers, business partners, marketing partners, analytics providers, and in connection with corporate transactions including mergers and acquisitions. The document explicitly carves out Customer Data from the scope of this notice and directs affected individuals to the relevant customer's privacy policy, which is operationally significant for end users of applications built on Supabase who may not be aware their data is governed by a separate contractual chain. The policy engages GDPR (for EEA, UK, and Switzerland users), CCPA (for California residents), Nevada Chapter 603A, and general cross-border data transfer frameworks, with a dedicated EEA/UK/Switzerland section addressing lawful bases, data subject rights, and cookie governance; the document acknowledges that international transfers may involve countries without equivalent data protection standards, a disclosure that directly implicates GDPR Chapter V transfer requirements and UK adequacy frameworks.