Candidate Privacy Notice

Version 1 — October 28, 2026

What Does This Privacy Notice Apply To?#

This Candidate Privacy Notice ("Notice") applies to you if you are applying for, interviewing for, or are being considered for a position with Supabase Pte. Ltd. or Supabase Inc., (collectively, "Supabase," "we," "us," or "our") (also collectively, the "Recruitment Activities"). This Notice explains how we collect, process, use, and share personal information about you—including information that directly identifies you or that makes you identifiable—during our recruitment process.

This Notice applies whether you apply directly through our careers page, through a recruiter, at an event, through a referral from an existing team member, or through any other channel through which you express interest in a position with Supabase. It also applies if you are being considered for a position even if you did not formally apply.

This Notice is our standard candidate privacy notice. Depending on the jurisdiction in which you are applying for a position, we may provide you with supplementary region-specific privacy disclosures or notices that address local legal requirements.

Information We Collect About You?#

We collect personal information about you from multiple sources for the purposes of conducting Recruitment Activities. The following table describes the categories and types of personal information we collect, organized by source.

Source	Information Collected
Information You Provide Directly to Supabase
Career Portal or Similar	Name, email address, phone number, mailing address, work authorization status and eligibility, educational background and credentials, employment history, skills and certifications, resume or curriculum vitae, cover letter, work samples or portfolio materials, location preferences, availability for interviews, any additional information you choose to include in free-text responses.
Interviews & Video Calls	Information from your responses during interviews and conversations with our recruiting team, including interview notetaking, audio or video recordings (if recorded), and any materials or presentations you provide during interviews or pipeline stage, any voluntarily provided diversity or demographic information (if you chose to provide it), records of any offer stage data (if you reached that stage).
Assessment & Evaluation	Responses to skills assessments, coding tests, or other evaluation tools we administer, performance scores and results, written responses to prompt-based assessments, post-interview opinions.
Reference Checks	Information from your named references, including confirmation of employment history, performance evaluations, professional relationships and conduct, suitability for the role applied for, other information referees choose to provide.
Application Communications	Email correspondence between you and our recruiting team, scheduling preferences and availability, questions or inquiries you send to us, your responses to our follow-up questions, status inquiries or requests for timeline updates.
Offer & Employment Agreement Execution	Name, email address, and contact information, signature and signing timestamp, IP address and device information used during signing, any metadata about document access and execution, personal information included in the offer letter or employment agreement (such as agreed-upon salary, job title, start date, employment terms), any attachments or exhibits to employment agreements you sign, record of your acceptance and agreement to terms.
Hiring	Government-issued ID information (type, number, expiration date), work authorization verification data, tax information and documentation, emergency contact name and relationship, banking or payment information (if you consent to collection).
Information from Third Parties
Talent Sourcing	Candidate profile ID and linked identifiers, name and professional title, education history, professional experience and employment history, skills listed on your profile, endorsements and recommendations visible on your profile, geographic location, headline or summary you have published, profile visibility and activity (if publicly available), employment and educational institution information, any messaging or connection requests.
Selection Analytics	Candidate profile ID and linked identifiers, job preferences and role matching data, skills assessment results, resume or CV, engagement metrics (page views, application interactions, time spent on portal), matching analytics and scoring data.
Background Checks	Personal identifiers used to run background checks (name, date of birth, address), government-issued ID verification data, criminal record information (where permitted by applicable law), employment history verification results, education credentials verification, sanctions and watchlist screening results (AML/PEP screening where applicable), any other checks we request in compliance with local law, results and reports from the background check process.
Employment Setup & Onboarding	All personal information previously collected during Recruitment Activities, employment agreement and offer acceptance records, work authorization and compliance verification, tax registration and documentation, social security number or equivalent government identifier (where required by law), banking and payment information for salary disbursement, benefits enrollment information and elections, emergency contact and personal background information (marital status, dependents, etc.), health or disability information (to the extent required to administer benefits or to comply with employment law), any information necessary to establish your employment and payroll in the country where you will work, compliance documentation specific to local employment and social security laws.

