Supabase
Weighted across nine legal categories. Lower is worse.
Executive summary
Supabase's Terms & Conditions demonstrate strong data ownership and IP protections, including explicit safeguards against using customer data to train AI models. However, the agreement imposes asymmetric risk through mandatory arbitration with class-action waivers, broad customer indemnification for negligence, strict non-refundable payment terms, and unilateral modification rights. The 30-day arbitration opt-out and small claims carve-out provide partial mitigation, and venue allocation by geography (Asia, Europe, US) is reasonable. The service is oriented toward developers, and technical provisions favor fair use, but small businesses and individuals face significant exposure.
Category breakdown
Acceptance of Terms & Scope
Contract formation and service boundaries
Clear acceptance mechanism via 'I ACCEPT' button and prominent notice of arbitration/class waiver clauses. Service scope is well-defined (Cloud Services for internal business use per Order). However, the 53,098-character document is dense and complex, and implicit acceptance through continued use of the service adds ambiguity beyond the click-through.
Key findings
- Explicit 'I ACCEPT' button triggers agreement formation
- Scope limited to Cloud Services and features in Order
- Arbitration and class waiver clauses prominently flagged in all-caps warnings
- 53,098 characters makes comprehensive review difficult for typical users
Evidence from the document
THIS AGREEMENT TAKES EFFECT WHEN YOU CLICK THE 'I ACCEPT' BUTTON BELOW OR BY ACCESSING OR USING THE SERVICES
Such use is limited to Customer's internal business purposes and the features and functionalities specified in the Order
PLEASE READ THESE TERMS CAREFULLY TO ENSURE THAT YOU UNDERSTAND EACH PROVISION. THIS AGREEMENT CONTAINS A MANDATORY INDIVIDUAL ARBITRATION PROVISION
Recommendations
- Review the separate Data Processing Addendum and Privacy Policy referenced in the terms
- Take note of the arbitration opt-out mechanism and exercise it within 30 days if you prefer court access
- Understand that continued use after signup constitutes acceptance of updates
User Accounts
Registration, suspension, and termination
Service suspension is permitted with 'commercially reasonable efforts to provide written notice,' which is vague and does not guarantee advance notice. Grounds for suspension are broad (security threats, business disruption). Termination requires notice and cure periods, but suspension can occur quickly. Data export is available through service features, though the mechanism is somewhat discretionary.
Key findings
- Suspension possible for security threats, disruption to other customers, fraud, or insolvency
- Notice required but standard is 'commercially reasonable efforts,' lacking a specific timeline
- No distinction between urgent suspension (fraud) and routine suspension (policy breach)
- Data export available during subscription but no guaranteed export on termination
- 30-day cure period for material breaches before termination
Evidence from the document
Supabase may temporarily suspend Customer's and any Authorized User's access to any portion or all of the Services if: (i) Supabase reasonably determines that (A) there is a threat or attack
Supabase shall use commercially reasonable efforts to provide written notice of any Service Suspension
Customer may export the Customer Data at any time through the features and functionalities made available via the Services
Recommendations
- Regularly export your critical data while account is active, do not rely on termination export
- Monitor account for any suspension notices and respond promptly
- Keep documentation of your business use to support any appeal of suspension decisions
Intellectual Property & UGC
Content ownership and licensing
Strong protection for customer-generated content. Customer retains full ownership of Customer Data. Supabase receives only the licenses necessary to operate the service, and crucially, explicitly excludes AI training on customer data without consent. Data export is always available. Feedback clause is one-way but standard for the industry.
Key findings
- Customer retains all ownership of Customer Data
- Supabase cannot train AI models on customer data without explicit written consent
- Data export available anytime during subscription
- Perpetual license to Aggregated Data (anonymized) is allowed
- Supabase IP (platform, documentation) remains company property
Evidence from the document
Customer owns all right, title, and interest, including all intellectual property rights, in and to the Customer Data
Supabase will not use, nor allow any third-party to use, Customer Data, Customer's AI Input, or any AI Output to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, without Customer's prior written consent
Customer may export the Customer Data at any time through the features and functionalities made available via the Services
Supabase may (i) make Aggregated Data available to third parties including its other customers
Recommendations
- Review AI training consent carefully if Supabase offers AI features that could benefit from your data
- Keep copies of your data outside Supabase for backup and portability
- Understand that anonymized aggregate statistics from your usage may be shared with other customers
Data Privacy
Data collection, usage, and protection
Privacy framework is reasonable but depends heavily on external documents (Privacy Policy, Data Processing Addendum) not included in the T&C. Data Processing Addendum is incorporated, and special protections are required for HIPAA and payment card data. Limited detail on data collection practices or user consent mechanisms within the T&C itself.
