Combination

GDPR Supabase, Resend, and Stripe

Name: StackLégal
Brand: StackLégal
Price: 19.00 EUR
Availability: InStock

This page reuses the vendor entries for the stack. It says what to write in the privacy policy and in the processor list. Last update: October 5, 2026.

What the entries say

Location, DPA, further processors and transfer mechanism. Each block links to the entry, which keeps its own check date.

Supabase

Full entry

Supabase Pte. Ltd. Checked on October 4, 2026.

Hosting / location: If the customer designates a region, Supabase states that the covered data is stored and primarily processed there, unless otherwise instructed, legally required, or required for a service requested by the customer. Otherwise, processing may take place anywhere Supabase or its sub-processors have facilities. Stated headquarters: 65 Chulia Street, Singapore. The documentation states that a project is deployed in a single primary region.
DPA: Yes. Public Data Processing Addendum. Source
Further processors: Public sub-processor list. Source
Transfer (Data Privacy Framework): Official search for “Supabase” and “Supabase Pte”: no participant. Not registered.

Resend

Full entry

Plus Five Five, Inc.. Checked on October 4, 2026.

Hosting / location: The DPA states that the primary processing operations are in the United States. Stored data is stored in the United States.
DPA: Yes. Public DPA. Source
Further processors: Public list. Source
Transfer (Data Privacy Framework): The participant “Resend”, legal name PLUS FIVE FIVE, is registered. Exact EU-U.S. Data Privacy Framework status: Active - Re-certification under Review. Source

Stripe

Full entry

Stripe Payments Europe, Limited for accounts outside North and South America; Stripe, LLC for accounts located in North or South America. Checked on October 4, 2026.

Hosting / location: The DPA indicates a transfer to Stripe, LLC in the United States. The privacy policy states that the majority of providers are in the European Union, the United States, and India.
DPA: Yes. The DPA is part of the Stripe Services Agreement. Source
Further processors: Public list of providers, sub-processors, and affiliates. Source
Transfer (Data Privacy Framework): Stripe, LLC is registered. EU-U.S. Data Privacy Framework status: Active. The European entity Stripe Payments Europe, Limited is not the name on that entry. Source

What to write in the policy

You remain the controller of the processing. Three vendors see data of your users: the database, transactional email, and payment. Each has its entry, with its entity, its role, its location, its DPA, and its transfer mechanism.

Supabase Pte. Ltd is the processor, or a sub-processor if you already are one. If you chose a region, the entry states that the covered data is stored and primarily processed there: write the project's actual region. Supabase is not registered under the Data Privacy Framework. Point to its DPA and its sub-processor list.

Resend (Plus Five Five, Inc.) is the processor of email data, and an independent controller for the account, billing, and service usage. The DPA places the primary operations and storage in the United States. The “Resend” participant has status Active - Re-certification under Review.

For Stripe, name your account's entity, the dual role (processor on instruction, independent controller for fraud and AML/CFT), the transfer to Stripe, LLC in the United States, and the DPF registration of Stripe, LLC.

On cookies, the Supabase entry cites the Auth session cookie on your domain and cookies of its own site. The Resend entry indicates essential cookies. Complete this with the cookies that your application sets in addition.

History

October 5, 2026
First publication. The facts are taken from the entries, which cite the official pages. What is not there stays “not disclosed”.

Clauses to paste

One clause per vendor, for the processors section. Review them: a “not disclosed” field must be completed before publication.

