Data
GDPR PlanetScale
In an indie stack, PlanetScale is used for Managed MySQL database. Entity cited: PlanetScale, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA PlanetScale
Yes. Public Data Processing Addendum.
Stated role
For Customer Data, the customer is controller and PlanetScale is processor. If the customer is itself a processor, PlanetScale is as well. For account information, PlanetScale presents itself as an independent controller.
Personal data
Personal data contained in customer content, names or contact details of authorized persons, phone numbers, emails, account billing information.
Sub-processors of PlanetScale
Public list.
Transfers outside the EU
Hosting / location
The DPA indicates primary facilities in the United States, and possible processing anywhere PlanetScale or its sub-processors operate. The sub-processor table indicates “United States”, except Pusher Ltd. (Messagebird): “United States & United Kingdom”.
EU–United States Data Privacy Framework
PlanetScale Inc. is registered. EU-U.S. Data Privacy Framework status: Active (non-HR data). United Kingdom extension and Swiss-U.S. DPF: Active.
Cookies
The Cookie Policy (stated update: 21 January 2025) publishes the essential cookies _api_bb_session, _www_session, principal, sso_organization, and tz, on PlanetScale domains. It also indicates Google Analytics and advertising cookies from partners. Names of those third-party cookies: not disclosed.
Typical use, written by StackLégal and not by the vendor: Managed MySQL database.
History
Last update: October 4, 2026.
Cookies: names from the Cookie Policy, in place of "not disclosed".
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is PlanetScale a processor within the meaning of the GDPR?
For Customer Data, the customer is controller and PlanetScale is processor. If the customer is itself a processor, PlanetScale is as well. For account information, PlanetScale presents itself as an independent controller.
What DPA does PlanetScale publish?
Yes. Public Data Processing Addendum. https://planetscale.com/legal/data-processing-addendum
Which further sub-processors does PlanetScale publish?
Public list. https://planetscale.com/legal/subprocessors
Where does PlanetScale state that it processes data, including outside the EU?
The DPA indicates primary facilities in the United States, and possible processing anywhere PlanetScale or its sub-processors operate. The sub-processor table indicates “United States”, except Pusher Ltd. (Messagebird): “United States & United Kingdom”.
Is PlanetScale registered under the EU–United States Data Privacy Framework?
PlanetScale Inc. is registered. EU-U.S. Data Privacy Framework status: Active (non-HR data). United Kingdom extension and Swiss-U.S. DPF: Active. https://www.dataprivacyframework.gov/participant/6402
Which personal data does PlanetScale mention?
Personal data contained in customer content, names or contact details of authorized persons, phone numbers, emails, account billing information.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.