Key findings
- Privacy Policy is external and subject to change
- Data Processing Addendum is incorporated by reference
- Business Associate Agreement required for HIPAA-protected health information
- Prior written approval needed for payment cardholder data
- Aggregated statistics collection is permitted and shared with third parties
- Customer responsible for configuring security and backup of data
Evidence from the document
Supabase's privacy policy, available at https://supabase.com/privacy ('Privacy Policy') is subject to change
Customer is responsible for properly configuring and using the Services and taking its own steps to maintain appropriate security, protection, and backup of Customer Data
Customer may not store or process protected health information (as defined in HIPAA) using the Services unless Customer signs a Business Associate Agreement with Supabase
Recommendations
- Review the Privacy Policy at supabase.com/privacy and the Data Processing Addendum before processing sensitive data
- If handling HIPAA data, ensure a Business Associate Agreement is in place
- Verify in writing that payment card storage is approved before storing card data
- Configure data retention policies in the service to limit exposure
Payment & Subscriptions
Billing and subscription management
Payment terms are strict: all fees are non-refundable, and there is no mention of proration for early termination. Auto-renewal is clearly disclosed with a 30-day non-renewal notice requirement (a positive). Late payment triggers interest (1.5% monthly, capped at highest legal rate) and can lead to service suspension. EU and UK consumers lose their statutory 14-day withdrawal right if they start using the service during the trial period.
Key findings
- All fees are non-refundable
- Auto-renewal continues unless 30-day non-renewal notice given
- Interest on late payments at 1.5% monthly (capped by law)
- Service suspension possible after 10 days of non-payment
- No explicit proration for partial periods
- EU/UK consumers waive 14-day statutory withdrawal right if service begins during trial
Evidence from the document
Fees paid by Customer are non-refundable
This Agreement will automatically renew for additional successive terms equal to the length of the Initial Subscription Period unless earlier terminated pursuant to this Agreement's express provisions or either Party gives the other Party written notice of non-renewal at least thirty (30) days prior
Supabase may charge interest on the undisputed past due amount at the rate of 1.5% per month
you expressly consent to the immediate provision of the services and acknowledge that you waive your right to cancel the service and receive a refund under applicable consumer protection laws
Recommendations
- Set calendar reminders 30 days before renewal to cancel if you plan to stop using the service
- Review your billing statements monthly for unexpected charges
- If EU/UK resident, do not begin using the service during the 14-day withdrawal period unless you are certain you want to continue
- Understand that payment disputes do not suspend the service (unless you notify Supabase within 10 days with good faith dispute claim)
Limitation of Liability
Risk allocation and legal protection
Well-drafted limitation clause with proper carve-outs for excluded liabilities (gross negligence, fraud, willful misconduct, and indemnification obligations). Liability cap is tied to fees paid in the preceding 12 months, which is reasonable and proportionate. The language is clear and conspicuous (all caps). However, the cap is absolute for most damages, and even the 3X multiplier for excluded liabilities may be insufficient for critical service failures.
Key findings
- Excluded liabilities include gross negligence, fraud, willful misconduct, confidentiality breaches, and indemnification
- Standard liability cap is limited to amounts paid in preceding 12 months
- Excluded liabilities capped at 3X amounts paid
- No liability for consequential, incidental, indirect, or special damages
- Clear all-caps presentation of key limitations
- Severability clause preserves enforceability if one provision is void
Evidence from the document
EXCEPT FOR: (I) A PARTY'S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS; (II) A PARTY'S INDEMNITY OBLIGATIONS; OR (III) A PARTY'S GROSS NEGLIGENCE, FRAUD, OR WILLFUL MISCONDUCT
IN NO EVENT WILL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY...EXCEED THE TOTAL AMOUNTS PAID AND/OR PAYABLE TO SUPABASE UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE CLAIM
Supabase will have no liability for any damage, liabilities, losses (including any loss of data or profits), or any other consequences that Customer or any Authorized User may incur as a result of a Service Suspension
Recommendations
- Understand that Supabase's liability is capped even for data loss or service downtime
- Consider purchasing errors and omissions insurance for mission-critical services
- Review backup and disaster recovery plans, as Supabase's liability will not cover all potential losses
- Document the fees paid annually to understand your maximum recovery
Indemnification
Legal responsibility allocation
Asymmetric indemnification burden on customer. Customer indemnifies Supabase for claims arising from customer data infringement and from customer negligence or willful misconduct, with no cap. Supabase's indemnification is narrow (only for direct infringement of Supabase IP used in accordance with the agreement, excluding combinations with unauthorized technology). Customer cannot settle claims without Supabase consent. Supabase controls the defense at customer expense. This arrangement is heavily one-sided.