Sub-processor clause

Sub-processors

Supabase (Supabase Pte. Ltd). Role stated by the vendor: Supabase acts as processor (service provider) and the customer as controller. If the customer processes on behalf of its own controller, Supabase acts as a sub-processor. Data: The DPA annex cites contact details (first name, last name, email), usage data, account information including the password, and any other information determined by the customer. Location: If the customer designates a region, Supabase states that the covered data is stored and primarily processed there, unless otherwise instructed, legally required, or required for a service requested by the customer. Otherwise, processing may take place anywhere Supabase or its sub-processors have facilities. Stated headquarters: 65 Chulia Street, Singapore. The documentation states that a project is deployed in a single primary region. DPA: Yes. Public Data Processing Addendum. https://supabase.com/legal/customer-resources/data-processing-addendum EU–United States Data Privacy Framework: Official search for “Supabase” and “Supabase Pte”: no participant. Not registered. Further sub-processors: Public sub-processor list. https://supabase.com/legal/customer-resources/subprocessor-list Cookies: The policy (European services cookies section) cites Stripe, Cloudflare, YouTube, hCaptcha, PostHog, and Google Ads cookies, and names _sb_first_referrer (365 days, referrer and UTM parameters) and, for Google Analytics 4, _ga, FPID, _ga*, and FPLC. The SSR documentation states that the Auth session cookie on the customer's domain is called sb-<project_ref>-auth-token by default. Names of the Stripe, Cloudflare, YouTube, hCaptcha, PostHog, and Google Ads cookies: not disclosed. Verified on October 4, 2026 against the official pages cited. A template to review, not legal advice.

Resend (Plus Five Five, Inc.). Role stated by the vendor: Processor of the customer's email data. Independent controller for account, billing, and service-usage data. Data: Email, first name and last name, postal address, IP address and usage data, cookies, message metadata and content, recipient name and attachments, open and click tracking data (device, browser, location). Location: The DPA states that the primary processing operations are in the United States. Stored data is stored in the United States. DPA: Yes. Public DPA. https://resend.com/legal/dpa EU–United States Data Privacy Framework: The participant “Resend”, legal name PLUS FIVE FIVE, is registered. Exact EU-U.S. Data Privacy Framework status: Active - Re-certification under Review. https://www.dataprivacyframework.gov/participant/8907 Further sub-processors: Public list. https://resend.com/legal/subprocessors Cookies: Resend states that it uses only essential cookies, including Supabase login cookies, plus Stripe cookies for payment and fraud prevention. Verified on October 4, 2026 against the official pages cited. A template to review, not legal advice.

Stripe (Stripe Payments Europe, Limited for accounts outside North and South America; Stripe, LLC for accounts located in North or South America). Role stated by the vendor: When Stripe processes on instruction, it acts as the customer's processor, the customer being the controller. Stripe also presents itself as an independent controller for purposes such as fraud, AML/CFT, and operation of the product. Data: The Stripe pages cite in particular payment method and card data, bank account, billing and shipping addresses, name, order description and amount, device identifier, email, IP address and location, tax identifier, customer identifier, and, where applicable, identity documents and facial-recognition data. Location: The DPA indicates a transfer to Stripe, LLC in the United States. The privacy policy states that the majority of providers are in the European Union, the United States, and India. DPA: Yes. The DPA is part of the Stripe Services Agreement. https://stripe.com/legal/dpa EU–United States Data Privacy Framework: Stripe, LLC is registered. EU-U.S. Data Privacy Framework status: Active. The European entity Stripe Payments Europe, Limited is not the name on that entry. https://www.dataprivacyframework.gov/participant/10014 Further sub-processors: Public list of providers, sub-processors, and affiliates. https://stripe.com/legal/service-providers Cookies: The cookies policy distinguishes essential, functional, and advertising cookies, including third-party analytics and marketing cookies. Non-essential cookies can be refused in Stripe's consent settings. Verified on October 4, 2026 against the official pages cited. A template to review, not legal advice.

List assembled on October 5, 2026 from the StackLégal entries. Each block keeps its entry’s check date. “not disclosed” was not confirmed. This is not legal advice.

Related entries

Full pack, from 39 € incl. VAT

The clauses above cover this stack only. StackLégal generates the legal notice, terms of use, terms of sale, privacy policy, Article 28 DPA and the public list, citing only the boxes you tick. One-time payment via Gumroad. This is not legal advice.

From 39 € incl. VAT Check them in the assistant