Privacy policy clauses for Supabase Edge Functions
Supabase Edge Functions is a serverless computing platform that runs Deno-based functions on distributed servers, allowing websites to execute backend code without managing infrastructure. Organizations use it to process data, authenticate users, and handle API requests with automatic scaling.
Free scan · No signup · Results in 60 seconds
What data Supabase Edge Functions collects
Your privacy policy must disclose each of the following data types when you use Supabase Edge Functions.
When does Supabase Edge Functions trigger privacy obligations?
Installation & Immediate Data Flows
The moment you deploy a Supabase Edge Function, you begin processing user data in a third-party cloud environment (Deno Deploy infrastructure, operated by Supabase Inc., US-based). This triggers obligations immediately because:
Data in motion: Function invocation payloads, request headers, and authentication tokens are transmitted to Supabase's servers. If your function queries a Supabase database, additional PII may flow through the function's execution context. These are not processed locally—they leave your infrastructure.
GDPR (if you serve EU users): If any user is in the EU, GDPR Articles 5 (lawfulness, transparency) and 28 (processor agreement) activate. You must have a Data Processing Agreement (DPA) with Supabase Inc. in place *before* deploying. Supabase provides a DPA, but you must execute it. Additionally, your privacy policy must disclose that function data is processed in the United States (GDPR Article 13/14).
