Privacy policy clauses for Netlify Functions
Netlify Functions is a serverless computing service that allows websites to run backend code without managing servers. It executes custom functions in response to user requests, enabling dynamic features like form processing, API integrations, and authentication workflows.
Free scan · No signup · Results in 60 seconds
What data Netlify Functions collects
Your privacy policy must disclose each of the following data types when you use Netlify Functions.
When does Netlify Functions trigger privacy obligations?
Netlify Functions trigger privacy obligations the moment you deploy a function that processes user data. Here's what activates compliance requirements:
Data flow trigger: When a Netlify Function receives a request payload containing user information (emails, IPs, form submissions, authentication tokens), you are collecting and processing personal data. This happens automatically—Netlify also captures request metadata and function invocation logs, which may contain PII even if your function code doesn't explicitly extract it.
GDPR (if you have EU users): Processing any personal data of EU residents triggers GDPR obligations regardless of where your server is located. Article 13 requires you to provide privacy information *at point of collection*—meaning before the function processes the data. You must document a lawful basis (Article 6) for processing and establish a Data Processing Agreement (DPA) with Netlify Inc. as your processor under Article 28.
CCPA (if you have California users):