Key findings
- Customer indemnifies for data infringement and any claims based on customer negligence or willful misconduct
- Customer indemnification is uncapped and broad
- Supabase indemnification limited to direct IP infringement only
- Supabase carve-outs exclude unauthorized technology, modifications, third-party products, and AI-related claims
- Supabase controls defense and settlement while customer pays costs
- Customer may not settle without Supabase consent
Evidence from the document
Customer shall indemnify, hold harmless, and, at Supabase's option, defend Supabase from and against any Losses resulting from any Third-Party Claim that the Customer Data, AI Input or any use of the Customer Data in accordance with this Agreement, infringes or misappropriates such third party's US intellectual property or other rights and any Third-Party Claims based on Customer's or any Authorized User's (i) negligence or willful misconduct
Supabase shall indemnify, defend, and hold harmless Customer from and against any and all losses, damages, liabilities, costs (including reasonable attorneys' fees) ('Losses') incurred by Customer resulting from any third-party claim...that the Services...infringes or misappropriates such third party's US copyrights or trade secrets
Customer may not settle any Third-Party Claim against Supabase unless Supabase consents to such settlement
Recommendations
- Be extremely careful about what data and content you upload to the platform
- Ensure you have rights to all content and data before uploading
- Consider errors and omissions insurance to cover indemnification exposure
- Review third-party licenses carefully before integrating with Supabase
- Document your due diligence on data ownership and rights
Modification of Terms
How agreements can be changed
Supabase reserves the right to change the agreement at discretion, with only 'reasonable notice' (undefined timeframe) via email or other method reasonably designed to notify. Acceptance occurs through continued use at the next renewal period, which is prospective (good). No explicit right to reject and cancel is stated, but implied through the renewal-period application. The 'last modified' date tracking is promised but provides limited practical benefit without clear version history.
Key findings
- Unilateral modification right for Supabase
- Notice standard is vague ('reasonable notice')
- Applied prospectively at next renewal period or new order
- Acceptance through continued use after notice
- Last modified date tracking promised but no version archive mentioned
- No explicit right to reject and cancel, though non-renewal is possible
Evidence from the document
Supabase may change this Agreement (except for any Orders) from time to time at its discretion
Supabase will provide Customer with reasonable notice prior to any amendments or modifications taking effect, either by emailing the email address associated with Customer's account on the Services or by another method reasonably designed to provide notice to Customer
If Customer accesses or uses the Services after the effective date of the revised Agreement, such access and use will constitute Customer's acceptance of the revised Agreement beginning at the next Renewal Subscription Period
Recommendations
- Monitor your email for T&C update notices from Supabase
- Review the Supabase website periodically to check for term changes
- Plan to review changes before your subscription renewal date if you want to cancel
- Consider taking screenshots of the current terms for reference
- Pay special attention to changes in dispute resolution, data use, or payment terms
Governing Law & Disputes
Jurisdiction and conflict resolution
Supabase imposes mandatory pre-dispute arbitration and class action/jury trial waivers, limiting consumers' access to courts. Arbitration is governed by ICC Rules with venues allocated by geography (Singapore for Asia, London for Europe, San Francisco for US/others), which is reasonable. Critical mitigation: 30-day opt-out window for new customers and carve-out for small claims court for individuals. However, the arbitration applies retroactively to all disputes 'that arose or were asserted before' agreement acceptance, and the class waiver prevents economic remedies for small-dollar harms.
Key findings
- Mandatory pre-dispute binding arbitration for all claims
- Class action and jury trial waivers in place
- 30-day opt-out window available by email (significant mitigation)
- Small claims court carve-out for individuals (positive)
- Reasonable venue allocation: Asia, Europe, US by geography
- Informal dispute resolution required first (60 days)
- Retroactive application to disputes arising before agreement acceptance
- California law governs; FAA preempts state law on arbitration
Evidence from the document
READ THIS SECTION CAREFULLY BECAUSE IT REQUIRES THE PARTIES TO ARBITRATE THEIR DISPUTES AND LIMITS THE MANNER IN WHICH CUSTOMER CAN SEEK RELIEF FROM SUPABASE
If you are a new customer, you can reject and opt out of this Arbitration Agreement within thirty (30) days of accepting this Agreement by emailing Supabase at legal@supabase.io
By entering into this Agreement, each Party is waiving the right to a trial by jury or to bring, join, or participate in any purported class action, collective action, private attorney general action, or other representative proceeding
the Claim shall be finally settled under the Rules of Arbitration ('Rules') of the International Chamber of Commerce ('ICC')
Recommendations
- Within 30 days of signup, email legal@supabase.io to opt out of arbitration if you prefer court access
- For small claims (under your jurisdiction's limit), use small claims court rather than arbitration
- Understand that arbitration decisions are final and not appealable
- Try informal dispute resolution first to avoid ICC arbitration costs
- Consider the arbitration venue when evaluating the service
Ex-TerCo provides automated analysis of legal documents for informational purposes. This is not legal advice. Terms can change at any time.