Privacy policy clauses for Supabase (Database)
Supabase is a PostgreSQL database platform with real-time capabilities and row-level security that developers use to store, manage, and sync application data. Websites use it to handle user information, application state, and file uploads with built-in access controls and live data synchronization features.
Free scan · No signup · Results in 60 seconds
What data Supabase (Database) collects
Your privacy policy must disclose each of the following data types when you use Supabase (Database).
When does Supabase (Database) trigger privacy obligations?
When Supabase (Database) Triggers Privacy Obligations
Adding Supabase (Database) creates immediate data collection obligations the moment your application writes user data to its Postgres instance. Unlike client-side trackers, Supabase stores whatever schema and records your app persists—there is no passive default. This triggers:
GDPR (if you process EU residents' data): Article 13 (privacy notice) and Article 28 (processor agreement) apply instantly. Supabase Inc. becomes a data processor; you remain the controller. You must execute a Data Processing Addendum (DPA) with Supabase before storing personal data. Article 32 (security) and Article 5 (lawfulness, fairness, transparency) obligations also activate. If you store sensitive data (health, biometric), Article 9 consent rules apply separately.
