You own your data, but you grant Supabase a broad license to use, copy, and display it as needed to operate the service.
This analysis describes what Supabase's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
While customer data ownership is confirmed, the operational license granted to Supabase is broad in scope and includes worldwide rights to reproduce and distribute customer data, which is the standard mechanism by which Supabase can store, back up, and deliver your data through its infrastructure.
The relocation of Supabase's legal entity from Delaware to Singapore may affect which jurisdiction's courts and laws apply to disputes, potentially impacting your ability to pursue claims in US courts and changing which consumer protection laws govern your relationship. The requirement to explicitly click 'I Accept' rather than accepting through sign-up or service use clarifies consent but does not substantively change the agreement's terms. The new section on AI-powered tools discloses that Supabase may use AI chatbots for customer support; review that section to understand how such tools may process your inquiries.
View change record →You retain ownership of all data you upload to Supabase, but the agreement grants Supabase a worldwide, royalty-free license to use and process that data to provide the service. This license is standard for cloud services but means your data may be processed across global infrastructure; review the DPA for data residency and transfer details.
How other platforms handle this
we may share data between our affiliates for the safety and security of our users and may take necessary actions if we believe you have violated these Terms, including banning you from our Services and/or our affiliates' services...
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
Each payment processor uses and processes your complete payment information in accordance with its applicable privacy policy (Stripe and PayPal).
"As between Customer and Supabase, Customer is and will remain the sole and exclusive owner of all right, title, and interest in and to all Customer Data, including all intellectual property rights therein. Customer hereby grants to Supabase a non-exclusive, royalty-free, worldwide license to reproduce, distribute, and otherwise use and display the Customer Data and perform all acts with respect to the Customer Data as may be necessary for Supabase to provide the Services to Customer.Excerpt from Supabase's Terms of Service
REGULATORY LANDSCAPE: The customer data ownership clause and associated license engage GDPR Article 28 (processor obligations) and the principle that data controller instructions govern processor actions.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
While customer data ownership is confirmed, the operational license granted to Supabase is broad in scope and includes worldwide rights to reproduce and distribute customer data, which is the standard mechanism by which Supabase can store, back up, and deliver your data through its infrastructure.
You retain ownership of all data you upload to Supabase, but the agreement grants Supabase a worldwide, royalty-free license to use and process that data to provide the service. This license is standard for cloud services but means your data may be processed across global infrastructure; review the DPA for data residency and transfer details.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Supabase.