Sensitive Personal Information We May Collect About You?#

Depending on your location and our Recruitment Activities, we may collect certain special or sensitive categories of information:

Recordings Data: Recorded audio and video from interviews or assessments.
Ethnic or National Origin: Information voluntarily provided through diversity questionnaires or demographic surveys.
Health Information: Disclosure of disability or health conditions.
Conviction Information: Criminal records or conviction data from background check providers.

How Will We Use This Information About You? And With Which Legal Basis?#

Recruitment Activities covered by this Notice include:

Reviewing your CV, resume, application, or other submitted materials;
Screening your qualifications and background;
Conducting interviews (in person, by phone, by video, or otherwise);
Administering assessments, skills tests, and other evaluation tools, as well as assessing how your profile matches with selection criteria;
Analyzing trends in hiring manager questions, candidate concerns and expectations to improve recruiter materials, coach interviewers and foster candidate engagement;
Conducting background checks (where permitted by applicable law);
Checking references and conducting reference calls;
Communicating with you about open positions and your candidacy;
Preparing, negotiating, and submitting job offers;
Collecting information necessary for onboarding and compliance purposes (such as, without limiting to, work authorization verification, tax information, and emergency contacts).

Legal Basis Explained#

Singapore#

Singapore's data protection framework does not require a separate "legal basis" determination. Instead, we notify you at the time of collection of the purposes for which we collect your information. We collect and process your personal information based on:

Direct Relationship to Stated Purpose: We process your information for the purposes we disclose to you at collection (hiring evaluation, recruitment administration, employment contract preparation).
Legitimate Business Interests: We have legitimate business interests in identifying and hiring suitable candidates, in improving the recruitment process quality and efficiency and in maintaining recruitment records to manage our hiring process and respond to inquiries.
Legal and Regulatory Compliance: We conduct background checks and retain employment records where required by Singapore law or the law of the jurisdiction where you will work.

EU, UK, & Switzerland#

We process your personal information based on the following legal bases:

Legitimate Interests: We identify and hire talented individuals to build our team. We rely on legitimate interests for sourcing, screening, interview evaluation, interview trend analysis and maintaining recruitment records.
Contract: Once we extend you an offer, processing your information is necessary to evaluate and prepare your employment contract. We continue to rely on contract as the basis for employment setup and onboarding activities.
Legal Obligation: We are required by employment law, tax law, and anti-money laundering/sanctions screening law to conduct certain processing (such as background checks and employment verification, as well as collecting health and disability information) and maintain employment records for specified periods.

California#

California does not use a "legal basis" framework. Instead, your personal information can be collected and used for the business purposes we disclose to you:

Disclosed Business Purposes: We collect your information to conduct Recruitment Activities, including identifying candidates, evaluating fit, conducting interviews, improving the recruitment process quality and efficiency, preparing employment offers, and performing background checks. We use your information only for these disclosed purposes.
Service Providers: We share your information with service providers who process your data solely to provide services to Supabase for recruitment purposes. We do not allow service providers to use your information for their own independent purposes.
No Sale or Sharing: We do not "sell" or "share" (as defined under CCPA/CPRA) candidate personal information. Your data is not used for targeted advertising or other purposes beyond the Recruitment Activities.

We do not require your consent for essential Recruitment Activities, such as submitting your resume, being evaluated, or undergoing background checks. However, we do ask for your consent for:

Interview Recording and Notetaking: We request consent before recording video or audio interviews, as well as for notetaking.
Diversity & Demographic Information: We request consent before collecting optional ethnic or nationality data.
Marketing Communications: We request consent before sending you information about future job opportunities.

You have the right to withdraw consent. See "What Are Your Rights?" for information on how to submit a withdrawal. Withdrawal will not affect your candidacy for the role you are applying for.

Balancing Your Rights & Our Interests#

Where we rely on legitimate/business interests, we have balanced your privacy rights against our need to conduct Recruitment Activities that are efficient and fair. This balancing allows us to:

Source and evaluate candidates through dedicated recruitment platforms;
Use AI matching tools to identify the best-fit candidates;
Improve the quality and efficiency of the overall recruitment process;
Maintain recruitment records to respond to inquiries and defend hiring decisions.

