The policy provides a dedicated section for EEA, UK, and Switzerland users covering lawful bases for processing, cookie governance, and data subject rights, incorporating GDPR and UK GDPR compliance requirements.
This analysis describes what Supabase's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Supabase maintains a separate GDPR-aligned disclosure framework for European users, including lawful bases documentation and data subject rights procedures, which are operationally significant for enterprise customers and individual users exercising GDPR rights.
Interpretive note: The full content of the EEA/UK/Switzerland section was not available in the provided document excerpt; the assessment is based on the policy's table of contents reference and the introductory description of the section's scope.
The updated policy discloses that Supabase may use business contact information, including email domains, to identify organizations for sales and marketing outreach. The policy now explicitly states that personal information will be shared with Customer.io, a marketing communications service provider. For marketing communications, the policy relies on user consent for three purposes: sending marketing messages, using approximate location information to determine relevant communications, and combining personal information from different sources for relevance determination. These three consents operate independently, meaning you can grant or withdraw any of them without affecting the others. You can manage these marketing-related consents separately through the consent mechanisms available in your account or in response to marketing communications.
View change record →Under this clause, users in the EEA, UK, and Switzerland are directed to a dedicated section of the policy that sets out the lawful bases for processing their personal information and their rights under GDPR and equivalent frameworks. The agreement establishes that these users have specific rights in respect of their personal information.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
to object to profiling activities based on our own legitimate interests
"European Economic Area, United Kingdom or Switzerland: If you are located in the European Economic Area ("EEA"), United Kingdom or Switzerland, or otherwise engage with Supabase's European operations, please see the Privacy Disclosures for the European Economic Area, United Kingdom and Switzerland for additional European-specific privacy disclosures, including the lawful bases we rely on to process your personal information, how we use cookies when you access our Sites from the EEA, UK or Switzerland and your rights in respect of your personal information.Excerpt from Supabase's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 6, 7, 13, 14, and 15-22 (lawful basis, consent, transparency, and data subject rights), UK GDPR, and the Swiss Federal Act on Data Protection.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Supabase maintains a separate GDPR-aligned disclosure framework for European users, including lawful bases documentation and data subject rights procedures, which are operationally significant for enterprise customers and individual users exercising GDPR rights.
Under this clause, users in the EEA, UK, and Switzerland are directed to a dedicated section of the policy that sets out the lawful bases for processing their personal information and their rights under GDPR and equivalent frameworks. The agreement establishes that these users have specific rights in respect of their personal information.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Supabase.