Data Processing Addendum

Data Processing Addendum

Version 1 — August 1, 2026

This Data Processing Addendum (the “DPA”) supplements and forms part of the Supabase Terms of Service available at https://supabase.com/terms, or such other agreement entered into between the Customer and Supabase Pte. Ltd (“Supabase”) relevant to Customer’s use of the Services (the “Agreement”), and in case of any conflict, supersedes the Agreement in relation to the transfer and processing of Covered Data in connection with the performance of the Services. This DPA is effective as of the Effective Date of the Agreement.

1. Definitions.#

Capitalized terms used but not defined within this DPA will have the meaning set forth in the Agreement. The terms “controller”, “processor”, “business” and “service provider”, whether capitalized or in the lower-case, have the meanings given to them under the Applicable Data Protection Laws. The following capitalized terms used in this DPA will be defined as follows:

"Applicable Data Protection Laws" means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation): the GDPR, Swiss Data Protection Laws and the US Data Protection Laws.

"Biometric Data" means Personal Data resulting from technical processing of physical, physiological or behavioral characteristics such as fingerprints, facial images, iris or voice recognition data, used to identify a natural person.

“CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, including its implementing regulations and the California Privacy Rights Act of 2020.

“Covered Data” means: (a) Personal Data that is provided by or on behalf of Customer to Supabase in connection with Customer's use of the Services, as further described in Schedule 3 (Processing Details) of this DPA; (b) contact information and access credentials relating to, and support requests submitted by, Authorized Users; and (c) any other Personal Data that is otherwise collected, generated or Processed by Supabase in connection with the provision of the Services.

“Customer's Controller” means, where the Customer acts as a processor or service provider (as identified in Schedule 3 (Processing Details)), the controller or business on whose behalf the Customer Processes Covered Data.

“Data Subject” means a natural person whose Personal Data is Processed.

“Deidentified Data” means data created using Covered Data that cannot reasonably be linked to such Covered Data, directly or indirectly.

“GDPR” means Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR”, as defined in section 3 of the Data Protection Act 2018.

“Personal Data” means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise "personal data," "personal information," "personally identifiable information," or similarly defined data or information under Applicable Data Protection Laws.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means. "Process", "Processes" and "Processed" will be interpreted accordingly.

“Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to (including unauthorized internal access to) Covered Data. Security Incidents do not include unsuccessful incidents that are trivial in nature, such as pings and other broadcast service attacks that do not compromise the security of Covered Data.