8 Total
2 High severity
5 Medium severity
1 Low severity
Summary

This is the legal agreement that governs your use of Supabase's database and backend cloud platform, covering everything from how you can use the service to what happens when disputes arise. The most important thing to know is that the agreement includes mandatory arbitration and a class action waiver, meaning disputes must generally be resolved individually through arbitration rather than in court, unless you opt out within 30 days of your first acceptance. If you want to preserve your right to sue in court or join a class action, you should send a written opt-out notice to legal@supabase.io within 30 days of first accepting these terms.

Technical / Legal Breakdown

This Agreement governs access to and use of Supabase's proprietary hosted cloud services platform, constituting a binding contract between the customer and Supabase Pte. Ltd., a Singapore-incorporated entity, effective upon click-through acceptance or service access. The agreement states that customers receive a non-exclusive, non-transferable, non-sublicensable license to the services for internal business purposes only, while Supabase retains all intellectual property rights including in Aggregated Data derived from customer use; the terms also authorize Supabase to suspend services without prior notice under defined circumstances including security threats, illegal activity, or payment failures. Notably, the agreement includes a mandatory individual arbitration clause and class action/jury trial waiver applicable to all disputes, with an opt-out mechanism, and a broad competitive use restriction prohibiting use of Supabase IP for competitive analysis or development of competing products; the enforceability of the arbitration clause and class action waiver may be constrained under certain jurisdictions, including EU member states and some US state courts, and does not automatically override applicable consumer protection law. The agreement engages GDPR and other data privacy frameworks through its Personal Information and Aggregated Data definitions and its data processing representations; customers operating under GDPR, CCPA, or sector-specific regulations should evaluate whether Supabase's use of Aggregated Data derived from customer data and the DPA referenced in the agreement satisfy their upstream compliance obligations. Customers subject to Singapore law as governing law should note that Section 13 dispute resolution provisions are stated to apply to the fullest extent permitted by applicable law, which may limit enforceability outside the US context.

Institutional Analysis

Institutional analysis available with Professional

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Start Professional free trial

1 important change detected

2 versions captured · Last updated: May 2026

May 6, 2026

medium
What changed Supabase updated its legal entity from a Delaware corporation to a Singapore-based company and refined several procedural details in its Terms of Service. Key changes include clarifying how agreement acceptance works (clicking an explicit 'I Accept' button rather than implicit sign-up), updating documentation URLs, and adding a new section addressing AI-powered support tools. The shift to Singapore incorporation may affect which laws govern disputes and how certain consumer protections apply depending on your location.
Why this matters The relocation of Supabase's legal entity from Delaware to Singapore may affect which jurisdiction's courts and laws apply to disputes, potentially impacting your ability to pursue claims in US courts and changing which consumer protection laws govern your relationship. The requirement to explicitly click 'I Accept' rather than accepting through sign-up or service use clarifies consent but does not substantively change the agreement's terms. The new section on AI-powered tools discloses that Supabase may use AI chatbots for customer support; review that section to understand how such tools may process your inquiries.
View full change record →
High — 2 provisions
Medium — 5 provisions
Low — 1 provision

Monitoring

Supabase has updated this document before.

Watcher includes same-day alerts, structured change summaries, and monitoring for up to 10 platforms.

Start Watcher free trial Or create a free account →

Professional Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Professional includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Professional free trial

Cross-platform context

See how other platforms handle Aggregated Data Commercialization and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
CAN-SPAM
United States Federal
View official text ↗
DMA
European Union
View official text ↗
FAA
United States Federal
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
VPPA
United States Federal
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured May 6, 2026 16:38 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000681
Version ID CA-V-002299
SHA-256 0f68e0578c23fa9e89d10e55a4d905471a9b127eefaa403438d93c63da416e26
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans