mirror of
https://github.com/supabase/supabase.git
synced 2026-09-09 11:30:17 +08:00
Terms of Service v3 (effective August 1, 2026, #48482) incorporates the Data Processing Addendum by reference, so customers no longer sign a separate DPA. Legal confirmed the PandaDoc signing flow can go; previously signed DPAs remain binding. This removes the frontend flow only. I'll remove the platform endpoint (`POST /platform/organizations/{slug}/documents/dpa`) separately once the PandaDoc contract conversation wraps. **Changed:** - **Dashboard DPA card no longer requests PandaDoc documents**: the Request DPA button and confirm modal are replaced with a View DPA link to the canonical legal page, with evergreen copy explaining the DPA is part of the Terms. Tracked via the same `document_view_button_clicked` event the other document cards use. - **Legacy `/legal/dpa` page retired**: the page told users to request a signed DPA from the dashboard, which no longer exists. It now permanently redirects to `/legal/customer-resources/data-processing-addendum` (the follow-up already flagged in #48483), and the footer link is removed. The `dpa_pdf_opened` and `dpa_request_button_clicked` events are removed with their last call sites. The latest privacy version links the canonical page directly; archived v1/v2 keep their original `/legal/dpa` link, served by the redirect. - **Orphaned DPA PDFs removed**: the four dated `Supabase+DPA+*.pdf` files under `/downloads/docs` had zero remaining references once the signing flow is gone. No redirect: nothing links these URLs, so they 404. - **Subscription tracking**: the subprocessor updates form now fires `www_subprocessor_updates_subscribed` on successful submit, so we can measure uptake of the notification list that replaces per-customer DPA emails. ## To test Verified on the Vercel previews (Playwright): - [x] Studio: `/org/_/documents` shows the DPA card with the incorporation copy and a working View DPA link (href = canonical page); no Request DPA button, no PandaDoc mention; TIA/SOC2/ISO27001/HIPAA cards unaffected - [x] www: `/legal/dpa` permanently redirects to `/legal/customer-resources/data-processing-addendum`; footer no longer shows DPA; zero console errors - [x] www: subscribing on the subprocessor page succeeds (200 from the form route, profile created with topic_4) and fires `www_subprocessor_updates_subscribed` (201 from the telemetry endpoint); test profile unsubscribed afterwards - [x] www: `/downloads/docs/Supabase+DPA+260601.pdf` returns 404 with no redirect; DPA card copy verified without the effective date ## Linear - fixes GROWTH-1068
130 lines
4.4 KiB
TypeScript
130 lines
4.4 KiB
TypeScript
import { useSendTelemetryEvent } from '~/lib/telemetry'
|
|
import Link from 'next/link'
|
|
import { useState } from 'react'
|
|
import { Button, Input, Label } from 'ui'
|
|
|
|
const isValidEmail = (email: string): boolean => {
|
|
const emailPattern = /^[\w-\.+]+@([\w-]+\.)+[\w-]{2,8}$/
|
|
return emailPattern.test(email)
|
|
}
|
|
|
|
/**
|
|
* Subscribe form for subprocessor update notifications.
|
|
* Mirrors components/SecurityNewsletterForm.tsx, posting to the
|
|
* /api-v2/submit-form-subprocessor-updates route (Customer.io "Subprocessor Alerts", topic_4).
|
|
*/
|
|
const SubprocessorUpdatesForm = () => {
|
|
const [firstName, setFirstName] = useState('')
|
|
const [lastName, setLastName] = useState('')
|
|
const [email, setEmail] = useState('')
|
|
const [status, setStatus] = useState<'idle' | 'loading' | 'success' | 'error'>('idle')
|
|
const [errorMessage, setErrorMessage] = useState('')
|
|
const sendTelemetryEvent = useSendTelemetryEvent()
|
|
|
|
const handleSubmit = async (e: React.FormEvent) => {
|
|
e.preventDefault()
|
|
setErrorMessage('')
|
|
|
|
if (!firstName || !lastName || !email) {
|
|
setErrorMessage('All fields are required.')
|
|
return
|
|
}
|
|
|
|
if (!isValidEmail(email)) {
|
|
setErrorMessage('Please enter a valid email address.')
|
|
return
|
|
}
|
|
|
|
setStatus('loading')
|
|
|
|
try {
|
|
const res = await fetch('/api-v2/submit-form-subprocessor-updates', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ firstName, lastName, email }),
|
|
})
|
|
|
|
if (!res.ok) {
|
|
const data = await res.json()
|
|
throw new Error(data.message || 'Something went wrong')
|
|
}
|
|
|
|
setStatus('success')
|
|
sendTelemetryEvent({ action: 'www_subprocessor_updates_subscribed' })
|
|
} catch (err: any) {
|
|
setStatus('error')
|
|
setErrorMessage(err.message || 'Something went wrong. Please try again.')
|
|
}
|
|
}
|
|
|
|
return (
|
|
<div className="border rounded-xl bg-surface-75 p-4 md:p-6 w-full max-w-lg not-prose">
|
|
<p className="text-foreground-light text-sm text-pretty mb-6">
|
|
<strong className="text-foreground">Subscribe to updates</strong>. Receive an email
|
|
notification when Supabase updates its sub-processors. By submitting this form, you
|
|
acknowledge and agree that Supabase will process your personal information in accordance
|
|
with our{' '}
|
|
<Link
|
|
href="https://supabase.com/privacy"
|
|
className="text-brand-link hover:underline"
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
>
|
|
Privacy Policy
|
|
</Link>
|
|
.
|
|
</p>
|
|
|
|
{status === 'success' ? (
|
|
<p className="text-foreground text-sm">
|
|
Thanks for subscribing! You'll receive an email when Supabase updates its sub-processors.
|
|
</p>
|
|
) : (
|
|
<form onSubmit={handleSubmit} className="flex flex-col gap-4">
|
|
<div className="grid grid-cols-1 md:grid-cols-2 gap-4">
|
|
<div className="flex flex-col gap-2">
|
|
<Label htmlFor="subprocessor-first-name">First name</Label>
|
|
<Input
|
|
id="subprocessor-first-name"
|
|
type="text"
|
|
value={firstName}
|
|
onChange={(e) => setFirstName(e.target.value)}
|
|
placeholder="First name"
|
|
required
|
|
/>
|
|
</div>
|
|
<div className="flex flex-col gap-2">
|
|
<Label htmlFor="subprocessor-last-name">Last name</Label>
|
|
<Input
|
|
id="subprocessor-last-name"
|
|
type="text"
|
|
value={lastName}
|
|
onChange={(e) => setLastName(e.target.value)}
|
|
placeholder="Last name"
|
|
required
|
|
/>
|
|
</div>
|
|
</div>
|
|
<div className="flex flex-col gap-2">
|
|
<Label htmlFor="subprocessor-email">Email</Label>
|
|
<Input
|
|
id="subprocessor-email"
|
|
type="email"
|
|
value={email}
|
|
onChange={(e) => setEmail(e.target.value)}
|
|
placeholder="Email"
|
|
required
|
|
/>
|
|
</div>
|
|
{errorMessage && <p className="text-destructive text-sm">{errorMessage}</p>}
|
|
<Button variant="primary" size="large" type="submit" loading={status === 'loading'}>
|
|
Subscribe
|
|
</Button>
|
|
</form>
|
|
)}
|
|
</div>
|
|
)
|
|
}
|
|
|
|
export default SubprocessorUpdatesForm
|