Supabase

Downstream

Who's behind Supabase, as listed in its own subprocessor documents. No subprocessors identified · coverage incomplete: no subprocessor document is on file; the names below come from other documents, if any.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. no training clause matched

Documents read

• privacy policy https://supabase.com/privacyHTTP 200 · 2026-10-13
• dpa https://supabase.com/legal/dpaHTTP 200 · 2026-09-06

Document changes

• low 2026-10-13 · privacy policy +3 / −3 lines
  show diff

  + * California - Your California Privacy Rights: If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. We may use tracking tools to measure the performance of our advertising campaigns and help deliver personalized ads. You can manage your preferences in the .

  + We may use tracking technologies to measure the effectiveness of our advertising campaigns and to help deliver personalized ads. These tools may collect information about your interactions with our ads and websites, which can be used to analyze advertising metrics and tailor ads specifically to you. You can manage your preferences for such tracking technologies in the .

  + We use Analytics cookies to collect information to assess how our Service is used. We will only do so, however, only if you give us your consent to do so.

  − * California - Your California Privacy Rights: If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. We may use tracking tools to measure the performance of our advertising campaigns and help deliver personalized ads. You can manage your preferences in the Privacy Settings.

  − We may use tracking technologies to measure the effectiveness of our advertising campaigns and to help deliver personalized ads. These tools may collect information about your interactions with our ads and websites, which can be used to analyze advertising metrics and tailor ads specifically to you. You can manage your preferences for such tracking technologies in the Privacy Settings.

  − We use Analytics cookies to collect information to assess how our Service is used. We will only do so, however, only if you give us your consent to do so. Manage preferences
• low 2026-09-17 · privacy policy +3 / −3 lines
  show diff

  + Thank you for your interest in Supabase Pte. Ltd., ("Supabase," "we", "our" or "us"). Supabase provides a suite of open source tools, stitched together to build a seamless developer experience. This Privacy Notice explains how information about you, that directly identifies you, or that makes you identifiable ("personal information") is collected, used and disclosed by Supabase in connection with our website at supabase.com (the "Site") and our services offered in connection with the Site (collectively with the Site, the "Service").

  + Supabase Pte. Ltd. is the data controller of your personal information when we use it as described in these Privacy Disclosures, meaning that we determine and are responsible for how your personal information is processed.

  + CookieType of cookieWhen is the cookie dropped?How long does the cookie stay on my device?Purpose of the cookieLinks to respective privacy noticesStripeStrictly necessaryWhen you access the payment interface on our Service.30 minutesDetecting and preventing fraudulent payments and transactions.Stripe Cookie SettingsStripeStrictly necessaryWhen you access the payment interface on our Service.1 yearDetecting and preventing fraudulent payments and transactions.Stripe Cookie SettingsStripeStrictly necessaryWhen you access the payment interface on our Service.2 yearsDetecting and preventing fraudulent payments and transactions.Stripe Cookie SettingsCloudflareStrictly necessaryWhen you first access the Site.30 minutesIdentify and block bots from accessing the Service.Cloudflare CookiesCloudflareStrictly necessaryWhen you first access the Site.End of SessionManage traffic to our Service to ensure that it does not get overloaded.Cloudflare CookiesYoutubeStrictly necessaryWhen you view a Youtube embedded video on our Site.End of SessionTo display embedded videos to you on our Site.Google Cookie PolicyhCaptchaStrictly necessaryWhen you respond to a CAPTCHA to prove you are not a robot.End of SessionTo record your responses to the CAPTCHA and grant you access to certain areas of the Service.hCaptcha Privacy PolicyPosthogAnalyticsWhen you access the Service.1 yearTo monitor and analyze how you use the Service.Posthog Privacy PolicyGoogle Analytics 4AnalyticsWhen you first access the Site.2 years (_ga, FPID), 20 hours (_ga*_, FPLC)To measure ad campaign performance and deliver personalized ads upon consent.Google Analytics Privacy and Google's use of cookiesGoogle AdsAdvertisingWhen you visit the Site after interacting with one of our ads.90 daysTo measure ad campaign performance and deliver personalized ads upon consent.Google Ads Privacy_sb_first_referrerAnalyticsWhen you first visit the Site from an external source.365 daysPreserves original external referrer, UTM parameters, and ad-network click identifiers (e.g. gclid, fbclid) when navigating from marketing site to dashboard. Used for internal analytics only; no third-party sharing.N/A (first-party)FreebuffAdvertisingWhen you visit the Site after interacting with Freebuff ads.30 daysTo measure ad campaign performance and attribute conversions to ad clicks upon consent.Freebuff Privacy Policy

  − Thank you for your interest in Supabase, Inc., ("Supabase," "we", "our" or "us"). Supabase provides a suite of open source tools, stitched together to build a seamless developer experience. This Privacy Notice explains how information about you, that directly identifies you, or that makes you identifiable ("personal information") is collected, used and disclosed by Supabase in connection with our website at supabase.com (the "Site") and our services offered in connection with the Site (collectively with the Site, the "Service").

  − Supabase, Inc is the data controller of your personal information when we use it as described in these Privacy Disclosures, meaning that we determine and are responsible for how your personal information is processed.