You have the right to object to processing based on legitimate interests. See "What Are Your Rights?" for information on how to submit an objection.

Automated Decision-Making#

Supabase uses AI tools to assist with Recruitment Activities, but algorithms never make final hiring decisions. Supabase hiring managers make all final hiring decisions after human review.

How do algorithms assist at each stage?

Main Use Case	What Algorithms Do	Human Control
Candidate Sourcing	AI tools help identify candidate profiles matching our job requirements from large databases. Algorithms rank results by relevance based on skills, experience, location, and profile data.	Supabase recruiters decide which search criteria to use and manually review ranked results.
Candidate Ranking and Matching	AI tools generate matching scores and candidate rankings to help recruiters prioritize qualified candidates. Algorithms analyze candidate profiles against role requirements and experience.	Supabase hiring managers and recruiters manually review all candidate materials and decide which candidates to interview.

Bear in mind that you are not subject to a solely automated hiring decision. Every recruitment decision involves human review:

Sourcing: Algorithms identify and contact candidates;
Screening: Algorithms rank candidates; humans review materials and decide which candidates to interview;
Interviews: Humans conduct interviews and make assessments;
Final decision: Humans decide to hire or reject;

Nevertheless, based on your location, you may have the right not to be subject to a decision based solely on automated processing. See "What Are Your Rights?" for information on how to know more about algorithms and to request human review.

We share your information with carefully selected service providers who help us conduct Recruitment Activities.

Service Provider	Main Use Case
Talent Sourcing Providers	We search profiles to identify candidates for open positions.
Selection Analysis Providers	We use selection platforms to evaluate fit and generate matching analytics.
Application Tracking Systems (ATS)	We use ATSs to manage applications, interviews, feedback, and hiring decisions.
Background Check Providers	We share identity and employment history information to conduct background verification checks.
Document Signing Providers	Offer execution—we share your offer letter and /or employment agreement and collect your electronic signature.
Employer of Record (EOR) Service Providers	Employment and onboarding—if you are hired, we share your information with our EOR provider to establish employment, process payroll, and administer benefits

We contractually require all service providers listed above to:

Implement appropriate security measures;
Process your information only for the purposes we specify;
Comply with applicable data protection laws;
Not use your information for any purpose other than providing services to Supabase;
Assist us in responding to your data subject rights requests.

Supabase remains responsible for ensuring each service provider complies with these obligations and applicable data protection laws.

In addition, we may disclose your personal information to law enforcement, regulators, or courts when required by law, subpoena, or court order. We may also disclose information to prevent fraud, detect security incidents, or comply with employment or tax law obligations.

Finally, if Supabase merges, is acquired, or transfers its business, your information may be transferred to the buyer or successor as part of that transaction.

Where Your Data May Be Transferred?#

Your personal information may be transferred to, stored in, and processed in countries outside the country where you are applying or where you are located, including Singapore and the United States. Supabase relies on appropriate safeguards to authorize international data transfers, particularly for transfers from the European Union, United Kingdom, and Switzerland to countries without an "adequate" level of data protection.

For transfers from the EU/UK/Switzerland, Supabase and our service providers are bound by Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner.

How Do We Secure Your Data?#

Supabase implements and maintains appropriate technical and organizational measures designed to protect your personal information from unauthorized or unlawful processing and from accidental loss, destruction, or damage.

We regularly review our security measures and policies to ensure they continue to be appropriate for the data we protect, and we establish and maintain secure configurations for systems and software used in our Recruitment Activities.

We restrict access to your personal information based on the principle of least privilege, meaning individuals are granted only the access they need to perform their recruitment-related duties, and that access is revoked when no longer needed.

All personal information is encrypted where appropriate for the context in which we store and process it. We also maintain internal monitoring systems designed to detect security incidents and service outages. We have developed and regularly test a comprehensive data breach response plan. In the event of a security incident affecting your personal information, we will notify you and provide information about the incident, mitigation measures, and the status of our investigation, as required by applicable law.

