Version v0.37 of Metabase is no longer supported. Check out the docs for the current stable version, Metabase v0.63.
Do we need a Data Processing Agreement with Metabase to comply with GDPR?
Metabase is a self-hosted application, and as such we have no access to any data on your instance. We only collect anonymized usage stats if you opted-in during installation, but even in that case, we see no personally identifiable data. As such, we are not a data processor for the purposes of GDPR.
Read docs for other versions of Metabase.