  − CookieType of cookieWhen is the cookie dropped?How long does the cookie stay on my device?Purpose of the cookieLinks to respective privacy noticesStripeStrictly necessaryWhen you access the payment interface on our Service.30 minutesDetecting and preventing fraudulent payments and transactions.Stripe Cookie SettingsStripeStrictly necessaryWhen you access the payment interface on our Service.1 yearDetecting and preventing fraudulent payments and transactions.Stripe Cookie SettingsStripeStrictly necessaryWhen you access the payment interface on our Service.2 yearsDetecting and preventing fraudulent payments and transactions.Stripe Cookie SettingsCloudflareStrictly necessaryWhen you first access the Site.30 minutesIdentify and block bots from accessing the Service.Cloudflare CookiesCloudflareStrictly necessaryWhen you first access the Site.End of SessionManage traffic to our Service to ensure that it does not get overloaded.Cloudflare CookiesYoutubeStrictly necessaryWhen you view a Youtube embedded video on our Site.End of SessionTo display embedded videos to you on our Site.Google Cookie PolicyhCaptchaStrictly necessaryWhen you respond to a CAPTCHA to prove you are not a robot.End of SessionTo record your responses to the CAPTCHA and grant you access to certain areas of the Service.hCaptcha Privacy PolicyPosthogAnalyticsWhen you access the Service.1 yearTo monitor and analyze how you use the Service.Posthog Privacy PolicyGoogle Analytics 4AnalyticsWhen you first access the Site.2 years (_ga, FPID), 20 hours (_ga*_, FPLC)To measure ad campaign performance and deliver personalized ads upon consent.Google Analytics Privacy and Google's use of cookiesGoogle AdsAdvertisingWhen you visit the Site after interacting with one of our ads.90 daysTo measure ad campaign performance and deliver personalized ads upon consent.Google Ads Privacy_sb_first_referrerAnalyticsWhen you first visit the Site from an external source.365 daysPreserves original external referrer, UTM parameters, and ad-network click identifiers (e.g. gclid, fbclid) when navigating from marketing site to dashboard. Used for internal analytics only; no third-party sharing.N/A (first-party)
• high 2026-09-06 · dpa +2 / −2 lines
  show diff

  + Customer grants Supabase general authorization (or, where applicable, has Customer's Controller's general authorization) to engage any of the Sub-processors provided in Supabase’s Sub-processor list, available at https://supabase. (“Subprocessor List”), as amended from time to time in accordance with clause 6.3 (the “Authorized Sub-processors”), to Process Covered Data. Supabase shall: (a) enter into a written agreement with each Authorized Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Supabase's obligations under this DPA; and (b) remain liable for each Authorized Sub-processor's compliance with the obligations under this DPA.

  + Supabase offers a mechanism for Customer to subscribe to notifications of changes to the Subprocessor List via https://supabase.. If Customer subscribes to receive such updates, Supabase will provide Customer with at least thirty (30) days' notice of any proposed changes to the Authorized Sub-processors. Customer shall notify Supabase if it objects to the proposed change to the Authorized Sub-processors (including, where applicable, when exercising its right to object under clause 9(a) of the SCCs) by providing Supabase with written notice of the objection within five (5) days after Supabase has provided notice to Customer of such proposed change (an “Objection”). In the event Customer submits an Objection to Supabase, Supabase and Customer shall work together in good faith to find a mutually acceptable resolution to address such Objection. If Supabase and Customer are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, Customer may terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Supabase.

  − Customer grants Supabase general authorization (or, where applicable, has Customer's Controller's general authorization) to engage any of the Sub-processors provided in Supabase’s Sub-processor list, available at https://supabase.com/legal/customer-resources/subprocessor-list (“Subprocessor List”), as amended from time to time in accordance with clause 6.3 (the “Authorized Sub-processors”), to Process Covered Data. Supabase shall: (a) enter into a written agreement with each Authorized Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Supabase's obligations under this DPA; and (b) remain liable for each Authorized Sub-processor's compliance with the obligations under this DPA.

  − Supabase offers a mechanism for Customer to subscribe to notifications of changes to the Subprocessor List via https://supabase.com/legal/customer-resources/subprocessor-list. If Customer subscribes to receive such updates, Supabase will provide Customer with at least thirty (30) days' notice of any proposed changes to the Authorized Sub-processors. Customer shall notify Supabase if it objects to the proposed change to the Authorized Sub-processors (including, where applicable, when exercising its right to object under clause 9(a) of the SCCs) by providing Supabase with written notice of the objection within five (5) days after Supabase has provided notice to Customer of such proposed change (an “Objection”). In the event Customer submits an Objection to Supabase, Supabase and Customer shall work together in good faith to find a mutually acceptable resolution to address such Objection. If Supabase and Customer are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, Customer may terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Supabase.
• high 2026-09-06 · privacy policy +1 / −1 lines
  show diff

  + You also have the right to lodge a complaint to your local data protection authority. If you are based in the European Union, information about how to contact your local data protection authority is available here. If you are based in the UK or Switzerland, your local data protection authorities are the UK Information Commissioner's Office (https://ico.org.uk/global/contact-us/) and the Swiss Federal Data Protection and Information Commissioner (https://www.edoeb.admin..html).

  − You also have the right to lodge a complaint to your local data protection authority. If you are based in the European Union, information about how to contact your local data protection authority is available here. If you are based in the UK or Switzerland, your local data protection authorities are the UK Information Commissioner's Office (https://ico.org.uk/global/contact-us/) and the Swiss Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact/address.html).

Fact changes

No changes recorded yet. Changes appear here when a later reading differs from an earlier one.

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.