Your personal information may be shared with third-party service providers to the extent necessary to carry out Recruitment Activities. We contractually require all such third parties to implement security measures that are no less protective than the measures Supabase employs, and we remain responsible for ensuring their compliance with applicable data protection standards.

How Long Do We Keep Your Data For?#

We retain candidate personal information for as long as necessary to:

Evaluate your candidacy and conduct our Recruitment Activities;
Fulfill our legal and contractual obligations, including employment law, tax law, and background check retention requirements;
Defend against legal claims or regulatory inquiries related to recruitment decisions;
Comply with applicable law in the jurisdictions where you are applying or where we operate.

If you are hired: Once you accept an offer and join Supabase, your information transitions to our employment records management. Retention periods are then governed by our/EOR’s employment policies and applicable employment and tax laws, which typically require retention for several years post-separation.

If you are not hired: We retain rejected candidate information for a reasonable period to respond to requests, handle disputes, and maintain recruitment records. After that period, we delete your information unless we are required by law to retain it longer.

Our third-party service providers maintain their own retention policies. We contractually require them to delete or return your data when we request it, but retention in their systems may vary by provider and jurisdiction.

You have the right to request deletion of your information in certain circumstances. See the "What Are Your Rights?" section for details on how to submit a deletion request.

What Are Your Rights?#

Depending on your location, you have rights regarding your personal information under applicable data protection laws, including Singapore's PDPA, the EU's GDPR, Switzerland's FADP, the UK's GDPR, and California's CCPA/CPRA/FEHA.

Right	What it means	Available in
Access	Request a copy of your personal information	Singapore, EU/UK/Switzerland, California
Correction	Request we correct inaccurate information	Singapore, EU/UK/Switzerland, California
Deletion	Request we delete your information	EU/UK/Switzerland, California; Singapore via consent withdrawal
Restriction	Request we limit how we use your data	EU/UK/Switzerland only
Portability	Request your data in a portable format	EU/UK/Switzerland, California
Objection	Object to processing (e.g., marketing)	Singapore, EU/UK/Switzerland
Automated Decision Review	Request human review of AI-based decisions	EU/UK/Switzerland, California
Withdraw Consent	Withdraw consent to optional processing	Singapore, EU/UK/Switzerland, California

If you want to exercise your rights, please submit a request to privacy@supabase.io. Make sure to include in your request:

Which right you wish to exercise;
Your full name and email address used in your application;
Your location/jurisdiction;
Brief description of what you're requesting.

We will:

Verify your identity;
Once identity is verified, respond within the applicable timeframe according to jurisdiction;
Not retaliate or penalize you for submitting a request.

Important Notes#

Deletion limitations: We may not be able to delete your personal information if we need it to complete your hire, comply with employment law, or respond to legal obligations;
Processing delays: Exercising certain rights (like restricting processing) may affect our ability to continue evaluating your candidacy;
Fees: We do not charge fees for rights requests, except for manifestly unfounded or excessive requests.

File a Complaint#

If you believe we've violated your rights:

Singapore: Personal Data Protection Commission (PDPC) - www.pdpc.gov.sg
EU/EEA: Your local Data Protection Authority - edpb.europa.eu/about-edpb/our-members_en
UK: Information Commissioner's Office (ICO) - www.ico.org.uk
Switzerland: Federal Data Protection Commissioner (FDPIC) - www.edoeb.admin.ch
California: California Privacy Protection Agency (CPPA) - cppa.ca.gov

We strongly encourage you to contact us first at privacy@supabase.io to resolve any concerns.

What If This Notice Changes?#

We may update this Notice from time to time as our Recruitment Activities evolve or as required by law. We will notify you of any material changes by posting the updated Notice on our Legal Hub and updating the "last version" date. Continued participation in our recruitment process following such changes constitutes your acceptance of the updated Notice.

Contact Us#

If you have questions about whether this Notice applies to your situation or your personal information, please contact us at privacy@supabase.io and we will clarify.