Supabase imposes mandatory pre-dispute arbitration and class action/jury trial waivers, limiting consumers' access to courts. Arbitration is governed by ICC Rules with venues allocated by geography (Singapore for Asia, London for Europe, San Francisco for US/others), which is reasonable. Critical mitigation: 30-day opt-out window for new customers and carve-out for small claims court for individuals. However, the arbitration applies retroactively to all disputes 'that arose or were asserted before' agreement acceptance, and the class waiver prevents economic remedies for small-dollar harms.
Service suspension is permitted with 'commercially reasonable efforts to provide written notice,' which is vague and does not guarantee advance notice. Grounds for suspension are broad (security threats, business disruption). Termination requires notice and cure periods, but suspension can occur quickly. Data export is available through service features, though the mechanism is somewhat discretionary.
Supabase reserves the right to change the agreement at discretion, with only 'reasonable notice' (undefined timeframe) via email or other method reasonably designed to notify. Acceptance occurs through continued use at the next renewal period, which is prospective (good). No explicit right to reject and cancel is stated, but implied through the renewal-period application. The 'last modified' date tracking is promised but provides limited practical benefit without clear version history.
Asymmetric indemnification burden on customer. Customer indemnifies Supabase for claims arising from customer data infringement and from customer negligence or willful misconduct, with no cap. Supabase's indemnification is narrow (only for direct infringement of Supabase IP used in accordance with the agreement, excluding combinations with unauthorized technology). Customer cannot settle claims without Supabase consent. Supabase controls the defense at customer expense. This arrangement is heavily one-sided.
Privacy framework is reasonable but depends heavily on external documents (Privacy Policy, Data Processing Addendum) not included in the T&C. Data Processing Addendum is incorporated, and special protections are required for HIPAA and payment card data. Limited detail on data collection practices or user consent mechanisms within the T&C itself.
Clear acceptance mechanism via 'I ACCEPT' button and prominent notice of arbitration/class waiver clauses. Service scope is well-defined (Cloud Services for internal business use per Order). However, the 53,098-character document is dense and complex, and implicit acceptance through continued use of the service adds ambiguity beyond the click-through.
Payment terms are strict: all fees are non-refundable, and there is no mention of proration for early termination. Auto-renewal is clearly disclosed with a 30-day non-renewal notice requirement (a positive). Late payment triggers interest (1.5% monthly, capped at highest legal rate) and can lead to service suspension. EU and UK consumers lose their statutory 14-day withdrawal right if they start using the service during the trial period.
Well-drafted limitation clause with proper carve-outs for excluded liabilities (gross negligence, fraud, willful misconduct, and indemnification obligations). Liability cap is tied to fees paid in the preceding 12 months, which is reasonable and proportionate. The language is clear and conspicuous (all caps). However, the cap is absolute for most damages, and even the 3X multiplier for excluded liabilities may be insufficient for critical service failures.
Strong protection for customer-generated content. Customer retains full ownership of Customer Data. Supabase receives only the licenses necessary to operate the service, and crucially, explicitly excludes AI training on customer data without consent. Data export is always available. Feedback clause is one-way but standard for the industry.