California Privacy Notice

Effective date: [EFFECTIVE DATE]

This notice applies to residents of California and adds to the Privacy Policy. It serves as our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

Personal information we collect

In the past 12 months we collected these categories of personal information:

Category	Examples	Source	Disclosed for a business purpose to
Identifiers	Name, email address, user id, IP address	You; GitHub or Google if you sign in with them; automatically	Supabase, [CLOUD PROVIDER], [STATIC HOST], [EMAIL PROVIDER]
Customer records	Name, email address, billing customer id	You; Stripe	Supabase, Stripe
Commercial information	Build minutes used, storage used, invoice amounts	Your use of the Service	Supabase, Stripe
Internet or other electronic network activity	Tool calls, builds, request logs, usage statistics	Automatically	Supabase, [CLOUD PROVIDER]
Sensitive personal information	Account log-in (email address with password)	You	Supabase (authentication only)

We use sensitive personal information only to sign you in and secure your account, as permitted by the CCPA regulations, and not to infer characteristics about you. Code and files your agents put into projects are processed on the workspace's behalf.

We use personal information for the purposes in the Privacy Policy: providing the Service, enforcing quotas, billing, security and service communications.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months, and we have no actual knowledge of selling or sharing personal information of consumers under 16.

How long we keep it

We keep each category for as long as described in the Privacy Policy's "How long we keep it" section: account data while your account exists and then [ACCOUNT RETENTION PERIOD]; usage statistics for 32 days on our servers and rollups for [USAGE ROLLUP RETENTION PERIOD]; billing records for [BILLING RECORD RETENTION PERIOD]; logs for [LOG RETENTION PERIOD].

Your rights

As a California resident you have the right to:

know what personal information we collected about you, its sources, purposes and recipients, and get a copy of specific pieces;
delete personal information we collected from you, subject to legal exceptions;
correct inaccurate personal information;
opt out of the sale or sharing of personal information (we do neither);
limit the use of sensitive personal information (we use it only for permitted purposes);
not be discriminated against for exercising these rights.

How to make a request

Email [PRIVACY CONTACT EMAIL] [or call [TOLL-FREE NUMBER], if required]. We verify requests by confirming control of the email address on the account; we may ask for more information when a request concerns sensitive data. We respond within 45 days, and may extend that by another 45 days when reasonably necessary, telling you so.

You may use an authorized agent. We will ask the agent for your signed permission and may ask you to verify your identity directly.

Contact